Suppose you're trying to store data as securely as possible, including splitting it across multiple machines (encrypted in a manner so that it's unreadable unless all pieces of the data are recovered). If the attacker knows your algorithm and compromises all of your machines, they can always recover the data, so there is always some nonzero probability of this happening. But you want to reduce the probability as much as possible.

It seems the strategy would be to encrypt the data with a key, and then split the key across multiple machines, such that all the machines (the data storage machine and the key-storage machines) are as physically independent as possible and are running different operating systems (with each OS always applying all of the latest available patches).

Running different operating systems means that the probability of compromising one machine is more independent of the probability of compromising the other machines. If you have three machines and they're all running Windows Server, and in a given time frame you have a 10% of chance of finding a vulnerability in Windows Server that gives you read access to the machine, you have a 10% of compromising the whole system because then you'll own all three machines. But if there are three machines, each running a different OS, and for each OS you have a 10% of finding a vulnerability in that OS, and the odds are independent for each OS, then you have a 0.1% chance of compromising the whole system.

You can also re-encrypt the data periodically with a new key and then split the new key. Then the attacker only beats the system if they compromise all of the machines in the same time period before re-encryption.

Now, this does also mean that if any of the machines fails, you lose all the data, but the fragment of the key on each machine can be backed up to another machine. And in this case, while the backup machine should still be physically separate to reduce the chance of both being lost at once, it could be running the same OS as the machine it's backing up. The idea is that if A1 is backed up to A2, then the attacker compromises the same amount of data whether they hack into A1 or A2 or both, so there's no reason A1 and A2 can't run the same OS (with the same potential vulnerabilities).

However, I've never heard of a security principle along the lines of "split sensitive data across machines running different operating systems". Did I just re-discover something well-known and obvious that has a name already? Or is there some reason the whole logic is flawed (and that's why it doesn't have a name)?

  • 3
    Off the top of my head, my first concern would be that there has to be some way for the legitimate users to get the data out (otherwise there's no point in keeping it) and an attacker would be more likely to try to compromise that than to hack into each of the servers separately. Commented Jul 30, 2018 at 1:29
  • 3x the data loss risk for an uncertain payoff does not sound like good infosec (which includes reliability)
    – dandavis
    Commented Jul 30, 2018 at 16:23

2 Answers 2


You can use the Shamir's Secret Sharing with the threshold scheme which specifies how many key fragments you need to reconstruct the key. So if you have 20 key fragments total and you require at least 10 fragments to reconstruct the key this means that 10 of your servers can go down and you still will be able to get the key. You will also need to set the replication factor so you don't lose the data if one node goes down.

Alternatively, instead of splitting your key into fragments you could split the encrypted data and specify the threshold to allow some of the servers to fail without any data loss.

  • Right but I am specifically asking if it is correct that you should have the key fragments stored on different operating systems, to reduce the chances of the attacker getting all the fragments. This seems logical but I've never seen it recommended anywhere.
    – Bennett
    Commented Aug 6, 2018 at 6:32
  • I don't think it adds that much security over the amount of introduced maintenance Commented Aug 12, 2018 at 17:02

Like any multi-layer scheme, it's only as strong as its weakest link.

1) Unless you are putting multiple copies of each key portion on different servers, you're actually introducing more single points of failure; if any of those machines is lost, the data is unrecoverable.

2) An attacker can attempt to compromise the device where the key is reassembled, bypassing any added difficulty.

3) You'll need to simulate the entire process start-to-finish with a copy of the key segments to ensure you can actually decrypt it successfully(i.e. if a character format change happens to one segment and you don't know it, you're never getting it fixed)

4) separating portions of the key does not inherently add difficulty in an attacker accessing the data; the algorithm and keylength are the same regardless of whether it's divided up. You're just inserting roadblocks that make it more complex and cumbersome, which in practice often means less secure.

tl;dr It sounds more like you're creating a cool CTF for hackers than making the key more secure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .