Feature request : Sub-group keys

[ndx1905-github]

Hi, the description today is you can decrypt a file for instance with 3 keys out of a group of 5 friends.

I am thinking of a different scenarios that would require for instance

• any key from group of people A
• any key from group of people B
• at least 3 keys from group of people C

This has real life examples

Or even more complex scenarios, but I have no use case in mind for this:

• 2 keys from A or 3 keys from B
• or all keys from C

[eljojo]

Hi, this is an interesting idea. This is possible, but I have no idea how the UX for this would work, I imagine it as a CLI-only kind of situation. In theory you can do this yourself today already.

The trick is to chain shamirs, pseudocode in ruby

my_data = "hello world"

# encrypt
first_split, big_payload = shamir(my_data, minimum_keys: 3, total_keys: 3) # require 3 out of 3
group_a, group_b = first_split[0], first_split[1]
group_c_keys, small_payload = shamir(first_split[2], minimum_keys: 3, total_keys: whatever_you_want)

# unlock
group_c = decrypt(small_payload, group_c_keys[1..3])
decrypted_data = decrypt(big_payload, [group_a, group_b, group_c]) # "hello world"

through a mechanism like the one above, you can give the same key from "group a" to anyone in that group, same for "group b" (everyone can have the same key, it doesn't matter). for "group c", they need to get together with their sub-keys, and get back together the "group key". Once they get it out, they can take all three group keys and unlock the vault.

Can you give me more context on how you imagine to use this?

[ndx1905-github]

Any circumstance where you have subgroups who have veto rights and subgroups who have a majority vote for instance.
I was wondering how this could be transformed in a voting mechanism -> Yes is unlocked if all with blocking rights do give their keys, while those with a no blocking right just contribute to secure a majority.

Other more far fetched scenario, that are a bit echoeing the apple whitepaper for csam. see https://hackernoon.com/a-late-laymans-overview-of-the-technology-behind-apples-csam-detection https://decentralizedthoughts.github.io/2021-08-29-the-private-set-intersection-psi-protocol-of-the-apple-csam-detection-system/
Each picture that is recognized locally by the phone as being potentially csam has a low resolution copy be encrypted and sent to a vault. A partial key is added to the picture (meta data or additional file / db). Imagine than given the lack of precision of the detection, you need a 10 or whatever hits like this to think there might be real CSAM content in those pictures. Then you need 10 partial keys to decrypt that.
But.. you always need one or two other special keys to really decrypt the pictures: one from the police (so that no random individual can access it) and one from a judge who will authorize the decryption (so that the police cannot access the content without proper authorization and the judge key).

[eljojo]

Aha I see. I think we need to think about this in terms of "Group Key", going from your original example, "People C" are the "Group Key" that the software helps manage too. From the UI we can either "Add Friend" or "Add Group", and then we can add friends inside that group.

I still think the UX could be challenging, but the idea is crystallizing in my mind. Certainly an advanced use case.