kn Secrets

What makes Secure Shares secure is the property that, given that a hypothetical attacker has gotten hold of fewer Secure Shares than what has been set as the threshold for recovering the secret, your k, then knowing these Secure Shares still gives no information about the secret at all except for maybe about its size or length. (Learning about the length of the secret is not considered a problem in cases where the attacker already knows or guesses that the secret constitutes the access key to some cryptocurrency wallet, for instance, as these key lengths are fixed.) In other words, your k absolutely constitutes an "all or nothing" threshold. Compare that to what is commonly called key splitting. To this end, let us assume your key or, equivalently, your secret consists of nine digits like, say, 176507492. (That's just for the sake of discussion. You should never use such a simple passphrase for anything.) You may be tempted to create three splits of this key, namely, "176507...", "...507492", and "176...492". Any set of two of these splits is sufficient to recover your key, hence your "k" is 2. Now, notice that, if an attacker has gotten hold of only one of these splits, which is less than your "k", of course, then all that is left for the attacker is to guess three more digits, which works out to no more than 1000 guesses as 1000 is equal to 10 (as there are 10 possible digits) taken to the power of 3 (as there are only three digits left to guess). By getting hold of only one split, the problem of guessing your key has, thus, become astronomically simpler than the one of guessing it without having gotten hold of any split, as in that case the number of guesses can reach 10 taken to the power of 9. We can conclude that, just by getting hold of one of these splits, the attacker has practically gained almost the all information contained in the passphrase itself. By contrast, kn Secrets does most emphatically not operate according to the key splitting idea or any other naive idea of this kind. More specifically, the algorithm that is implemented in kn Secrets exploits a principle called polynomial interpolation over a finite field. What is crucial about this approach to creating Secure Shares is precisely that it avoids the partial-information problem that key splitting or any other method of this kind leads to.

Yes, that's precisely true, kn Secrets implements Shamir's secret sharing. In other words, there is nothing special about kn Secrets in terms of technology. But that's a desirable property because kn Secrets is about providing security. The core idea of kn Secrets consists of implementing a known security algorithm in a way that is as straightforward to use and as transparent as possible. Inventing your own "security algorithm" so that it is really secure is usually very difficult — So it is a good thing that kn Secrets does not do this.

kn Secrets is not compatible in any way with any other implementation of Shamir's secret sharing that can be found on the Internet. These implementations differ from kn Secrets considerably with regard to many technical details. In particular, it is not possible to recover Secure Shares generated with kn Secrets using any other of the available implementations of Shamir's secret sharing.

No, kn Secrets only implements Shamir's secret sharing itself, not more than that. It's entirely up to users to determine whether employing the scheme really makes their secrets more secure from a holistic point of view taking into consideration all of their their individual, practical circumstances.

No, absolutely not. If you do not have the required number of Secure Shares left, then this situation is equivalent to having lost the entirety of your Secure Shares and, consequently, the secret itself (unless you cannot recover the secret in some other way). This property is the whole point about Shamir's secret sharing.

Well, sorry, no. No such trick has ever been discovered by the crypto community and most probably never will.

That's completely true, of course. If you worry about such attacks, then you could set aside some dedicated PC to compute Secure Shares or recover secrets from Secure Shares. This PC must never go online ever again once you have started using it in this role. (There must also be no data transfer via any other channel, for example, via USB stick.) Any old PC will probably do as performance requirements for running kn Secrets are low. Please note that, if you take this mode of attack seriously, then you must really not go online with your dedicated PC ever again, not even after having carried out a secure erase of every disk built into it, followed by reinstalling the operating system. That's because disk storage might not be the only permanent storage on your PC where malware might be able to stash your secrets or Secure Shares for hackers to be able to retrieve them later. Only once your secrets or Secure Shares have ceased to be of any value, for example, because you have emptied and nullified your cryptocurrency accounts that you secured using kn Secrets, it is secure for the dedicated PC to go online again.

No, kn Secrets in and of itself is not secure against this kind of attack. That's regardless of whether you use it in online or offline mode. We figure that, if you have to worry about attackers possessing sufficient resources to mount electromagnetic side-channel attacks, then you also have to worry about these same attackers redirecting their resources to steal your secrets in a variety of ways, for example, by breaking into your premises. Electromagnetic side-channel attacks usually require getting somewhat close to your system anyways. It then becomes a question of how to spend your own resources in a balanced manner to secure your secrets against different methods that might conceivably be used by attackers to try and steal them. If a cost-benefit calculation leads you to harden your premises against being broken into, for instance, then you might also want to spend resources on installing physical shielding that reduces the risk of your computer system leaking data in the electromagnetic spectrum. Such a balanced approach in the physical realm might be considered more coherent and secure than relying on software algorithms that inject computational noise into your system, so to speak, in an attempt to make electromagnetic side-channel attacks more difficult.

The quality of Secure Shares computed by kn Secrets indeed depends on the quality of the random numbers used in doing that. kn Secrets chiefly employs two sources of randomness stacked on top of each other. At the base, there is a third-party, cryptographically secure pseudo-random number generator that is open source and has been in the open as such unchallenged for a number of years, as far as we know. On top of this layer, random graphical points drawn by the user are employed in triggering this pseudo-random number generator. We assume that this staggered approach, on the whole, brings us sufficiently close to true randomness. A separate group of points is used for each random number required in computing Secure Shares. Each time Secure Shares are to be re-computed for any given secret, completely new points have to be provided by the user.

The tabular presentation in Step 7 of making Secure Shares is programmed in a way that allows users to move their mouse cursor to mark just the BIP39 mnemonics of each individual Secure Share. On most operating systems, a right-click should then bring up a context menu that allows the user to copy just the mnemonics and nothing else to the clipboard. Please make sure to follow the security guidelines with regard to handling Secure Shares on your system if you want to do anything else with them other than noting them down with pen and paper.

At the risk of using some technical jargon, the philosophy behind kn Secrets consists of giving transparency total priority over obfuscation. The way in which kn Secrets achieves this goal consists of providing a pure, and rather straightforward, JavaScript implementation of the secret sharing algorithm up to and including using JavaScript (and user inputs, see above) for generating random numbers. Please note that, in keeping with prioritizing transparency, we make heavy use of JavaScript BigInt's — This design decision is particularly frowned upon by people who worry about electromagnetic side-channel attacks. Users are kindly asked to refer to the JavaScript code itself if they would like to know more about how kn Secrets works. The JavaScript code is easy to get hold of by downloading the offline version of kn Secrets. It ought to be self-explanatory, so we will not provide any explanation that goes any further than what is written here.