2

Requirement:
An "arbitrary text" should be encrypted, and keys distributed among 3 people, atleast two keys are needed to unlock.

Here is how I plan to do it, please let me know if I'm missing something:

  1. Create four symmetric keys (AES-256), each with different IV. lets call them S0, S1, S2, S3
  2. Create three RSA keypairs(keylength 2048), lets call them A1, A2, A3

Encrypt the arbitrary text by S0 (AES256, padding mode ISO10126, cypher mode CBC), lets call the output as ENCTEXT

Encrypt S0 sequentially by S1 and S2, lets call the output as S0-S1S2
Encrypt S0 sequentially by S2 and S3, lets call the output as S0-S2S3
Encrypt S0 sequentially by S3 and S1, lets call the output as S0-S3S1

Encrypt S1 by A1-Public
Encrypt S2 by A2-Public
Encrypt S3 by A3-Public

  1. Share ENCTEXT, S0-S1S2, S0-S2S3, S0-S3S1, IV0, IV1, IV2, IV3, A1Public, A2Public, A3Public openly with everyone
  2. Share A1-Private, A2-Private, A3-Private with respective keyowners.

Say, if Key owners 2 and 3 want to unlock the text, they will use their private keys to unlock S2, S3 respectively, then unlock S0 using that, and finally unlock the ENCTEXT using S0.

Would this work? Is there a vulnerability since S0 is encrypted by repeatedly by other Sx keys and revealed (though each will have their own IV)?

I'm a newbie and gathered most of the above choices by reading various forums, would greatly appreciate validation from experts.

Edit 8/26: Thank you Mike and Ricky. Both were good pointers, I now gather that the formal name for the above approach is Threshold Encryption, and Samir's Secret Sharing algorithm is another way to implement it. I see that the difference between the approach above and Samir's secret sharing algorithm is: a new secret should be shared for every message if I use Samir algorithm, the above logic will need distribution of secret keys just once, and use the same public keys every time for newer messages (of-course new symmetric keys and IVs every-time, but the encrypted version of it is distributed openly as part of the encrypted message itself). I need to now rethink which approach fits my usecase.

  • At a very quick first glance this seems ok, but you're inventing something to do the same job as Shamir's Secret Sharing Algorithm. Have you looked into Shamir's? – Mike Ounsworth Aug 24 '16 at 23:16
  • glanced through it before but wasn't sure, will give a deeper read and respond. Thanks. – Mano Aug 25 '16 at 0:09
  • What you describe seems like it's trying for threshold decryption, rather than multi-signatures. ​ ​ – user49075 Aug 25 '16 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.