Splitting a GPG private key

[Alfredo Palhares]

Hello Daniel

> This is still ambiguous to me.  I described two distinct cases, and i'm
> not sure which one you are agreeing to.  From the rest of your message,
> i think you're agreeing to the first question, but not the second.

The objective is to require multiple people in order to use that key, so the
quote below is the one I agree it:
> Do you want to require multiple people to come together to use that
> secret key?

> I don't know what "the encryption group" means.  can you explain
> further?  I think you might mean that everything encrypted to any key
> will also be encrypted to this key; and that some especially sensitive
> material will *only* be encrypted to this key.

By encryption group I mean the group of keys that would be used to encrypt a
file. Let place an example.

I have a git repository with multiple passwords, these password are organized by
directories like such:
  credentials-repository
    ├─── Finance
    │     ├── mybank.txt.gpg
    │     ├── onlineinvoice-service.txt.gpg
    │     ├── stubs.js
    │     └── ticker.js
    ├─── Development
    │     ├── cloudservice.txt.gpg
    │     ├── emailserver.txt.gpg
    │     └── sshdetails.txt.gpg
    └── Operations
         ├── ssl-root.pem.gpg
         └── service2.txt.gpg

Now we have a team of 6 people Jim, Bob, Ana, Foo, Bar and Joe:
- Jim and Bob are the main starters of the group one is part of the Finance team
and another is a part of the development team.
- Ana and Foo are members of the finance team
- Bar and Joe are members of the development team.

Every single member has GPG key with their email.

All the files in finance directory are encrypted with Jim, Ana, Foo, and
the master GPG key so only these 3 and the master GPG can decrypt its contents.
people can access it and the root key.

The files in the development directory are encrypted with Bar, Joe and Bob and
the root key and only them can decrypt.

Now lets say we want to get the ssl root pem this would only be encrypted with
this root key, so this would both require Jim and Bob to be present to decrypt
its contents.

Also if there any other department that they do not belong to.

> https://tails.boum.org/news/signing_key_transition/index.en.html#index2h1
>
> says:
>
>  * Is not owned in a usable format by any single individual. It is split
>    cryptographically using gfshare.
>
>   gfshare is: http://www.digital-scurf.org/software/libgfshare
>
> If you have more questions about how they this, you may wish to ask them
> to the tails folks themselves:
>
>  https://tails.boum.org/support/index.en.html
>
> I find that their mailing lists and IRC channel (see "Support List" and
> "Chat" at the bottom of the page) are usually pretty helpful and
> responsive to well-framed questions.

This seems like a viable option, I will look into it.

-- 
Alfredo Palhares
GPG/PGP Key Fingerprint
68FC B06A 6C22 8B9B F110
38D6 E8F7 4D1F 0763 CAAD
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: </pipermail/attachments/20150408/58ee07dd/attachment.sig>