When I told my wife about the concept I am about to discuss, she rolled her eyes and called me a nerd (a moniker I am very comfortable with). File this under paranoid or even egotistical, but for some time I have been searching for a way give my passwords to family members. Thats right, the keys to my digital kingdom and I want to give them away- with one catch, no one person can read them. Here is the idea, in the event that I am ever incapacitated, I want to make sure my family has access to anything they need- from my bank account information to the root password on my machines. The only thing, like I said, is that I wanted a way to disseminate the passwords in such a way that no one person had everything. What I needed was to create some kind of quorum. I had a vision of sending out USB keys, one to my parents, one to my in-laws, one hidden here at home and one in a safe deposit box. Of course that has some flaws, what happens if the house burns down and one of the keys is lost? I was also really concerned with security. What if one of the keys outside of my house was stolen or lost- would my passwords be in the wild?

I wanted a 3 out of 4 system... I wanted a way to break the passwords into 4 parts and require that 3 of the 4 be present in order to decode the passwords. Is that to much to ask? Its kind of the "wonder twins activate" of the password world. I was aware of the key recovery techniques that PGP uses where you can essentially plot keys on a parabolic curve, but frankly I'm just not a big enough nerd to make sense of that.

What I found is so cool it just blows my mind: Shamir's Secret Sharing. This Wikipedia article does a much better job of explaining things than I can. In a nutshell Adi Shamir figured out a mathematical way to split "secrets" into N parts and require M (where M is equal to or less than N) parts to rebuild the secret. Wait, it gets better! There is an open source application that implements Shamir's Secret Sharing, its called ssss and is available totally free here . Need a demo? Check the demo page here , it lets you plug in a "secret" and specify the number of shares and the threshold (number needed to rebuild the secret).

To the SSSS program, a secret is a short string of text. That could be a short sentence or one word. SSSS does not seem to do well with whole documents.

Let me give you an example. Let's say I want to take a secret and break it into 4 parts. The results look like this:
1-6a489b233e29ddc15d23a6c1c1ef9d80e2
2-198c349efd3d7d19b6f679e02655d9a6ca
3-373051f5bc311d51efbaccff7b3c1a44d0
4-fe056be57b143ca8615dc7a3e92151ea84

In this example lets say we only need any 2 of the 4 lines above to recreate my secret... pick any two of those lines and paste them into the combine field on this page .... pretty cool huh?

Installing SSSS in most flavors of linux should be trivial if you are comfortable compiling software. On Ubuntu feisty fawn you'll need to have a compiler installed, the easiest way to go about that is by issuing the following command:
sudo apt-get install build-essential
Then you should be able to navigate to the directory where you uncompressed ssss and compile the source.
On the Mac side its a little more tricky. First, you'll need to install Xcode from your OSX install DVD. SSSS requires glib which is not part of OSX by default. The easiest way to get glib is through MacPorts. Once you have MacPorts installed, open a terminal and type:
sudo port install glib
After that, SSSS should compile fine.
According to the SSSS page, there is a Windows port but its flawed. Use it at your own risk.

Once installed SSSS is simple to use, follow the on screen prompts.

I've split my passwords into 4 parts (of which I am requiring 3). I have them on USB keys that I've sent out into the world. Each key has a text file with instructions as well as OSX and Linux binaries of SSSS. I have told the holders of the USB keys, that in the event that I am ever incapacitated to assemble 3 of the 4 keys and follow the instructions to recover my passwords.

To implement my plan I turned to TrueCrypt. I wanted to crate a text file that had all of my passwords, as well as some other instructions and detailed information. TueCrypt made short work of turning that file into a block of unreadable gibberish. That way I can put a copy of the encrypted file on each USB drive. All that was left was to take the password for the TrueCrypt volume and and run it through SSSS.

I the end this may be more of an exercise in geekyness than anything else. But, perhaps, the tools and ideas can help inspire a ore elegant solution. Clearly there is power in Shamir's Secret Sharing and it seems to have a very usable role in online security. I would love to hear from anyone reading this about ways they have tackled this issue and what they think of SSS and my solution.

