# Encrypt a file in a way that decryption requires every recipient's cooperation

The best related concept I can think of is the two-man rule. https://en.wikipedia.org/wiki/Two-man_rule.

To put it simply, n people are required to give their authorization before a system / secret can be used.

If I have a file (say an encrypted password or private key) that allows me to access a server with sensitive information. I will require a key from the data privacy officer and the lead engineer.

Does anyone know a way I could implement this using existing tools and maybe some systems language (read: go) to tie it all together?

I'd imagine there are multiple systems involved in making this work, but what I'm mostly curious about the cryptography.

There are various ways to do this, but one of the most flexible ways is to use a secret sharing scheme. These are mathematical methods that allow a secret value (such as a symmetric encryption key, or even an entire file) to be split into multiple "shares", such that a certain number of shares (which does not necessarily need to be all of them) is required to reconstruct it.

For example, a simple $$n$$-out-of-$$n$$ secret sharing scheme like you describe can be obtained by taking $$n-1$$ random bitstrings (from a cryptographically secure true RNG) of the same length as the secret, and constructing the $$n$$-th share by bitwise XORing together all $$n-1$$ other shares and the secret. It's not hard to prove that this last share is then also indistinguishable from random, and in fact that knowing no set of $$n-1$$ or fewer shares yield any information about the secret (other than its length, that is). But if you have all $$n$$ shares, you can just XOR them together to get the original secret value back.

Once you've split the secret into $$n$$ shares, you can of course then e.g. encrypt each share with a different person's key. Or you could just directly send each share to the person it belongs to for safekeeping, if that's more practical.

The real power of secret sharing schemes, however, is that you don't necessarily have to require all shareholders to cooperate in order to reconstruct the secret. Specifically, there exist efficient threshold secret sharing schemes, such as Shamir's scheme, which work basically just like the simple XOR scheme described above, but allow the secret to be reconstructed from any subset of $$k \le n$$ shares, where $$k$$ is an arbitrary threshold set when the shares are created.

The mathematics involved are slightly more complicated than in the basic XOR scheme above, but they provide essentially the same guarantee: any $$k$$ shares uniquely determine the secret, whereas $$k-1$$ shares do not reveal any information about it whatsoever (not even if the attacker has infinite computing power!).

For example, to implement a general "two-person rule" for accessing some sensitive data (which could e.g. be a key to something else), you could use Shamir's secret sharing with a threshold of $$k = 2$$ to split the data into $$n$$ shares, and distribute these among all authorized persons. That way, any two authorized persons could combine their shares to reconstruct the data. But as far as a single person acting alone is concerned, their share is just a random number that reveals absolutely nothing about the data unless combined with another share.

There are also hierarchical secret sharing schemes that allow more complex access structures, such that one could require e.g. "any two people in group $$A$$ and any three other people in group $$B$$" to access the secret. I could go into more detail, but we actually have an entire tag with plenty of good questions and answers that you might want to take a look at.

• please note that once the key is constructed from the shares, the key is on the hand of the server. It is no more shared. Also, the construction step requires a trusted party. Oct 5 '18 at 19:56
• @kelalaka: The construction step in Shamir's scheme (or the trivial XOR scheme) really only requires the shareholders who want to reconstruct the key to trust each other. On the other hand, if one of the shareholders wants to cheat, they can do so (by lying about their share) regardless of who does the actual reconstruction. There do exist, however, other secret sharing schemes that (try to) prevent that. Oct 5 '18 at 22:13
• Yes, I'm aware that you followed his steps. Wrote it yo just remember. Thanks Oct 5 '18 at 22:18

You could use cascaded AES.

EncryptAES(Key1, EncryptAES(Key2, EncryptAES(Key3, Password)))

It would just be important to know the sequence in order to decrypt it (else you would to do it with trial and error until you found the correct sequence again).

It does however not directly increase the security.

• I was thinking something similar actually. My experience in cryptography is limited, so I'm just trying to figure out if it's even possible to execute something like this: A: requesting party, B, C: parties that need to give permission. A encrypts secret -> sends to B -> B decrpyts partial 1 -> sends to C -> c decrypts partial 2 -> sends back to A -> a decrypts finally. I guess if you could "curry" the encryption / decryption algorithm is what i'm after. Oct 5 '18 at 12:54

After a bit of research, I've stumbled onto cloudflare's implementation of the two-man rule called Red October

https://blog.cloudflare.com/red-october-cloudflares-open-source-implementation-of-the-two-man-rule/

In case anyone has a similar question ^ is how they implemented it. Source here: https://github.com/cloudflare/redoctober

Using cascading AES (or really any encryption scheme) works, but there's a way to do it that does not requiring correct ordering.

Lets say there exists a master key $$sk$$ which grants access to the system.

After generating $$sk$$, you randomly sample $$n-1$$ random bit strings $$r_1,\cdots,r_{n-1}$$ (of the same length as $$sk$$). Then set $$r_n=sk\oplus r_1\oplus\cdots\oplus r_{n-1}$$. The secret key $$sk$$ is perfectly hidden unless one as all of $$r_1,\cdots,r_n$$. You could thus give person $$i$$ the value $$r_i$$. If any person chooses to withhold their value, then $$sk$$ is unrecoverable.

This post describes a 2-of-3 secret sharing scheme where any 2 of 3 people are needed to reconstruct the secret. It's so simple you can do it by hand very quickly.