SlideShare a Scribd company logo
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Secret Sharing
Split Brains
1
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Password
‣Everything online or sensitive has a password
‣Usually known by single person
‣Person gone = password gone
‣Equivalent to a door's lock
2
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Multi people examples
‣NSA access to mobile devices
‣Four-eyes principle for admins
‣Joint bank account of a company
‣Lawyer needs six family member to open a will
‣Nuclear missile launch system
‣and many more
3
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Advances examples
‣Bank account: access by any 2 of 4 people
‣Nuclear missile: hierarchy of passwords
(president counts 3 votes, SoD counts 2, ...)
‣Will: family member die before you, don't want to
de-/encrypt will again and send out passwords
‣Will: new family member without redistributing
passwords to all again
‣Four-eyes principle: admins can do some
operation only with another admin
4
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Characteristic of multi PW solution
‣Exposure of 1 sub password doesn't expose any
more hints to attacker
‣All sub passwords required to obtain solution
‣Knowledge of all-but-one no better than knowing
none
‣Sub passwords have same magnitude in length
than master password
5
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Characteristic of multi PW solution
‣Generate new passwords, because one got
exposed, without re-issuing the others
‣Keep sub passwords despite additions/deletions
‣Generate new viable sub password without re-
issue
6
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Ideas?
7
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Password Carve-up
‣Discloses partial information
‣Reduces effort of brute-force attack
‣Not elegant
‣Need all pieces like a broken plate
8
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Random Offsets
‣Disclose a password doesn't help attacker
‣Magnitude of passwords is good
‣More elegant
‣Still need all pieces
9
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Exclusive Or (XOR)
‣Disclose a password doesn't help attacker
‣Magnitude of passwords is good
‣More elegant
‣Still need all pieces
10
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Shamir's Algorithm
‣Using a bit of math
‣Not too complicated
‣Matches all requirements
‣Doesn't need all sub-keys to decrypt
‣Threshold cryptosystem
11
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Back to school
‣Draw a graph
‣Transform password into coordinate (e.g. 25,20)
‣Now draw a line through this point
‣How would you do it?
12
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Some examples
‣Infinite possibilities
‣Correct way: you need 2 points
13
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Equation of straight line
‣Y = mX + C
‣M is gradient (slope) of line
‣C is intercept of y-axis
‣Our Secret S = C
14
TEQneers GmbH & Co. KG www.teqneers.de
Slide
More solutions
‣Any two point on the line describe the line and
determine the interception of y-axis (our S)
15
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Simplest solution
‣Any number of point we desire
‣Distribute hundreds of coordinates
‣Individually, each coordinate is useless, because
infinite number of solutions
‣Any two points together describe 

solution
‣Awesome!
16
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Order-2
‣From linear to quadratic
‣Straight lines are order-1 polynomials
‣Quadratic equations are order-2
‣e.g. y = Ax
2
+ Bx + C
‣Unlimited solution with only 2 points
17
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Order-2 example
18
‣Any number of point we desire
‣Distribute hundreds of coordinates
‣Individually, each coordinate is useless, because
infinite number of solutions
‣Any three points together describe 

solution
‣Awesome! Again!
TEQneers GmbH & Co. KG www.teqneers.de
Slide
x-order
19
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Advance feature support
‣Not a broken-plate type problem
‣No need of all passwords
‣Non-complete combination no value to attacker
‣Easy to generate new sub passwords, no need to
re-issue others
‣In case of compromised passwords: keep
uncompromised coords and generate new curve
‣President: just needs more coordinates than
others (e.g. 3) and SoD gets 2, others 1
20
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Demo
https://github.com/teqneers/shamir
21
TEQneers GmbH & Co. KG www.teqneers.de
Slide
Links
‣https://github.com/teqneers/shamir
‣http://en.wikipedia.org/wiki/Secret_sharing
‣http://en.wikipedia.org/wiki/Shamir
%27s_Secret_Sharing
‣http://www.cs.cornell.edu/Courses/
cs513/2000SP/SecretSharing.html
‣http://groups.csail.mit.edu/cis/crypto/classes/
6.857/papers/secret-shamir.pdf
22

