2
$\begingroup$

I have a locked-down production system that we'd like to process specific requests, picked-up (poll) from a less-secure location. For security and "go slow, this is production" reasons, a request must be authorized by 2 (or N) people on the team.

I can imagine how to implement this fairly simply just using openssl and signatures -- e.g., the secure server has a pool of public keys (people on the team who can authorize a request) and any submitted request must be correctly signed (e.g., https://stackoverflow.com/questions/10782826/digital-signature-for-a-file-using-openssl) with the private keys of N different people from that pool.

But it seems like a common-enough requirement that it must already exist; any pointers? I have a suspicion I'm just not searching for the right terminology... Thanks!

$\endgroup$
2
$\begingroup$

What you are describing is called $(t,n)$-threshold signature, where you need at least $t$ parties (out of a total of $n$) to create a signature. Considering your description, it seems that in your case $t=n$, so it is necessary that all the keys are used for creating the signature.

This answer assumes that you want to verify the signature with a single public key (i.e., $n$ signatures, 1 verification). If you want to use $n$ public keys, then you can just require $n$ independent signatures.

$\endgroup$
  • $\begingroup$ Ah interesting -- I wasn't aware there's a way to support this without even maintaining a list of accepted signers to check with. In our case we're not t=n, actually (any two people out of a larger team should be able to sign a request to make it authentic), but the idea applies. Because we already have our own public keys, it may in the end be simpler to simply require n independent signatures. I still don't see implementations around that do this, but it's a simple enough case that perhaps most people are using custom setups anyway. $\endgroup$ – Rob Whelan Jul 17 '15 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.