[Mathmesh] A different approach to key escrow

Phillip Hallam-Baker <phill@hallambaker.com> Mon, 02 September 2019 21:20 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: mathmesh@ietfa.amsl.com
Delivered-To: mathmesh@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 645701201A3 for <mathmesh@ietfa.amsl.com>; Mon, 2 Sep 2019 14:20:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.4
X-Spam-Status: No, score=-1.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id 3kXXTbIqqyrw for <mathmesh@ietfa.amsl.com>; Mon, 2 Sep 2019 14:20:40 -0700 (PDT)
Received: from mail-oi1-f169.google.com (mail-oi1-f169.google.com []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0193112021C for <mathmesh@ietf.org>; Mon, 2 Sep 2019 14:20:39 -0700 (PDT)
Received: by mail-oi1-f169.google.com with SMTP id v12so11225153oic.12 for <mathmesh@ietf.org>; Mon, 02 Sep 2019 14:20:39 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=o0plS9kcB0EyY+Q2aGR7HN/2gyh28jQNqomQTolsBcc=; b=UjjJSx92MZllet6+Slso5Rt+pML19LfRqDWqD/Wo7IP8MdtYNr28gLGpAmfFT+hA01 c1f/+RFmWPMIwh+bjjBbm4xzB3d4My3GTlxzHgwOZZMTlkHVavYu/k99Ep1u/8J2CLsZ z+2SZ8nZ2i2CB4eSNCa6XTGdbYPpBzjoulkswPlTd5Fgkwm5ctrHsGGEjG8FndJBKujZ HvE87wpLuART0JeTprBi8SaiDG+28QuGJx6VmM7hX6/4r8FdxRYRxTcsKNxXSRtFLJ0o vGoY6WpAj6x/1SjP/KTy/hB6cgZzue2MQblxVZ0uzNGb0iXx+GXIb+kLPbZNbh6y4ECh SG+g==
X-Gm-Message-State: APjAAAWI/20Hw086lfThmSUFrrA4lDcFa78BRR4rONHC8YlkurSfdMUB fIO8bbLJmk1O1Lvc6P9AmbILekPFrDawc5qvdS81aeI1
X-Google-Smtp-Source: APXvYqwMnqqKkDdxZEYHdmN1heZrXBpO/tz56BNAOCjP6trlNBQboIkSCkDW7BjKhg9o8H0dEJirAeTowvyddMsEOzc=
X-Received: by 2002:aca:782:: with SMTP id 124mr20768285oih.95.1567459239076; Mon, 02 Sep 2019 14:20:39 -0700 (PDT)
MIME-Version: 1.0
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Mon, 2 Sep 2019 17:20:30 -0400
Message-ID: <CAMm+LwiZqA=M90YdmQOV+sAy+T-prhzphct2bsOyPmaQ4V2oOA@mail.gmail.com>
To: mathmesh@ietf.org, cfrg@irtf.org
Content-Type: multipart/alternative; boundary="000000000000252a0c0591988bd2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/mathmesh/u7YdZIjqNqB6CR2gk_OvkV5wREg>
Subject: [Mathmesh] A different approach to key escrow
X-BeenThere: mathmesh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <mathmesh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mathmesh>, <mailto:mathmesh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mathmesh/>
List-Post: <mailto:mathmesh@ietf.org>
List-Help: <mailto:mathmesh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mathmesh>, <mailto:mathmesh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 02 Sep 2019 21:20:52 -0000

[ccd to CFRG for comment]

At the moment, the approach used to escrow Mesh keys is

* Generate a master secret of at least 128 bits
* Use the master secret to derive an AES 256 encryption key and
initialization vector under which the private key information is encrypted.
* Use a content digest of the master secret as the identifier under which
the escrow record is stored on some sort of service (TBS).
* Use Shamir secret sharing to split the master secret  n out of m ways

This works with any public key algorithm but it requires a service. It has
since occurred to me that I may have gone down a blind alley because I
designed this part of the system back when RSA was still the default
algorithm (we were discussing the CFRG curves at the time). I am now
thinking about using this approach:

* Generate a master secret of at least 128 bits
* Use a KDF to generate the master key pairs for Encryption and Signature
from the master secret
* Use Shamir secret sharing to split the master secret  n out of m ways


One side benefit of this approach is that it becomes quite easy to give
test vectors, just give the master secret used to generate the key pairs.

I know 128 bits is short, my preference is for 256 bits. But given the
number of times this ends up going through SHA-2-512, I am not really