Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to the datastore until it terminates). I don't want any single admin to have the ability to unlock the datastore himself, but I also don't want all of the admins to be required to do it (since they may not always be available) -- I'd like a certain subset of admins to be able to unlock the datastore by entering their credentials.

For example, if I have 5 administrators for the application, I might want any two or three of them to be able to enter their passphrase to unlock access to the datastore.

Is there some off-the-shelf software implementation for a system like this?

This seems similar to a bifurcated key, but instead of requiring both people to supply their half of the key, I'd like any specified subset of users to be able to unlock the key.


1 Answer 1


This sounds like a good task for Shamir's Secret Sharing, as Stephen pointed out in comments. One example of off-the-shelf software that can do this is Crypto++ (relevant docs: http://www.cryptopp.com/docs/ref/class_secret_sharing.html).

  • I figured there'd be dozens of algorithms and options, but based on the lack of responses, it seems like this is the about the only choice.
    – Johnny
    Apr 8, 2014 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.