Design for secure offline storage of key with two or more parties by key sharing

Question

Design:

People should be able to store the partial-key in a unobtrusive form but the unobtrusive form should not be used to decrypt sensitive content on its own.

The design should allow to be plausible deniable because the parts should not look like keys.

How it works

Two (or more) pieces of information like numbers are fed to the software. The software derives a password from it that is used to decrypt the real sensitive stuff.

User A has the unobtrusive key '1234' User B has the unobtrusive key '5678'

Together they form '12345678' and the software derives a key from this string.

It's like two people come to a safe box and the safe box only opens with two keys at the same time.

Key derivation method

• Secure key derivation method can be used on the final string like PBKDF2 with custom iteration count
• The iteration could also be calculated from the final string (something like crc32 + 10000

Threat model:

• One piece of the key can be compromised without revealing the other one
• Key can be something unobtrusive, anything that translates in to a sequence where a key can be derived from (string, file & etc.)

Out of scope:

• Keyloggers
• Malware
• Encryption algorithm

Failure:

• Attacker gets hold of things and feds them in to the software

Cons:

• Somewhat Security by obscurity

Pros:

• Non-technical users can handle it better than a saved password
• One key alone does not translate to a password. It will be derived from the whole sequence of keys
• Can be stored in any form as long as it can be translated back to a sequence of data (post it note, image file & etc).
• Plausible deniability - The unobtrusive key can look like a regular item

Questions:

• What would be a realistic attack for this storage method?
• How can it be improved?
• (sarcasm) What could possibly go wrong? (/sarcasm)

Answer 1

To summarize your design: you combine arbitrary secret data which can be held by different people with some hash function into a secret key which is then used to protect some secret data.

What would be a realistic attack for this storage method?

One possible attack against this method is to somehow collect all the separate parts which are needed to create the common secret key. This is the kind of "attack" which makes a good story line for movies, games or fairy tales. And while you exclude malware, keyloggers and weak encryption higher value secrets have to face also attacks like physical brute force, bribing, black mailing, hidden cameras etc - just look at typical movies for more ideas.

But instead of somehow compromising every one of the bearers of the secret parts it might be easier to attack the place where these parts get combined to form the final secret key, because then all information are there in a single place already. And, it is also hard for the participating parties to deny their involvement if they can be seen to participate in constructing the secret key.

Alternatively one can attack even later stages, i.e. the stage were the common secret key is already computed (without knowing the separate inputs) or the stage where the secret key was already used to decrypt the secret data and just grab these secret data.

None of these later stage attacks seem to be out of scope or even considered in your given threat model.