Re: [Mathmesh] [Cfrg] A different approach to key escrow

[Nico Williams <[e-mail]>]

On Mon, Sep 02, 2019 at 05:20:30PM -0400, Phillip Hallam-Baker wrote:
> At the moment, the approach used to escrow Mesh keys is
> 
> * Generate a master secret of at least 128 bits
> * Use the master secret to derive an AES 256 encryption key and
> initialization vector under which the private key information is encrypted.
> * Use a content digest of the master secret as the identifier under which
> the escrow record is stored on some sort of service (TBS).
> * Use Shamir secret sharing to split the master secret  n out of m ways
> 
> This works with any public key algorithm but it requires a service. It has
> since occurred to me that I may have gone down a blind alley because I
> designed this part of the system back when RSA was still the default
> algorithm (we were discussing the CFRG curves at the time). I am now
> thinking about using this approach:
> 
> * Generate a master secret of at least 128 bits
> * Use a KDF to generate the master key pairs for Encryption and Signature
> from the master secret
> * Use Shamir secret sharing to split the master secret  n out of m ways
> 
> Thoughts?

I don't see why in the first case you'd need a separate service to store
the private keys encrypted in the master secret.  All the entities that
hold secret shares can also hold copies of the encrypted record along
with the secret shares.

In any case, both of these approaches have similar security properties.
Most importantly, compromise of a master secret compromises all the
private keys it protects.

However, you might find it difficult to generate key pairs from a master
secret, especially if you ever need to generate keys on a hardware
token.  If you won't have that requirement, and if you're willing to
have that as an anti-requirement, then the second scheme is simpler,
indeed, and the entities that store key shares will need to store
smaller records.

> One side benefit of this approach is that it becomes quite easy to give
> test vectors, just give the master secret used to generate the key pairs.
> 
> I know 128 bits is short, my preference is for 256 bits. But given the
> number of times this ends up going through SHA-2-512, I am not really
> worried.

In a PQ world you want 256 bits of entropy, otherwise 128 bits is
sufficient.

Nico
--