What makes Secure Shares secure is the property that, given that a hypothetical attacker has gotten hold of fewer Secure Shares than what has been set as the threshold
for recovering the secret, your k, then knowing these Secure Shares still gives no information about the secret at all except for maybe about its size or length.
(Learning about the length of the secret is not considered a problem in cases where the attacker already knows or guesses that the secret constitutes
the access key to some cryptocurrency wallet, for instance, as these key lengths are fixed.)
In other words, your k absolutely constitutes an "all or nothing" threshold.
Compare that to what is commonly called
key splitting. To this end, let us assume your key or, equivalently, your secret consists of nine digits like, say, 176507492. (That's just for the sake of discussion. You should never use such a simple
passphrase for anything.)
You may be tempted to create three splits of this key, namely,
"176507...", "...507492", and "176...492". Any set of two of these splits is sufficient to recover your key, hence your "k" is 2. Now, notice that, if an attacker has gotten hold of only one of these splits,
which is less than your "k", of course,
then all that is left for the attacker is to guess three more digits, which works out to no more than 1000 guesses as 1000 is equal to 10 (as there are 10 possible digits)
taken to the power of 3 (as there are only three digits left to guess). By getting hold of only one split, the problem of guessing your key has, thus, become astronomically simpler than the one of guessing it without
having gotten hold of any split, as in that case the number of guesses can reach 10 taken to the power of 9. We can conclude that, just by getting hold of one of these splits, the attacker has
practically gained almost the all information
contained in the passphrase itself.
By contrast, kn Secrets does most emphatically not operate according to the key splitting idea or any other naive
idea of this kind. More specifically, the algorithm that is implemented in kn Secrets exploits a principle called polynomial interpolation over a finite field.
What is crucial about this approach
to creating Secure Shares is precisely that it avoids the partial-information problem that key splitting or any other method of this kind leads to.
2. Is kn Secrets an implementation of the algorithm that is known as Shamir's secret sharing?
Yes, that's precisely true, kn Secrets implements Shamir's secret sharing. In other words, there is nothing special about
kn Secrets in terms of technology. But that's a desirable property because kn Secrets is about providing security.
The core idea of kn Secrets consists of implementing a known security algorithm in a way that
is as straightforward to use and as transparent as possible. Inventing your own "security algorithm" so that
it is really secure is usually very difficult — So it is a good thing that kn Secrets does not do this.
3. Is kn Secrets compatible with any other implementation of Shamir's secret sharing?
kn Secrets is not compatible in any way with any other implementation of Shamir's secret sharing that can be found
on the Internet. These implementations differ from kn Secrets considerably with regard to many technical details.
In particular, it is not possible to recover Secure Shares generated with kn Secrets using any other of the available
implementations of Shamir's secret sharing.
4. Does kn Secrets address any of the practical usability concerns that have been raised with regard to Shamir's secret sharing?
No, kn Secrets only implements Shamir's secret sharing itself, not more than that. It's entirely up to users
to determine whether employing the scheme really makes their secrets
more secure from a holistic point of view taking into consideration all of their their individual, practical circumstances.
5. I have lost some of my Secure Shares, and the number of Secure Shares that remain is lower than the minimum that I set for recovery.
Is that of any use in recovering my secret after all?
No, absolutely not. If you do not have the required number of Secure Shares left, then this situation is equivalent
to having lost the entirety of your Secure Shares and, consequently, the secret itself (unless you cannot recover the secret in some other way). This property is the
whole point about Shamir's secret sharing.
6. Surely there must be some secret trick that would allow me to circumvent the previous point?
Well, sorry, no. No such trick has ever been discovered by the crypto community and most probably never will.
7. But just going offline does not protect against any malware attacks where secrets or Secure Shares get stored in some inconspicuous place on my system?
Hackers would then retrieve that store once I am online again.
That's completely true, of course. If you worry about such attacks, then you could set aside some dedicated PC to compute Secure Shares or recover secrets
from Secure Shares.
