Skip to content

Commit 6a031ca

Browse files
mbartoschmbartosch
committed
Add documentation and script to recreate secret share set.
Fixes #15
1 parent bcc6db3 commit 6a031ca

File tree

2 files changed

+214
-0
lines changed

2 files changed

+214
-0
lines changed

‎README.keyceremony-shared-interactive.md

+118
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ This is an example runbook for an interactive key ceremony using Secret Sharing.
33

44
2013-12-16 Martin Bartosch
55

6+
# Creation of a secret share set and CA initialization
7+
68
Assumptions:
79
2048 Bit RSA key protected by a 128 Bit random pass phrase.
810
The pass phrase is split into 5 shares, of which 3 will be needed to perform CA operations.
@@ -52,3 +54,119 @@ cd dummyca
5254
5355
```
5456

57+
58+
59+
## Replacing a secret share set
60+
61+
If a share gets lost or if the existing quorum should be changed to a different one, it is possible to recreate the secret share set with a completely different secret share set, replacing the old share set.
62+
63+
This is done be decrypting the private key with the old quorum and re-encrypting the key with a newly created quorum, thus also changing the underlying passphrase.
64+
65+
Please note that the old private key file with the old share set will still be sufficient to unlock the private key, so make sure to destroy the old set and key once it has been verified that the new share set works.
66+
67+
The following procedure (also available as bin/change-quorum.sh) can be applied to perform this task.
68+
69+
Please note that you need to edit the script to adapt old and new quorum parameters. The script will fail if these parameters are not correct.
70+
71+
```bash
72+
#!/bin/bash -e
73+
#
74+
# 2019-12 Martin Bartosch
75+
# This script can assist CA Administrators in recreating a secret sharing
76+
# quorum.
77+
78+
# specify old (existing) quorum
79+
K_OLD=3
80+
N_OLD=5
81+
82+
# new quorum, default: identical to old quorum
83+
K_NEW=$K_OLD
84+
N_NEW=$N_OLD
85+
86+
KEY_OLD="$1"
87+
KEY_NEW="$2"
88+
89+
if [ -z "$KEY_NEW" ] ; then
90+
cat <<EOF
91+
Usage:
92+
$0 OLD_KEY_FILE NEW_KEY_FILE
93+
94+
This script will recreate a share set and write a copy of the existing
95+
private key KEY_OLD_FILE to the file KEY_NEW_FILE.
96+
The script will not overwrite KEY_NEW_FILE if the file already exists.
97+
The private key in KEY_NEW_FILE will be identical to KEY_OLD_FILE but it will
98+
be encrypted with a different random passphrase determined by the new
99+
quorum.
100+
After verifying that KEY_NEW_FILE can be used with the newly created quorum
101+
it can be used instead of KEY_OLD_FILE.
102+
103+
Assumptions:
104+
- the existing quorum and the new quorum are defined in this script
105+
(edit below settings to reflect the actual setup)
106+
- the existing private key is protected with the old quorum
107+
108+
EOF
109+
exit 0
110+
fi
111+
112+
# assert that secret is in $PATH
113+
type secret
114+
type openssl
115+
116+
if [ ! -r "$KEY_OLD" ] ; then
117+
echo "Old key $KEY_OLD not readable."
118+
exit 1
119+
fi
120+
if [ -e "$KEY_NEW" ] ; then
121+
echo "New key $KEY_NEW already exists, refusing to overwrite."
122+
exit 1
123+
fi
124+
125+
126+
echo "Recreating secret key sharing quorum"
127+
echo "Old quorum:"
128+
echo "k = $K_OLD"
129+
echo "n = $N_OLD"
130+
