Integrating n-of-m threshold scheme

[Andreas Schwier]

Hi,

I've added a blog entry that explains the concept with more details.

http://www.smartcard-hsm.com/2015/10/10/Shared_Control_over_Key_Usage.html

Andreas

On 09/07/2015 08:39 PM, Andreas Schwier wrote:
>> What are the use cases you have in mind?
> The feature was actually developed based on a customer request. It will
> be used for 3 different use cases
> 
> 1. Protect access to CA signing keys
> In the CA procedure the CA key store may only be activated by two key
> custodians acting together. Because key custodians have different times
> on duty, a group of 6 persons are authorized and two must act together
> to enable CA keys.
> 
> 2. Key escrow
> User documents are encrypted for a private key controlled by the
> document owner. If the document owner can no longer take control, a
> group of people come together to enable access to the escrow key, for
> which a copy of each document is encrypted. In the scheme 5 out of 10
> key custodians must work together.
> 
> 3. Shared control SSH access
> There exists a dedicated and quite expensive hardware box that allows to
> share control for important SSH keys. Using a SmartCard-HSM to store the
> SSH key and the a n-of-m scheme allows a less costly alternative using
> standard tools.
> 
> Of course there are more applications, like safeguarding code signing
> keys for example. The other application is remote activation where the
> SmartCard-HSM connects to an authentication server for activation.
> 
> For the PKCS#11 interface we are looking to use the remote management
> interface available in the ScriptingServer of the OpenSCDP project. That
> is basically a HTTP protocol (RAMoverHTTP from Global Platform) that
> connects the SmartCard-HSM via the P11 module with a remote server.
> Purpose of the server is to manage the authentication protocol, i.e.
> provide a website to the key custodian and support the authentication
> protocol for both sides, the SmartCard-HSM performing the n-of-m scheme
> and the device with the private authentication key.
> 
> Sounds to me like the remote APDU feature is similar. Where would I find
> the code ?
> 
> 
>>
>>
>> Salam-Shalom,
>>
>>    Werner
>>
> 
> 


-- 

    ---------    CardContact Software & System Consulting
   |.##> <##.|   Andreas Schwier
   |#       #|   Schülerweg 38
   |#       #|   32429 Minden, Germany
   |'##> <##'|   Phone +49 571 56149
    ---------    http://www.cardcontact.de
                 http://www.tscons.de
                 http://www.openscdp.org
                 http://www.smartcard-hsm.com