This PC must never go online ever again once you have started using it in this role. (There must also be no data transfer via any other channel, for example,
via USB stick.) Any old PC will probably do as performance requirements
for running kn Secrets are low. Please note that, if you take this mode of attack seriously, then you must really not go online with your dedicated PC
ever again, not even after having carried out a secure erase of every disk built into it, followed by reinstalling the operating system.
That's because disk storage might not be the only permanent storage on your PC where malware might be able to stash
your secrets or Secure Shares for hackers to be able to retrieve them later. Only once your secrets or Secure Shares have ceased to be of any value,
for example, because you have
emptied and nullified your cryptocurrency accounts that you secured using kn Secrets, it is secure for the dedicated PC to go online again.
8. I have heard about "side-channel attacks" exploiting electromagnetic emissions of the system targeted. Is kn Secrets secure against this kind of attack?
No, kn Secrets in and of itself is not secure against this kind of attack. That's regardless of whether you use it in online or offline mode. We figure that, if you
have to worry about attackers possessing sufficient resources to mount electromagnetic side-channel attacks, then you also have to worry about these same attackers
redirecting their resources to steal your secrets in a variety of ways, for example, by breaking into your premises. Electromagnetic side-channel attacks
usually require getting
somewhat close to your system anyways.
It then becomes a question of how to spend your own resources in a balanced manner to secure your secrets against different methods that might conceivably
be used by attackers to try and
steal them. If a cost-benefit calculation leads you to harden your premises against being broken into, for instance, then you might
also want to spend resources on installing physical shielding that reduces the risk of your computer system leaking data in the electromagnetic spectrum.
Such a balanced approach in the physical realm might
be considered more coherent and secure than relying on software algorithms that inject computational noise into your system, so to speak, in an attempt to make
electromagnetic side-channel
attacks more difficult.
9. What sources of randomness does kn Secrets use in computing Secure Shares?
The quality of Secure Shares computed by kn Secrets indeed depends on the quality of the random numbers used in doing that.
kn Secrets chiefly employs two sources of randomness stacked on top of each other. At the base,
there is a third-party, cryptographically secure pseudo-random number generator that is open source and has been in the open as such unchallenged for a number of years,
as far as we know. On top of this layer, random graphical points drawn by the user are employed in triggering this pseudo-random number generator.
We assume that this staggered approach, on the whole, brings us sufficiently close to true randomness.
A separate group of points is used for each random number required in computing Secure Shares. Each time Secure Shares are to be re-computed
for any given secret, completely new points have to be provided by the user.
10. What do I do if I want to copy and paste the BIP39 mnemonics of a Secure Share without the indices that appear to the left of them?
The tabular presentation in Step 7 of making Secure Shares is programmed in a way that allows users to move their mouse cursor
to mark just the BIP39 mnemonics of each individual Secure Share.
On most operating systems, a right-click should then bring up a context menu that allows the user to copy just the mnemonics
and nothing else to the clipboard. Please make sure to follow the security guidelines with regard to handling Secure Shares on your system
if you want to do anything else with them other than noting them down with pen and paper.
11. How does kn Secrets work under the hood?
At the risk of using some technical jargon, the philosophy behind kn Secrets consists of giving transparency total priority over obfuscation.
The way in which kn Secrets achieves this goal consists of providing a pure, and rather straightforward, JavaScript implementation
of the secret sharing algorithm up to and including using JavaScript (and user inputs, see above) for generating random numbers.
Please note that, in keeping with prioritizing transparency, we make heavy use of JavaScript BigInt's — This design decision is
particularly frowned upon by people who worry about electromagnetic
side-channel attacks. Users are kindly asked to refer to the JavaScript code itself if they would like to know more about how kn Secrets works.
The JavaScript code is easy to get hold of by downloading the offline version of kn Secrets. It ought to be self-explanatory,
so we will not provide any explanation that goes any further than what is written here.