1

Let's say I have the following security scheme:

Master entity
    |
    |
    v
   Group entity-----> Child entity 1
        |     |-----> Child entity 2
        |     \-----> Child entity 3
        |
        v
      Data vault

The master entity contains the master key. Every time a new Group entity is created, a new derived key from the master key should be created and assigned to that group (provided a password for the Group). And every time a new Child entity is created, a new derived key from the Group should be created (provided a password for the Child).

  • There is some data that needs to be stored in such a way that all Child entities of a Group can access it (without knowing the Group password)

  • It must be possible to change/recover any of the Child passwords by the Group or the Master (without the Child losing access to the Data vault once the new key is generated)

  • It must be possible to change/recover the Group password by the Master (without losing access to the Data vault once the new key is generated).

Is that actually possible with key derivation, and if so:

  • are there any security flaws (aside from the obvious one, aka, leaked master/group keys)
  • how exactly would it be done (a brief explanation would be more than enough)
  • In LUKS-style each actual key is wrapped by the key of the entity needing access. Upon adding an entity, the key needs to be decrypted by an existing entity and wrapped by the added entity. This way both entities can access the same key without knowing each others key. This also works in a tree; each upper entity can unwrap all of the lower keys but not the neighbors or upper keys. Unwrapping the group key will only get you access to whatever was encrypted with that key, i.e. a vault/disk image. As long as you only add a wrapped copy of the private key below the current entry, you can't go up. – John Keates Oct 12 '16 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.