3 ### Reveal shares of a secret distributed among keepers
5 ### (c) 2011 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This file is part of the distorted.org.uk key management suite.
12 ### distorted-keys is free software; you can redistribute it and/or modify
13 ### it under the terms of the GNU General Public License as published by
14 ### the Free Software Foundation; either version 2 of the License, or
15 ### (at your option) any later version.
17 ### distorted-keys is distributed in the hope that it will be useful,
18 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
19 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 ### GNU General Public License for more details.
22 ### You should have received a copy of the GNU General Public License
23 ### along with distorted-keys; if not, write to the Free Software Foundation,
24 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
27 case "${KEYSLIB+t}" in t
) ;; *) echo >&2 "$0: KEYSLIB unset"; exit 1 ;; esac
28 .
"$KEYSLIB"/keyfunc.sh
32 Reveal a share of a recovery key distributed among keepers.
34 If enough shares have been revealed, reconstruct the recovery private key.
35 The keeper nub is read from stdin.
38 ## Parse the command line.
39 case $# in 2) ;; *) usage_err
;; esac
40 recov
=$1 keeper
=$2; shift 2
41 checklabel
"recovery key" "$recov"
44 *) recov
=$recov/current
;;
46 checkword
"keeper set label" "$keeper"
48 ## Check that this is a sensible thing to do.
49 if [ ! -f
$KEYS/keeper
/$keeper/meta
]; then
50 echo >&2 "$quis: unknown keeper set \`$keeper'"
53 if [ ! -d
$KEYS/recov
/$recov ]; then
54 echo >&2 "$quis: unknown recovery key \`$recov'"
57 if [ ! -f
$KEYS/recov
/$recov/$keeper.param
]; then
58 echo >&2 "$quis: recovery key \`$recov' not kept by keeper set \`$keeper'"
62 ## Grab the key, because we'll need to read it several times.
66 ## Read the threshold from the recovery metadata.
67 t
=$
(sharethresh
$KEYS/recov
/$recov/$keeper.param
)
69 ## Find out which keeper index it corresponds to.
70 read n hunoz
<$KEYS/keeper
/$keeper/meta
73 while [ $i -lt
$n ]; do
74 c_sysprepare
$KEYS/keeper
/$keeper/$i
75 nubbin
=$
(nubid
<$tmp/secret
)
76 nubid
=$
(cat $KEYS/keeper
/$keeper/$i/nubid
)
77 case "$nubbin" in "$nubid") foundp
=t
; break ;; esac
81 nil
) echo >&2 "$quis: nub doesn't match keeper \`$keeper'"; exit 1 ;;
84 ## Establish the recovery staging area. See whether we've done enough
87 tag
=$
(echo $recov |
tr / .
)
88 mkdir
-p
-m700
$SAFE/keys.reveal
89 reveal
=$SAFE/keys.reveal
/$tag
90 if [ ! -d
$reveal ]; then mkdir
-m700
$reveal; fi
93 echo >&2 "$quis: recovery key \`$recov' already revealed"
99 if [ -f
$keeper.
$i.share
]; then
100 echo >&2 "$quis: share $i already revealed"
102 c_sysdecrypt
$KEYS/keeper
/$keeper/$i $tmp/secret \
103 <$KEYS/recov
/$recov/$keeper.
$i.share \
105 mv $keeper.
$i.new
$keeper.
$i.share
108 ## See if there's enough for a recovery.
110 for j
in $keeper.
*.share
; do if [ -f
"$j" ]; then n
=$
(( $n + 1 )); fi; done
111 if [ $n -lt
$t ]; then
112 echo >&2 "$quis: share $i revealed; $(( $t - $n )) more required"
114 cat $KEYS/recov
/$recov/$keeper.param
$keeper.
*.share
>$keeper.shares
115 $bindir/shamir recover
<$keeper.shares
>nub.new
116 c_sysprepare
$KEYS/recov
/$recov/store
117 nubbin
=$
(nubid
<nub.new
)
118 nubid
=$
(cat $KEYS/recov
/$recov/store
/nubid
)
122 echo >&2 "$quis: recovered nub doesn't match stored hash"
128 echo >&2 "$quis: recovery key \`$recov' revealed"
131 ###----- That's all, folks --------------------------------------------------