Secret-sharing for GPG?

[Edward S. Marshall]

On Fri, 4 Dec 1998, brian moore wrote:
> This breaks when someone steals the key from the central server: they
> now have the ability to get around the "must have 2 signatures" rules.
> If they copy it to a floppy, they can keep it as an insurance package
> for when they get canned.

Yes, you have a single point of failure. However, this assumes the
compromise of the host. Frankly, if someone has compromised a server that
houses critical keys on it, it's time to start issuing revokations anyway.

In other words, you can work around this. But...

> There are ways to split keys (mathematically) that allow key sharing
> with no central secret key storage.

...>this< is definitely preferred. ;-) However, unless I'm missing
something, you still need a centrally stored "half-key", unless you're
talking about having two unique individuals sign the InterNIC submission
(which seems like a lot of overhead for nothing)?

However, even with a central "half-key" stored, it doesn't do an attacker
who compromises the key any good at all without the other half. If the
attacker is one of your employees who do InterNIC submissions, though,
you're stuck back in the same boat as before...

Or did I miss something in your description (I'm probably automating
things more than you were suggesting...)?

-- 
Edward S. Marshall <emarshal at logic.net>       [ What goes up, must come down. ]
http://www.logic.net/~emarshal/               [ Ask any system administrator. ]

   Linux labyrinth 2.1.129 #2 SMP Thu Nov 26 13:54:26 CST 1998 i586 unknown
        9:35pm up 8 days, 6:48, 3 users, load average: 0.04, 0.03, 0.15