GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages


Manual Reference Pages  -  SSSS (1)

NAME

ssss - Split and Combine Secrets using Shamir’s Secret Sharing Scheme.

CONTENTS

Synopsis
Description
Commands
Options
Example
Notes
Security
Author
Further Reading

SYNOPSIS

ssss-split -t threshold -n shares [-w token] [-s level] [-x] [-q] [-Q] [-D] [-v]

ssss-combine -t threshold [-x] [-q] [-Q] [-D] [-v]

DESCRIPTION

ssss is an implementation of Shamir’s Secret Sharing Scheme. The program suite does both: the generation of shares for a known secret, and the reconstruction of a secret using user-provided shares.

COMMANDS

ssss-split: prompt the user for a secret and generate a set of corresponding shares.

ssss-combine: read in a set of shares and reconstruct the secret.

OPTIONS

-t threshold
  Specify the number of shares necessary to reconstruct the secret.
-n shares
  Specify the number of shares to be generated.
-w token
  Text token to name shares in order to avoid confusion in case one utilizes secret sharing to protect several independent secrets. The generated shares are prefixed by these tokens.
-s level
  Enforce the scheme’s security level (in bits). This option implies an upper bound for the length of the shared secret (shorter secrets are padded). Only multiples of 8 in the range from 8 to 1024 are allowed. If this option is ommitted (or the value given is 0) the security level is chosen automatically depending on the secret’s length. The security level directly determines the length of the shares.
-x Hex mode: use hexadecimal digits in place of ASCII characters for I/O. This is useful if one wants to protect binary data, like block cipher keys.
-q Quiet mode: disable all unnecessary output. Useful in scripts.
-Q Extra quiet mode: like -q, but also suppress warnings.
-D Disable the diffusion layer added in version 0.2. This option is needed when shares are combined that where generated with ssss version 0.1.
-v Print version information.

EXAMPLE

In case you want to protect your login password with a set of ten shares in such a way that any three of them can reconstruct the password, you simply run the command

ssss-split -t 3 -n 10 -w passwd

To reconstruct the password pass three of the generated shares (in any order) to

ssss-combine -t 3

NOTES

To protect a secret larger than 1024 bits a hybrid technique has to be applied: encrypt the secret with a block cipher and apply secret sharing to just the key. Among others openssl and gpg can do the encryption part:

openssl bf -e < file.plain > file.encrypted

gpg -c < file.plain > file.encrypted

SECURITY

ssss tries to lock its virtual address space into RAM for privacy reasons. But this may fail for two reasons: either the current uid doesn’t permit page locking, or the RLIMIT_MEMLOCK is set too low. After printing a warning message ssss will run even without obtaining the desired mlock.

AUTHOR

This software (v0.5) was written in 2006 by B. Poettering (ssss AT point-at-infinity.org). Find the newest version of ssss on the project’s homepage: http://point-at-infinity.org/ssss/.

FURTHER READING

http://en.wikipedia.org/wiki/Secret_sharing
Search for    or go to Top of page |  Section 1 |  Main Index


Manuals SSSS (1) User

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.