More Related Content

Recently uploaded

Using LLM Agents with Llama 3, LangGraph and Milvus
Using LLM Agents with Llama 3, LangGraph and MilvusUsing LLM Agents with Llama 3, LangGraph and Milvus
Using LLM Agents with Llama 3, LangGraph and Milvus
Zilliz
 
The Path to General-Purpose Robots - Coatue
The Path to General-Purpose Robots - CoatueThe Path to General-Purpose Robots - Coatue
The Path to General-Purpose Robots - Coatue
Razin Mustafiz
 
Vulnerability Management: A Comprehensive Overview
Vulnerability Management: A Comprehensive OverviewVulnerability Management: A Comprehensive Overview
Vulnerability Management: A Comprehensive Overview
Steven Carlson
 
Semantic-Aware Code Model: Elevating the Future of Software Development
Semantic-Aware Code Model: Elevating the Future of Software DevelopmentSemantic-Aware Code Model: Elevating the Future of Software Development
Semantic-Aware Code Model: Elevating the Future of Software Development
Baishakhi Ray
 
Vertex AI Agent Builder - GDG Alicante - Julio 2024
Vertex AI Agent Builder - GDG Alicante - Julio 2024Vertex AI Agent Builder - GDG Alicante - Julio 2024
Vertex AI Agent Builder - GDG Alicante - Julio 2024
Nicolás Lopéz
 
Connector Corner: Leveraging Snowflake Integration for Smarter Decision Making
Connector Corner: Leveraging Snowflake Integration for Smarter Decision MakingConnector Corner: Leveraging Snowflake Integration for Smarter Decision Making
Connector Corner: Leveraging Snowflake Integration for Smarter Decision Making
DianaGray10
 
UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...
UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...
UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...
FIDO Alliance
 
Zaitechno Handheld Raman Spectrometer.pdf
Zaitechno Handheld Raman Spectrometer.pdfZaitechno Handheld Raman Spectrometer.pdf
Zaitechno Handheld Raman Spectrometer.pdf
AmandaCheung15
 
The History of Embeddings & Multimodal Embeddings
The History of Embeddings & Multimodal EmbeddingsThe History of Embeddings & Multimodal Embeddings
The History of Embeddings & Multimodal Embeddings
Zilliz
 
Tailored CRM Software Development for Enhanced Customer Insights
Tailored CRM Software Development for Enhanced Customer InsightsTailored CRM Software Development for Enhanced Customer Insights
Tailored CRM Software Development for Enhanced Customer Insights
SynapseIndia
 
Mule Experience Hub and Release Channel with Java 17
Mule Experience Hub and Release Channel with Java 17Mule Experience Hub and Release Channel with Java 17
Mule Experience Hub and Release Channel with Java 17
Bhajan Mehta
 
Generative AI Reasoning Tech Talk - July 2024
Generative AI Reasoning Tech Talk - July 2024Generative AI Reasoning Tech Talk - July 2024
Generative AI Reasoning Tech Talk - July 2024
siddu769252
 
Mastering OnlyFans Clone App Development: Key Strategies for Success
Mastering OnlyFans Clone App Development: Key Strategies for SuccessMastering OnlyFans Clone App Development: Key Strategies for Success
Mastering OnlyFans Clone App Development: Key Strategies for Success
David Wilson
 
leewayhertz.com-AI agents for healthcare Applications benefits and implementa...
leewayhertz.com-AI agents for healthcare Applications benefits and implementa...leewayhertz.com-AI agents for healthcare Applications benefits and implementa...
leewayhertz.com-AI agents for healthcare Applications benefits and implementa...
alexjohnson7307
 
kk vathada _digital transformation frameworks_2024.pdf
kk vathada _digital transformation frameworks_2024.pdfkk vathada _digital transformation frameworks_2024.pdf
kk vathada _digital transformation frameworks_2024.pdf
KIRAN KV
 
Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...
Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...
Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...
shanihomely
 
Feature sql server terbaru performance.pptx
Feature sql server terbaru performance.pptxFeature sql server terbaru performance.pptx
Feature sql server terbaru performance.pptx
ssuser1915fe1
 
Camunda Chapter NY Meetup July 2024.pptx
Camunda Chapter NY Meetup July 2024.pptxCamunda Chapter NY Meetup July 2024.pptx
Camunda Chapter NY Meetup July 2024.pptx
ZachWylie3
 
Use Cases & Benefits of RPA in Manufacturing in 2024.pptx
Use Cases & Benefits of RPA in Manufacturing in 2024.pptxUse Cases & Benefits of RPA in Manufacturing in 2024.pptx
Use Cases & Benefits of RPA in Manufacturing in 2024.pptx
SynapseIndia
 
Gen AI: Privacy Risks of Large Language Models (LLMs)
Gen AI: Privacy Risks of Large Language Models (LLMs)Gen AI: Privacy Risks of Large Language Models (LLMs)
Gen AI: Privacy Risks of Large Language Models (LLMs)
Debmalya Biswas
 

Recently uploaded (20)

Using LLM Agents with Llama 3, LangGraph and Milvus
Using LLM Agents with Llama 3, LangGraph and MilvusUsing LLM Agents with Llama 3, LangGraph and Milvus
Using LLM Agents with Llama 3, LangGraph and Milvus
 
The Path to General-Purpose Robots - Coatue
The Path to General-Purpose Robots - CoatueThe Path to General-Purpose Robots - Coatue
The Path to General-Purpose Robots - Coatue
 
Vulnerability Management: A Comprehensive Overview
Vulnerability Management: A Comprehensive OverviewVulnerability Management: A Comprehensive Overview
Vulnerability Management: A Comprehensive Overview
 
Semantic-Aware Code Model: Elevating the Future of Software Development
Semantic-Aware Code Model: Elevating the Future of Software DevelopmentSemantic-Aware Code Model: Elevating the Future of Software Development
Semantic-Aware Code Model: Elevating the Future of Software Development
 
Vertex AI Agent Builder - GDG Alicante - Julio 2024
Vertex AI Agent Builder - GDG Alicante - Julio 2024Vertex AI Agent Builder - GDG Alicante - Julio 2024
Vertex AI Agent Builder - GDG Alicante - Julio 2024
 
Connector Corner: Leveraging Snowflake Integration for Smarter Decision Making
Connector Corner: Leveraging Snowflake Integration for Smarter Decision MakingConnector Corner: Leveraging Snowflake Integration for Smarter Decision Making
Connector Corner: Leveraging Snowflake Integration for Smarter Decision Making
 
UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...
UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...
UX Webinar Series: Drive Revenue and Decrease Costs with Passkeys for Consume...
 
Zaitechno Handheld Raman Spectrometer.pdf
Zaitechno Handheld Raman Spectrometer.pdfZaitechno Handheld Raman Spectrometer.pdf
Zaitechno Handheld Raman Spectrometer.pdf
 
The History of Embeddings & Multimodal Embeddings
The History of Embeddings & Multimodal EmbeddingsThe History of Embeddings & Multimodal Embeddings
The History of Embeddings & Multimodal Embeddings
 
Tailored CRM Software Development for Enhanced Customer Insights
Tailored CRM Software Development for Enhanced Customer InsightsTailored CRM Software Development for Enhanced Customer Insights
Tailored CRM Software Development for Enhanced Customer Insights
 
Mule Experience Hub and Release Channel with Java 17
Mule Experience Hub and Release Channel with Java 17Mule Experience Hub and Release Channel with Java 17
Mule Experience Hub and Release Channel with Java 17
 