When I told my wife about the concept I am about to discuss, she rolled her eyes and called me a nerd (a moniker I am very comfortable with). File this under paranoid or even egotistical, but for some time I have been searching for a way give my passwords to family members. Thats right, the keys to my digital kingdom and I want to give them away- with one catch, no one person can read them. Here is the idea, in the event that I am ever incapacitated, I want to make sure my family has access to anything they need- from my bank account information to the root password on my machines. The only thing, like I said, is that I wanted a way to disseminate the passwords in such a way that no one person had everything. What I needed was to create some kind of quorum. I had a vision of sending out USB keys, one to my parents, one to my in-laws, one hidden here at home and one in a safe deposit box. Of course that has some flaws, what happens if the house burns down and one of the keys is lost? I was also really concerned with security. What if one of the keys outside of my house was stolen or lost- would my passwords be in the wild?

I wanted a 3 out of 4 system... I wanted a way to break the passwords into 4 parts and require that 3 of the 4 be present in order to decode the passwords. Is that to much to ask? Its kind of the "wonder twins activate" of the password world. I was aware of the key recovery techniques that PGP uses where you can essentially plot keys on a parabolic curve, but frankly I'm just not a big enough nerd to make sense of that.

What I found is so cool it just blows my mind: Shamir's Secret Sharing. This Wikipedia article does a much better job of explaining things than I can. In a nutshell Adi Shamir figured out a mathematical way to split "secrets" into N parts and require M (where M is equal to or less than N) parts to rebuild the secret. Wait, it gets better! There is an open source application that implements Shamir's Secret Sharing, its called ssss and is available totally free here . Need a demo? Check the demo page here , it lets you plug in a "secret" and specify the number of shares and the threshold (number needed to rebuild the secret).

To the SSSS program, a secret is a short string of text. That could be a short sentence or one word. SSSS does not seem to do well with whole documents.

Let me give you an example. Let's say I want to take a secret and break it into 4 parts. The results look like this:
1-6a489b233e29ddc15d23a6c1c1ef9d80e2
2-198c349efd3d7d19b6f679e02655d9a6ca
3-373051f5bc311d51efbaccff7b3c1a44d0
4-fe056be57b143ca8615dc7a3e92151ea84

In this example lets say we only need any 2 of the 4 lines above to recreate my secret... pick any two of those lines and paste them into the combine field on this page .... pretty cool huh?

Installing SSSS in most flavors of linux should be trivial if you are comfortable compiling software. On Ubuntu feisty fawn you'll need to have a compiler installed, the easiest way to go about that is by issuing the following command:
sudo apt-get install build-essential
Then you should be able to navigate to the directory where you uncompressed ssss and compile the source.
On the Mac side its a little more tricky. First, you'll need to install Xcode from your OSX install DVD. SSSS requires glib which is not part of OSX by default. The easiest way to get glib is through MacPorts. Once you have MacPorts installed, open a terminal and type:
sudo port install glib
After that, SSSS should compile fine.
According to the SSSS page, there is a Windows port but its flawed. Use it at your own risk.

Once installed SSSS is simple to use, follow the on screen prompts.

I've split my passwords into 4 parts (of which I am requiring 3). I have them on USB keys that I've sent out into the world. Each key has a text file with instructions as well as OSX and Linux binaries of SSSS. I have told the holders of the USB keys, that in the event that I am ever incapacitated to assemble 3 of the 4 keys and follow the instructions to recover my passwords.

To implement my plan I turned to TrueCrypt. I wanted to crate a text file that had all of my passwords, as well as some other instructions and detailed information. TueCrypt made short work of turning that file into a block of unreadable gibberish. That way I can put a copy of the encrypted file on each USB drive. All that was left was to take the password for the TrueCrypt volume and and run it through SSSS.

I the end this may be more of an exercise in geekyness than anything else. But, perhaps, the tools and ideas can help inspire a ore elegant solution. Clearly there is power in Shamir's Secret Sharing and it seems to have a very usable role in online security. I would love to hear from anyone reading this about ways they have tackled this issue and what they think of SSS and my solution.

{mos_fb_discuss:3}