Since the beginning of time, information has been power. In ancient times, although they did not have ciphers like today's, the Greeks and Romans shared a taste for codes, from hiding messages on the scalp to encoding them in paintings.
On many occasions, especially in the business world, it is necessary to transmit information that, by its nature, is of vital importance to the company or to the people communicating it, since it can be very tempting for competitors or curious onlookers, so it must be ensured that it cannot be intercepted by them. A cipher is a channel for hiding a message, where letters are substituted or transposed with other letters, pairs of letters, and sometimes many letters.
What is the Secret Store?
It is a module developed by the Parity Tech team for its Ethereum client, which allows storing fragments of an ECDSA key on the Blockchain, with its reconstruction depending on a smart contract. All of this happens within a cryptographic system that prevents the nodes from reading the key on their own, so the messages / documents are completely secure.
What can the Secret Store do for Alice?
This Parity module can generate an ECDSA key pair for Alice in a session
Participants in a scheme with Secret Store available (Parity Wiki)
This is a basic example of what the Secret Store could do.
-
Alice and Bob are the main actors in the example. They want to share a secret (data encrypted in a secure and decentralized way)
-
For the actors to interact with the Blockchain, the Secret Store API must be opened on a specific port on one of the nodes.
-
The three nodes that share the Secret Store module are configured to serve as the engine for generating the distributed ECDSA keys.
-
At the top of this scheme, there is a smart contract that manages permissions, where the actor sending the message can set which addresses are authorized to receive the cryptographic tools needed to decrypt the message.
-
Note that there is a regular node (node 4) that is present in the network (stores transactions, mines, etc.) but does not store a fragment of the key being shared.
This means that Alice (or Bob) will be able to encrypt documents, mail, passwords, images, etc., with a secret key that will be distributed across the ecosystem of nodes (the threshold can be defined by the sender). With this, Alice or Bob only need to share the Document Key ID and the encrypted document with the person authorized to decrypt it.
Why use a cryptographic system and the fragmentation of ECDSA keys?
In cryptography, a cryptosystem is called a threshold cryptosystem when, in order to decrypt a message or sign a message, several parties must cooperate in the decryption or signing protocol. The message is encrypted using a public key, and the private key is distributed among the participants.
Suppose we have a polynomial of degree 5.
Graph of a degree 5 polynomial.
Even though the graph is generated by n infinite points, and having just one of them yields no further information about the polynomial, if you manage to have t points out of n it is possible to reconstruct the given function.
This helps us understand why this module is interesting: it means that the Secret Store lives on the Blockchain and there is no way a single node can use the information available to decrypt any message (unless a scheme is set up where only one node exists), and that the fragment of the ECDSA key it stores has no meaning or value unless the minimum threshold is reached. Even when it is reached, it will only generate the tools needed for the recipient to decrypt the data, without the fragments being stored on other nodes.
Conclusions
Parity's Secret Store could be a solution for sharing secrets between different actors; unfortunately, at this time it only works with local accounts, that is, accounts that have their KeyStore on the node where the Secret Store API runs. We hope that development continues and that it will soon be possible to generate secrets from any account.