Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Shamir's Secret Sharing Works

ente.com

Post reply on HN
Print view View original

81–88 of 88 posts

Re: How Shamir's Secret Sharing Works

#81

Post by ghostfoxgod »

hamburglar wrote: post #79
ghostfoxgod wrote: post #78

Earlier quoted context omitted.

Honestly those are 100% fair questions, for (1), I have a security page: https://eternalvault.app/security/ but mainly because of marketing purposes, most people I have as customers are in their 30-40s and not fairly technical, so when they ask me, I have to be mindful to not bombard them with too much technical info, but it's a good idea to still have a whitepaper with more detailed info for someone who actually wan…

Well one idea I had that changes the operational posture somewhat is to have the “reader” UX be a static page served completely from S3 and referencing other static S3 resources (the encrypted blob), then have the dead man’s switch “fail open” if the “user is not dead yet” signal goes offline. That way the company could almost run out of money and cease active operations but still have the data be readable by end use…

Ngl, I was working on a "Save this page offline" feature, the idea was similar to what you said, it's more like a snapshot in time, you can export your whole vault encrypted with the SSS and an offline ready page to come to and unlock the vault.

In my idea, the doomsday trigger handling might be difficult if it was a truly offline page, so I've not yet thought it fully on how it can be executed well, I'll revisit that idea again with fresh eyes.

And thanks for the reach out, would love to chat more on email!

Re: How Shamir's Secret Sharing Works

#82

Post by UltraSane »

3eb7988a1663 wrote: post #12

Do the people who hold the root DNS keys do anything like this? Or is that too much complexity when a safe in a secure room works as an effective backup?

They go into extreme detail about DNSsec root key security

https://blog.apnic.net/2021/10/12/dns-security-and-key-cerem...

Re: How Shamir's Secret Sharing Works

#83

Post by stoapoikile »

946789987649 wrote: post #34

My masters thesis was on this! I created an app where you can store your data across all the common data storage providers (dropbox, google drive, onedrive, etc.) and used the secret sharing to aid with the encryption. The benefit was that: - They could no longer read your data - Additional redundancy (as you only need 2 to be available) - Compared to other secure storage apps which rely on a master password, which i…

Done something similar for mine as well, although the word of the year that day was blockchain, so implemented the same onto Ethereum. It was a fun project, and Secret Sharing is quite an interesting topic!

Re: How Shamir's Secret Sharing Works

#84

Post by 946789987649 »

trelane wrote: post #59
946789987649 wrote: post #34

My masters thesis was on this! I created an app where you can store your data across all the common data storage providers (dropbox, google drive, onedrive, etc.) and used the secret sharing to aid with the encryption. The benefit was that: - They could no longer read your data - Additional redundancy (as you only need 2 to be available) - Compared to other secure storage apps which rely on a master password, which i…

Where is your thesis available?

I'm afraid it's not available as it wasn't published. To be honest there wasn't much more than what I posted there, it was quite a practical thesis and really more of a market analysis and practical implementation of a potential consumer product.

Currently doing a different startup, but certainly an idea for a future one.

Re: How Shamir's Secret Sharing Works

#85

Post by trelane »

946789987649 wrote: post #84
trelane wrote: post #59

Earlier quoted context omitted.

Where is your thesis available?

I'm afraid it's not available as it wasn't published. To be honest there wasn't much more than what I posted there, it was quite a practical thesis and really more of a market analysis and practical implementation of a potential consumer product. Currently doing a different startup, but certainly an idea for a future one.

Ah, dang. Thanks for responding anyway!

Re: How Shamir's Secret Sharing Works

#86

Post by ndr_ »

andreareina wrote: post #24
ndr_ wrote: post #19

Bruce Schneier described this in his seminal book Applied Cryptography, and HashiCorp Vault used to have an implementation in Go. On the practical side, I always wondered how large - in bits - the shares should be. One answer I got on a news group was "1 bit more than the actual key length". Nowadays, I wonder how the quantum computing threat would inform 1) share size choice and 2) pro/con Secret Sharing in general.…

Do you remember why 1 bit more?

It was phrased as "to distinguish all possible secrets": https://groups.google.com/g/sci.crypt/c/siuibXhcUGc/m/wTpAEO...

Re: How Shamir's Secret Sharing Works

#87

Post by davidcollantes »

ahazred8ta wrote: post #29
Cider9986 wrote: post #6

Here is Ente's implementation: ( https://2of3.ente.com/ )

There are several browser-based versions which can be used online or downloaded to use offline. https://bs.parity.io/ -- http://passguardian.com/ -- https://iancoleman.io/shamir/

I have noticed that not one of them is compatible with the other. I generated shares using `ssss` (https://manpages.ubuntu.com/manpages/trusty/man1/ssss-split....), and couldn't combine them on any of the three sites linked. That is a downside, isn't it? Do you know of a way to bypass that hurdle, other than packing resources together with the shares?

Re: How Shamir's Secret Sharing Works

#88

Post by ahazred8ta »

davidcollantes wrote: post #87
ahazred8ta wrote: post #29

Earlier quoted context omitted.

There are several browser-based versions which can be used online or downloaded to use offline. https://bs.parity.io/ -- http://passguardian.com/ -- https://iancoleman.io/shamir/

I have noticed that not one of them is compatible with the other. I generated shares using `ssss` ( https://manpages.ubuntu.com/manpages/trusty/man1/ssss-split.... ), and couldn't combine them on any of the three sites linked. That is a downside, isn't it? Do you know of a way to bypass that hurdle, other than packing resources together with the shares?

SSSS is not the official canonical file format for SSS. Shamir did not specify an official file format when he described his technique. Each implementation knows how to recombine its own shares. The web apps can be saved and used on any device.
Post reply on HN