Distributed Cryptographic Key Storage via Nested Secret Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securely storing cryptographic keys, especially in cryptocurrency systems, are vulnerable to unauthorized access and loss, as they rely on secret-sharing processes that may not provide sufficient security against attackers who can compromise a threshold number of shares.
Innovation Solution
A distributed storage method that generates multiple key components, each split into shares with a threshold-based secret-sharing process, allowing reconstruction from any subset of shares above a predetermined threshold, ensuring that even if an attacker compromises an above-threshold number of shares, they may not have enough information to reconstruct the cryptographic key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cryptographic key is stored in a single data store, then access and reconstruction are simple, but security is compromised and loss risk increases
Solution Approach 1:
The cryptographic key is segmented into multiple key components, where each key component is further divided into multiple shares. This hierarchical segmentation ensures that no single storage location holds the complete key, thereby enhancing security while maintaining manageable complexity through structured organization.
Solution Approach 2:
The patent implements a nested structure where shares are contained within key components, which in turn are contained within the cryptographic key. This nested doll approach allows for layered security mechanisms where each level provides additional protection, resolving the contradiction between security enhancement and system complexity.
2Reliability
If secret-sharing is used to split the cryptographic key into shares, then security is improved, but an attacker compromising a threshold number of shares can still reconstruct the key
Solution Approach 1:
The key is divided into multiple key components, each with its own set of shares. An attacker must compromise shares across multiple key components simultaneously, not just a threshold number of shares from a single component. This segmentation approach significantly reduces attack vulnerability while maintaining security.
Solution Approach 2:
The cryptographic key is constructed as a composite of multiple key components, where each component contributes a portion of the overall security. This composite structure ensures that compromising one component or its shares does not compromise the entire key, thereby addressing the attack vulnerability issue.
3Reliability
If multiple key components are used, then security against attackers is enhanced, but the complexity of key management and reconstruction increases
Solution Approach 1:
The system employs a universal secret-sharing framework that can be applied to each key component independently. This multi-functional approach allows the same threshold secret-sharing mechanism to be reused across multiple key components, enhancing security while maintaining ease of operation through standardized procedures.
Solution Approach 2:
The key components and their shares are pre-organized in a structured manner, with predetermined thresholds and reconstruction procedures. This preliminary organization simplifies key management and reconstruction operations, reducing the complexity burden that would otherwise arise from multiple key components.
Data Source
AI summary
A method for distributed storage of a cryptographic key comprises generating a plurality of key components, wherein each key component is generated by a different respective computing device or enclave. The key components are suitable for processing to generate a cryptographic key that depends on all of the key components. The method comprises processing a first key component in a secret-sharing generation process to generate a plurality of shares, so that the first key component can be reconstructed from any subset of the shares of at least a predetermined threshold size. The method further comprises storing a first share in a first store, and storing a second share in a second store.