Generative AI Reasoning Tech Talk - July 2024
Generative AI Reasoning Tech Talk - July 2024Generative AI Reasoning Tech Talk - July 2024
Generative AI Reasoning Tech Talk - July 2024
 
Mastering OnlyFans Clone App Development: Key Strategies for Success
Mastering OnlyFans Clone App Development: Key Strategies for SuccessMastering OnlyFans Clone App Development: Key Strategies for Success
Mastering OnlyFans Clone App Development: Key Strategies for Success
 
leewayhertz.com-AI agents for healthcare Applications benefits and implementa...
leewayhertz.com-AI agents for healthcare Applications benefits and implementa...leewayhertz.com-AI agents for healthcare Applications benefits and implementa...
leewayhertz.com-AI agents for healthcare Applications benefits and implementa...
 
kk vathada _digital transformation frameworks_2024.pdf
kk vathada _digital transformation frameworks_2024.pdfkk vathada _digital transformation frameworks_2024.pdf
kk vathada _digital transformation frameworks_2024.pdf
 
Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...
Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...
Premium Girls Call Mumbai 9920725232 Unlimited Short Providing Girls Service ...
 
Feature sql server terbaru performance.pptx
Feature sql server terbaru performance.pptxFeature sql server terbaru performance.pptx
Feature sql server terbaru performance.pptx
 
Camunda Chapter NY Meetup July 2024.pptx
Camunda Chapter NY Meetup July 2024.pptxCamunda Chapter NY Meetup July 2024.pptx
Camunda Chapter NY Meetup July 2024.pptx
 
Use Cases & Benefits of RPA in Manufacturing in 2024.pptx
Use Cases & Benefits of RPA in Manufacturing in 2024.pptxUse Cases & Benefits of RPA in Manufacturing in 2024.pptx
Use Cases & Benefits of RPA in Manufacturing in 2024.pptx
 
Gen AI: Privacy Risks of Large Language Models (LLMs)
Gen AI: Privacy Risks of Large Language Models (LLMs)Gen AI: Privacy Risks of Large Language Models (LLMs)
Gen AI: Privacy Risks of Large Language Models (LLMs)
 

Featured

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
Skeleton Technologies
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Lily Ray
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
Rajiv Jayarajah, MAppComm, ACC
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
Christy Abraham Joy
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
Vit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
MindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
RachelPearson36
 

Featured (20)

