# Is splitting AES ecrypted data safe?

Say I have a key, an iv and an AES/GCM/NoPadding encoded string and I want to split this information between three people such that only jointly can they reveal the secret.

Is it safe to just split all this data to three equal chunks and provide to each party in a format "1/3 of key-1/3 of pass-1/3 of iv"? Under "safe" I mean, is it possible to come up with some kind of efficient attack while having 1/3 (or 2/3) of all the data?

-
What research have you done? Have you looked at the other questions marked secret-sharing? Why are you considering this approach rather than one of the standard schemes that are mentioned in those other questions, such as Shamir secret sharing? – D.W. Nov 3 '14 at 21:14
@D.W. I'm aware of SSSS, but in my case I need strictly n-of-n, not m-of-n so yes, as poncho has indicated, Shamir's scheme is sort of an overkill here. Eventually I've opted for his bit strings idea. No, I didn't look at other secret-sharing questions because yolo. – Anton Nov 4 '14 at 14:27

To answer your question, the cryptographic complexity will reduce by $2^{k-n}$ where $k$ is the key length and $n$ is the number of bits known.

A slightly better scheme that doesn't use a cryptographic key sharing scheme can be as follows: Generate three random numbers $B_1$, $B_2$, $B_3$ with bit length equal to the size of your key $K_p$. Generate each key with the following scheme:

$K_1$ = $B_1$ $\oplus$ $B_2$ $\oplus$ $K_p$

$K_2$ = $B_2$ $\oplus$ $B_3$ $\oplus$ $K_p$

$K_3$ = $B_1$ $\oplus$ $B_3$ $\oplus$ $K_p$

The original key can be reconstituted by:

$K_p$ = $K_1$ $\oplus$ $K_2$ $\oplus$ $K_3$

-
Actually, you don't need three separate $B_1, B_2, B_3$ values; you can get by with two. – poncho Nov 3 '14 at 18:24
@poncho Yes, but he did provide an answer that I can vote on :) – Maarten Bodewes Nov 3 '14 at 18:25
@poncho you are correct. I was thinking more of a homogeneous scheme so I wouldn't put bias on a particular key. The extra work provides no additional security. – Daniel Henneberger Nov 3 '14 at 18:33

Just use Shamir's Secret sharing: wiki link

It's designed by Adi Shamir, who is the "S" in RSA. It's fairly simple to use and there are no known weaknesses in it. While it doesn't split the data, splitting the key may work just as well (unless you absolutely must split the data.)

-
Actually, if you want to require all three shares to be able to retrieve the shared secret, then Shamir's method is overkill; just pick two random bit strings $B_1$ and $B_2$ and make those two of the shares; and make the third $B_1 \oplus B_2 \oplus M$, where $M$ is the secret. – poncho Nov 3 '14 at 16:13
Good point. Shamir's method is more useful if you need a $k$ of $n$ threshold. If you always need $n$ of $n$ keys then the XOR method is a simpler solution. – user13741 Nov 3 '14 at 16:29
Also, you said with "Shamir's method", there's no known weaknesses. Actually, we can make a stronger statement: if the internal values are randomly generated, then we can prove that $N-1$ shares do not give any information about the shared secret (and the same holds for my simpler method). – poncho Nov 3 '14 at 16:30
I can prove poncho's reduction. – Joshua Nov 3 '14 at 18:35