61–69 of 69 posts
https://en.bitcoin.it/wiki/Shamir_Secret_Snakeoil More on the subject of the post, this is now the third near-miss company destruction I've heard about due to SSS. Hopefully some of the others will make their stories public. The snakeoil page linked above doesn't really get into "when it's secure against you". One of the other stories I heard that was most similar to the paypal one failed for a different reason than…
OK, since we're pitching our SSS implementations here in comments, I welcome everyone to check out BananaSplit, https://bs.parity.io Not sure about year 2023, but at the time I wrote it for my previous employer there was nothing remotely usable for regular user. Thus, BananaSplit. It doesn't allow you to specify many parameters (just the number of shards, and then requires 50%+1 to recover); aimed at printed backups…
I like how it pushes you towards safety by requiring the code to run offline and off the disk. The resulting UX is not that great (though the explanation of what to do is clear), but it's a good step towards a little bit more security.
`killall` was different on Solaris than Linux; too. Learning those differences by coming to Linux from Solaris was liberating; there were less limits generally. The other way around was less fun: as in this example, code that had run fine before was now subject to weird behaviors that were caused by underlying system assumptions being different. At least Solaris usually had decent documentation.
I took down the production environment once with killall. The conversation explaining to management about why I ran something called "killall" and didn't expect it to kill all was very tense.
https://docs.oracle.com/cd/E86824_01/html/E54764/killall-1m....
For anybody new or returning to SSS, check out SLIP-0039: https://github.com/satoshilabs/slips/blob/master/slip-0039.m... One of the big downsides of SSS is that it’s very raw and you have to do a lot of legwork to make it actually useable. For instance, you can sss_combine any arbitrary polynomial coefficients and get a result, you don’t know if the reconstituted data is correct until you try to use it. Implementati…
Great story! It made me super nervous all the way. I also built a pure python lib a whole ago to use w/ an app, check it out: https://github.com/HacKanCuBa/secretshare-py It uses prime arithmetic, which limits severally the input size, but it works pretty well and fast. Not production ready BC I haven't tested it enough, but it is a good starting point.
Does this count as an instance of 'don't roll your own crypto'?
Eh, yes and no. With proper testing this issue should have been caught. But this is also an example of how small details in crypto can become a huge issue and domain knowledge counts for a lot. As soon as the story turned to getpass() on Solaris I already knew what it was because the 8-character limit is pretty famous if you've worked on old Unix systems.
They couldn't believe that anyone wants trailing spaces on their password.
Great story! It made me super nervous all the way. I also built a pure python lib a whole ago to use w/ an app, check it out: https://github.com/HacKanCuBa/secretshare-py It uses prime arithmetic, which limits severally the input size, but it works pretty well and fast. Not production ready BC I haven't tested it enough, but it is a good starting point.
Couldn't you just pick a big prime to get bigger input sizes supported?