Secret Sharing and Key Escrow Supplemental Information for Cryptology Class Lecture slides by Richard Newman

Secret Sharing and Key Escrow  touch on a few topics including: Need for key escrow Need for key escrow Basic key escrow approaches and history Basic key escrow approaches and history Secret sharing Secret sharing Threshold schemes Threshold schemes

Need for Key Escrow  Recovery of lost key Keyholder unable to provide key Keyholder unable to provide key Forgotten Forgotten Incapacitated Incapacitated Unavailable Unavailable Keyholder unwilling to provide key Keyholder unwilling to provide key Disgruntled (ex-) employee Disgruntled (ex-) employee Criminal, etc. Criminal, etc.  Legitimate causes Organizational information Organizational information Law Enforcement Law Enforcement  Controls on key recovery Only allow recovery when it is legitimate Only allow recovery when it is legitimate Limit recovery to appropriate elements Limit recovery to appropriate elements

Copyright  protects tangible or fixed expression of an idea but not the idea itself  is automatically assigned when created  may need to be registered in some countries  exists when: proposed work is original proposed work is original creator has put original idea in concrete form creator has put original idea in concrete form e.g. literary works, musical works, dramatic works, pantomimes and choreographic works, pictorial, graphic, and sculptural works, motion pictures and other audiovisual works, sound recordings, architectural works, software-related works. e.g. literary works, musical works, dramatic works, pantomimes and choreographic works, pictorial, graphic, and sculptural works, motion pictures and other audiovisual works, sound recordings, architectural works, software-related works.

Basic Key Escrow  Can store key K with trusted third party S Problem if S is unavailable Problem if S is unavailable Problem if S is compromised Problem if S is compromised Problem if S is dishonest Problem if S is dishonest  Can encrypt key K with key K’, store K’ with trusted third party Same problems as before Same problems as before  Can divide key K into n parts K = K 1 || K 2 || … || K n K = K 1 || K 2 || … || K n But each known part reduces keyspace to search… But each known part reduces keyspace to search… m colluders may be able to guess the rest m colluders may be able to guess the rest

Clipper Chip  US government program Wanted all commercial crypto done with Clipper Wanted all commercial crypto done with Clipper Algorithm secret initially (Skipjack – finally revealed) Algorithm secret initially (Skipjack – finally revealed) Wanted two parties to hold escrowed key for each chip Wanted two parties to hold escrowed key for each chip Law enforcement/executive branchLaw enforcement/executive branch Judiciary/judicial branchJudiciary/judicial branch Ultimately died due to strong public resistance Ultimately died due to strong public resistance  Clipper program key escrow Used XOR approach K = K 1 XOR K 2 Used XOR approach K = K 1 XOR K 2 If K 1 is random number, neither K 1 nor K 2 reveal info other than key length If K 1 is random number, neither K 1 nor K 2 reveal info other than key length

Secret Sharing  Want to share a secret S Say an escrowed key Say an escrowed key  Express S as a number  Derive shares S i from S, i=1,2,…,k  Each shareholder holds part of S  No fewer than k of them can derive any knowledge of S  All k of them can reconstruct S

Shamir’s Polynomial SS  Polynomial of degree k can be specified By k+1 coefficients By k+1 coefficients By k+1 distinct points By k+1 distinct points  Secret is P(x 0 ) Evaluate P at x 0 Evaluate P at x 0  Shares are (x i,P(x i )) for i=1,2,…,k+1 Distribute point pairs to shareholders Distribute point pairs to shareholders Fewer than k+1 points underspecify P(x) Fewer than k+1 points underspecify P(x)

Blakely’s Hyperplane SS  Imagine a k-dimensional space E.g., 3-dimensions E.g., 3-dimensions  Can specify (k-1)-dimensional hyperplanes These must be unique and must all have a common intersection point These must be unique and must all have a common intersection point Any two intersect in a (k-2)-dimensional hyperplane Any two intersect in a (k-2)-dimensional hyperplane E.g., 2-dimensional planes intersect in a line E.g., 2-dimensional planes intersect in a line  K of these hyperplanes intersect in a point The point coordinates constitute the shared secret The point coordinates constitute the shared secret

Threshold Schemes  Extend secret sharing so that any k of n shareholders can recover secret Useful for fault tolerance Useful for fault tolerance And for threshold authorization policies And for threshold authorization policies  Examples Shamir: issue more points of polynomial Shamir: issue more points of polynomial Any k points of a k-1 degree polynomial specify polynomialAny k points of a k-1 degree polynomial specify polynomial Issue more than k points; any k of them will doIssue more than k points; any k of them will do Blakely: issue more intersecting hyperplanes Blakely: issue more intersecting hyperplanes Any k hyperplanes in a k-dimensional space specify the secretAny k hyperplanes in a k-dimensional space specify the secret Issue n>k hyperplanes; any k will doIssue n>k hyperplanes; any k will do

Threshold Scheme Uses  Fault tolerant key/secret escrow  Multifactor authentication Require multiple tokens, passwords, etc. Require multiple tokens, passwords, etc. Allow for fault tolerance – lost token, e.g. Allow for fault tolerance – lost token, e.g. Helps discourage theft (can’t use stolen object without the other needed elements) Helps discourage theft (can’t use stolen object without the other needed elements)  Multiparty authorization Require multiple parties to sign credential Require multiple parties to sign credential May be based on roles – so any k can sign May be based on roles – so any k can sign May be made hierarchical May be made hierarchical

Summary  reviewed a range of topics: Key escrow need, history, approaches Key escrow need, history, approaches Secret sharing Secret sharing Threshold schemes and uses Threshold schemes and uses