Re: [Cfrg] [Mathmesh] A different approach to key escrow

OK so here is the difference.

In each case

Alice's master secret is
     97 BE C3 8C  EC 32 E3 A8  14 BE 38 AC  49 B3 58 D0

This has the UDF representation:
   ECL3-5Q4M-5QZO-HKAU-XY4K-YSNT-LDIA

We can split that using shamir secret sharing:

   f(1) = SAYE-UHOY-TVZO-LPGT-ZAGE-7JUW-6MTJ-I
   f(2) = SAYX-4HWP-3753-L4P3-N4S6-C2G4-QVPA-A
   f(3) = SAZD-HQNJ-KSDK-HAY7-BIFO-34Y2-NH7O-C
   f(4) = SAZW-WBTE-7MJ2-44B6-TC5X-KRKQ-UEEW-U
   f(5) = SA2C-H3IC-2ORN-NOK2-DM3X-OX37-FJ6W-Q

The difference is how we generate the private key pairs.

What is done now is that the Master Profile key pairs for encryption and
signature are generated in the normal way. The private keys are wrtiten out
to an escrow record that is encrypted under ECL3-5Q4M...

So recovery requires at least three of the key shares plus the encrypted
escrow record.

The other way to go about it is to use a KDF to generate the private keys
for the master profile:

Signing Key = HKDF ( [97 BE C3 8C EC 32 E3 A8 14 BE 38 AC 49 B3 58 D0],
"mmm/mesh-signature/Ed448". 448)
Escrow Key = HKDF ( [97 BE C3 8C EC 32 E3 A8 14 BE 38 AC 49 B3 58 D0],
"mmm/mesh-escrow/X448", 448)

So now recovery of the escrow record ONLY requires the master secret
ECL3-5Q4M-5QZO-HKAU-XY4K-YSNT-LDIA.
There is no encrypted escrow record.

Pros: More convenient.
Cons: The private keys have less ergodicity and are related by means of the
HMAC function.

If we are confident of our algorithms being secure, 2^128 is an infeasible
work factor. And if you look into how the scheme is implemented, we are not
talking about SHA-2-512 (x), we are talking about SHA-2-512 ( SHA-2-512 (
SHA-2-512 ( SHA-2-512 (x)  )  )  ).

If we are not confident of our algorithms being secure, we can use any size
work factor we like up to the size of our private key size. The recovery
shares just get a bit larger.

What I like about this is that I can easily specify an example key set just
by giving the master secret.

On Tue, Sep 3, 2019 at 1:08 AM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

>
> Phillip Hallam-Baker <phill@hallambaker.com> wrote:
>     > This works with any public key algorithm but it requires a service.
>
> ....
>
>     > * Generate a master secret of at least 128 bits
>     > * Use a KDF to generate the master key pairs for Encryption and
> Signature
>     > from the master secret
>     > * Use Shamir secret sharing to split the master secret  n out of m
> ways
>
>     > Thoughts?
>
> I don't understand how the need for the service is different.
>
>     > One side benefit of this approach is that it becomes quite easy to
> give
>     > test vectors, just give the master secret used to generate the key
>     > pairs.
>
> please expand.
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-
>
>
>
> --
> Mathmesh mailing list
> Mathmesh@ietf.org
> https://www.ietf.org/mailman/listinfo/mathmesh
>