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 

Sharing secrets with PHP

  • 1. TEQneers GmbH & Co. KG www.teqneers.de Slide Secret Sharing Split Brains 1
  • 2. TEQneers GmbH & Co. KG www.teqneers.de Slide Password ‣Everything online or sensitive has a password ‣Usually known by single person ‣Person gone = password gone ‣Equivalent to a door's lock 2
  • 3. TEQneers GmbH & Co. KG www.teqneers.de Slide Multi people examples ‣NSA access to mobile devices ‣Four-eyes principle for admins ‣Joint bank account of a company ‣Lawyer needs six family member to open a will ‣Nuclear missile launch system ‣and many more 3
  • 4. TEQneers GmbH & Co. KG www.teqneers.de Slide Advances examples ‣Bank account: access by any 2 of 4 people ‣Nuclear missile: hierarchy of passwords (president counts 3 votes, SoD counts 2, ...) ‣Will: family member die before you, don't want to de-/encrypt will again and send out passwords ‣Will: new family member without redistributing passwords to all again ‣Four-eyes principle: admins can do some operation only with another admin 4
  • 5. TEQneers GmbH & Co. KG www.teqneers.de Slide Characteristic of multi PW solution ‣Exposure of 1 sub password doesn't expose any more hints to attacker ‣All sub passwords required to obtain solution ‣Knowledge of all-but-one no better than knowing none ‣Sub passwords have same magnitude in length than master password 5
  • 6. TEQneers GmbH & Co. KG www.teqneers.de Slide Characteristic of multi PW solution ‣Generate new passwords, because one got exposed, without re-issuing the others ‣Keep sub passwords despite additions/deletions ‣Generate new viable sub password without re- issue 6
  • 7. TEQneers GmbH & Co. KG www.teqneers.de Slide Ideas? 7
  • 8. TEQneers GmbH & Co. KG www.teqneers.de Slide Password Carve-up ‣Discloses partial information ‣Reduces effort of brute-force attack ‣Not elegant ‣Need all pieces like a broken plate 8
  • 9. TEQneers GmbH & Co. KG www.teqneers.de Slide Random Offsets ‣Disclose a password doesn't help attacker ‣Magnitude of passwords is good ‣More elegant ‣Still need all pieces 9
  • 10. TEQneers GmbH & Co. KG www.teqneers.de Slide Exclusive Or (XOR) ‣Disclose a password doesn't help attacker ‣Magnitude of passwords is good ‣More elegant ‣Still need all pieces 10
  • 11. TEQneers GmbH & Co. KG www.teqneers.de Slide Shamir's Algorithm ‣Using a bit of math ‣Not too complicated ‣Matches all requirements ‣Doesn't need all sub-keys to decrypt ‣Threshold cryptosystem 11
  • 12. TEQneers GmbH & Co. KG www.teqneers.de Slide Back to school ‣Draw a graph ‣Transform password into coordinate (e.g. 25,20) ‣Now draw a line through this point ‣How would you do it? 12
  • 13. TEQneers GmbH & Co. KG www.teqneers.de Slide Some examples ‣Infinite possibilities ‣Correct way: you need 2 points 13
  • 14. TEQneers GmbH & Co. KG www.teqneers.de Slide Equation of straight line ‣Y = mX + C ‣M is gradient (slope) of line ‣C is intercept of y-axis ‣Our Secret S = C 14
  • 15. TEQneers GmbH & Co. KG www.teqneers.de Slide More solutions ‣Any two point on the line describe the line and determine the interception of y-axis (our S) 15
  • 16. TEQneers GmbH & Co. KG www.teqneers.de Slide Simplest solution ‣Any number of point we desire ‣Distribute hundreds of coordinates ‣Individually, each coordinate is useless, because infinite number of solutions ‣Any two points together describe 
 solution ‣Awesome! 16
  • 17. TEQneers GmbH & Co. KG www.teqneers.de Slide Order-2 ‣From linear to quadratic ‣Straight lines are order-1 polynomials ‣Quadratic equations are order-2 ‣e.g. y = Ax 2 + Bx + C ‣Unlimited solution with only 2 points 17
  • 18. TEQneers GmbH & Co. KG www.teqneers.de Slide Order-2 example 18 ‣Any number of point we desire ‣Distribute hundreds of coordinates ‣Individually, each coordinate is useless, because infinite number of solutions ‣Any three points together describe 
 solution ‣Awesome! Again!
  • 19. TEQneers GmbH & Co. KG www.teqneers.de Slide x-order 19
  • 20. TEQneers GmbH & Co. KG www.teqneers.de Slide Advance feature support ‣Not a broken-plate type problem ‣No need of all passwords ‣Non-complete combination no value to attacker ‣Easy to generate new sub passwords, no need to re-issue others ‣In case of compromised passwords: keep uncompromised coords and generate new curve ‣President: just needs more coordinates than others (e.g. 3) and SoD gets 2, others 1 20
  • 21. TEQneers GmbH & Co. KG www.teqneers.de Slide Demo https://github.com/teqneers/shamir 21
  • 22. TEQneers GmbH & Co. KG www.teqneers.de Slide Links ‣https://github.com/teqneers/shamir ‣http://en.wikipedia.org/wiki/Secret_sharing ‣http://en.wikipedia.org/wiki/Shamir %27s_Secret_Sharing ‣http://www.cs.cornell.edu/Courses/ cs513/2000SP/SecretSharing.html ‣http://groups.csail.mit.edu/cis/crypto/classes/ 6.857/papers/secret-shamir.pdf 22