echo "New quorum:"
131+
echo "k = $K_NEW"
132+
echo "n = $N_NEW"
133+
134+
echo
135+
echo "Unlocking old $K_OLD/$N_OLD quorum (press RETURN)"
136+
read
137+
138+
export PASSPHRASE=""
139+
eval `secret get --k $K_OLD --n $N_OLD`
140+
141+
if [ $? != 0 ] ; then
142+
echo "Error unlocking old quorum."
143+
exit 1
144+
fi
145+
146+
if [ -z "$PASSPHRASE" ] ; then
147+
echo "Could not unlock old quorum."
148+
exit 1
149+
fi
150+
151+
export PASSPHRASE_OLD="$PASSPHRASE"
152+
153+
clear
154+
echo
155+
echo "Creating new $K_NEW/$N_NEW quorum (press RETURN)"
156+
read
157+
158+
eval `secret generate --k $K_NEW --n $N_NEW`
159+
160+
openssl pkey -in $KEY_OLD -out $KEY_NEW -passin env:PASSPHRASE_OLD -passout env:PASSPHRASE
161+
162+
if [ $? != 0 ] ; then
163+
echo "Error: could not re-encrypt private key"
164+
exit 1
165+
fi
166+
167+
168+
169+
```
170+
171+
172+

‎bin/change-quorum.sh

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/bin/bash -e
2+
#
3+
# 2019-12 Martin Bartosch
4+
# This script can assist CA Administrators in recreating a secret sharing
5+
# quorum.
6+
7+
# specify old (existing) quorum
8+
K_OLD=3
9+
N_OLD=5
10+
11+
# new quorum, default: identical to old quorum
12+
K_NEW=$K_OLD
13+
N_NEW=$N_OLD
14+
15+
KEY_OLD="$1"
16+
KEY_NEW="$2"
17+
18+
if [ -z "$KEY_NEW" ] ; then
19+
cat <<EOF
20+
Usage:
21+
$0 OLD_KEY_FILE NEW_KEY_FILE
22+
23+
This script will recreate a share set and write a copy of the existing
24+
private key KEY_OLD_FILE to the file KEY_NEW_FILE.
25+
The script will not overwrite KEY_NEW_FILE if the file already exists.
26+
The private key in KEY_NEW_FILE will be identical to KEY_OLD_FILE but it will
27+
be encrypted with a different random passphrase determined by the new
28+
quorum.
29+
After verifying that KEY_NEW_FILE can be used with the newly created quorum
30+
it can be used instead of KEY_OLD_FILE.
31+
32+
Assumptions:
33+
- the existing quorum and the new quorum are defined in this script
34+
(edit below settings to reflect the actual setup)
35+
- the existing private key is protected with the old quorum
36+
37+
EOF
38+
exit 0
39+
fi
40+
41+
# assert that secret is in $PATH
42+
type secret
43+
type openssl
44+
45+
if [ ! -r "$KEY_OLD" ] ; then
46+
echo "Old key $KEY_OLD not readable."
47+
exit 1
48+
fi
49+
if [ -e "$KEY_NEW" ] ; then
50+
echo "New key $KEY_NEW already exists, refusing to overwrite."
51+
exit 1
52+
fi
53+
54+
55+
echo "Recreating secret key sharing quorum"
56+
echo "Old quorum:"
57+
echo "k = $K_OLD"
58+
echo "n = $N_OLD"
59+
echo "New quorum:"
60+
echo "k = $K_NEW"
61+
echo "n = $N_NEW"
62+
63+
echo
64+
echo "Unlocking old $K_OLD/$N_OLD quorum (press RETURN)"
65+
read
66+
67+
export PASSPHRASE=""
68+
eval `secret get --k $K_OLD --n $N_OLD`
69+
70+
if [ $? != 0 ] ; then
71+
echo "Error unlocking old quorum."
72+
exit 1
73+
fi
74+
75+
if [ -z "$PASSPHRASE" ] ; then
76+
echo "Could not unlock old quorum."
77+
exit 1
78+
fi
79+
80+
export PASSPHRASE_OLD="$PASSPHRASE"
81+
82+
clear
83+
echo
84+
echo "Creating new $K_NEW/$N_NEW quorum (press RETURN)"
85+
read
86+
87+
eval `secret generate --k $K_NEW --n $N_NEW`
88+
89+
openssl pkey -in $KEY_OLD -out $KEY_NEW -passin env:PASSPHRASE_OLD -passout env:PASSPHRASE
90+
91+
if [ $? != 0 ] ; then
92+
echo "Error: could not re-encrypt private key"
93+
exit 1
94+
fi
95+
96+

0 commit comments

Comments
 (0)