Shamir Secret Sharing • Hacker News Board

Re: Shamir Secret Sharing

#41

Post by richman66 » Wed, Aug 02, 2023, 3:58 PM UTC

[flagged]

Re: Shamir Secret Sharing

#42

Post by pravus » Wed, Aug 02, 2023, 4:30 PM UTC

c7b wrote: post #11

Does this count as an instance of 'don't roll your own crypto'?

Eh, yes and no. With proper testing this issue should have been caught. But this is also an example of how small details in crypto can become a huge issue and domain knowledge counts for a lot. As soon as the story turned to getpass() on Solaris I already knew what it was because the 8-character limit is pretty famous if you've worked on old Unix systems.

Re: Shamir Secret Sharing

#43

Post by rssoconnor » Wed, Aug 02, 2023, 5:27 PM UTC

dcow wrote: post #38

For anybody new or returning to SSS, check out SLIP-0039: https://github.com/satoshilabs/slips/blob/master/slip-0039.m... One of the big downsides of SSS is that it’s very raw and you have to do a lot of legwork to make it actually useable. For instance, you can sss_combine any arbitrary polynomial coefficients and get a result, you don’t know if the reconstituted data is correct until you try to use it. Implementati…

SLIP-0039 was pretty inspirational in the development of codex32 for doing SSS by hand on paper computers: https://secretcodex32.com/ and https://secretcodex32.com/docs/2023-03-07--color.pdf

Re: Shamir Secret Sharing

#44

Post by pxc » Wed, Aug 02, 2023, 5:43 PM UTC

kirushik wrote: post #9

OK, since we're pitching our SSS implementations here in comments, I welcome everyone to check out BananaSplit, https://bs.parity.io Not sure about year 2023, but at the time I wrote it for my previous employer there was nothing remotely usable for regular user. Thus, BananaSplit. It doesn't allow you to specify many parameters (just the number of shards, and then requires 50%+1 to recover); aimed at printed backups…

This is pretty cool!

Mozilla SOPS¹ also supports this, but it's not nearly as user friendly for non-technical folks. Probably one of those solutions you reviewed before creating Banana Split!

--

1: https://github.com/getsops/sops

Re: Shamir Secret Sharing

#45

Post by firesteelrain » Wed, Aug 02, 2023, 7:00 PM UTC

nightpool wrote: post #23

firesteelrain wrote: post #4

Now we have HashiCorp Vault that serves this purpose and uses shamir.

Yes, I agree, HashiCorp Vault definitely serves the purpose of having a single point of failure that can go down and take your entire company down with it, just like in the story :P (c.f. Roblox)

I mean you could have a Vault and Consul cluster with auto unsealing.

Re: Shamir Secret Sharing

#46

Post by pastage » Wed, Aug 02, 2023, 7:01 PM UTC

kirushik wrote: post #9

OK, since we're pitching our SSS implementations here in comments, I welcome everyone to check out BananaSplit, https://bs.parity.io Not sure about year 2023, but at the time I wrote it for my previous employer there was nothing remotely usable for regular user. Thus, BananaSplit. It doesn't allow you to specify many parameters (just the number of shards, and then requires 50%+1 to recover); aimed at printed backups…

Doesn't seem to understand that the file is local when opening in Chrome on Android, interesting.

Re: Shamir Secret Sharing

#47

Post by unethical_ban » Wed, Aug 02, 2023, 8:11 PM UTC

kirushik wrote: post #9

OK, since we're pitching our SSS implementations here in comments, I welcome everyone to check out BananaSplit, https://bs.parity.io Not sure about year 2023, but at the time I wrote it for my previous employer there was nothing remotely usable for regular user. Thus, BananaSplit. It doesn't allow you to specify many parameters (just the number of shards, and then requires 50%+1 to recover); aimed at printed backups…

I'm not sure the offline mode instructions for Firefox are accurate.

Re: Shamir Secret Sharing

#48

Post by xcdzvyn » Wed, Aug 02, 2023, 8:50 PM UTC

seanhunter wrote: post #10

ThePowerOfFuet wrote: post #2

>The idea (proposed by Adi Shamir – the A of RSA! – in 1979) is as simple as it is beautiful. Leonard Adleman might have something to say about that sentence.

Adleman is the S in RSA

Adi Shamir might have something to say about that sentence.

Re: Shamir Secret Sharing

#49

Post by tzs » Wed, Aug 02, 2023, 9:52 PM UTC

Most descriptions of and implementations of Shamir secret sharing are a bit intimidating. If however you just need a system where any two people with shares can reconstruct the secret then SSS can be very short and simple.

Let

  a0 = the secret
   p = a prime number > a0
  a1 = a random integer in [1, p-1]

Assign each person who is to receive a share of the secret an ID in [1, p-1]. It is OK to simply assign IDs sequentially starting at 1.

Here is how to generate the share for the person with ID i:

  Si = (a0 + i*a1) % p

Tell each person their ID and given them their share. When each person has received their ID and share you can delete a0 and a1.

To recover the secret given Si from person with ID i and Sj from person with ID j, do this in Python 3.8 or later:

  a0 = ((j*Si - i*Sj) * pow(j-i, -1, p)) % p

Pow(x, -1, m) for integers x and m in Python >= 3.8 computes the modular inverse of x mod m.

If you need to generate a share for a new person or regenerate a share for an existing person get shares from two people and recover a0 as described above. Recover a1 like this:

  a1 = ((Sj - Si) * pow(j-i, -1, p)) % p

You can then use a0 and a1 to issue or reissue shares as described earlier.

Re: Shamir Secret Sharing

#50

Post by nullc » Thu, Aug 03, 2023, 1:29 AM UTC

https://en.bitcoin.it/wiki/Shamir_Secret_Snakeoil

More on the subject of the post, this is now the third near-miss company destruction I've heard about due to SSS. Hopefully some of the others will make their stories public. The snakeoil page linked above doesn't really get into "when it's secure against you".

One of the other stories I heard that was most similar to the paypal one failed for a different reason than password truncation: Since they needed the key very infrequently and most participants never (since the threshold was met by other parties) too many people forgot their passwords. A better way to use it would be to always enter all the people who were not outright unavailable and consider it a serous failure for any party to be unavailable too often.