[Secdispatch] Deterministic generation of public key pairs

[Phillip Hallam-Baker <[e-mail]>]

[Yes I know this is too late for Vancouver, wanting to discuss]

As folk may have noticed, I am currently proposing CFRG start work on the
threshold cryptography work used in the Mesh. I would appreciate views on
what should be done with another piece of the Mesh, the UDF scheme.

The original goal of UDF was fairly modest, 'lets do PGP fingerprints a bit
better using Base32'. But it has since gown. Most of the pieces are pretty
unremarkable. How many formats do people need to represent a nonce in text?

But one part that I have discovered is increasingly useful is the use of
deterministic key generation. So for example let us say I use the udf tool
to create an SSH key:

udf keygen /x448
UDF: ZAAA-FFQA-3LE5-SAHG-E6K6-HOTN-TVLB-K4A

udf config ssh-agent ZAAA-FFQA-3LE5-SAHG-E6K6-HOTN-TVLB-K4A

This is a seed that can be written down and can be used to generate a
private keypair using any of the commonly used public key algorithms. So
you can use it for any application where you would use traditional key
escrow.

One thing I use this for is to move S/MIME and PGP keys about. Can also use
it to keep a paper back up of whole disk encryption keys etc.

The spec (but not the tool yet) also supports Shamir Secret Sharing. I need
to rejig that to match the developments in the threshold spec.


So is this something we should do and if so where? This is separable from
the Mesh and does have some functionality overlap. But it also makes a lot
of common sysadmin config much easier.