3 ### Generate a new recovery key and split it among keepers
5 ### (c) 2011 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 case "${KEYSLIB+t}" in t
) ;; *) echo >&2 "$0: KEYSLIB unset"; exit 1 ;; esac
26 .
"$KEYSLIB"/keyfunc.sh
30 Generate a new recovery secret, and split it among the available keepers.
32 The new secret will be called RECOV. For each KEEPER set, the private key
33 wil be split into shares, and encrypted with the KEEPER's public keys; any K
34 of these shares can be used to reveal the original key.
36 If there is already a recovery key called RECOV then it will be rolled over.
37 The previous key must already be revealed. If KEEPERs are listed, these
38 replace the existing keeper sets; otherwise the same keepers as before are
41 If there is not a recovery key called RECOV then at least one keeper set must
46 ## Parse the command line.
47 case $# in 0) echo >&2 "$usage"; exit 1 ;; esac
49 checkword
"recovery key label" "$recov"
53 *) echo >&2 "$quis: bad keeper spec \`$k'"; exit 1 ;;
55 keeper
=${k%:*} t
=${k#*:}
56 checkword
"keeper set label" "$keeper"
57 checknumber
"keeper quorum" "$t"
60 ## Establish the keeper parameters.
61 rdir
=$KEYS/recov
/$recov
62 if [ ! -d
$rdir ]; then mkdir
-m755
-p
$rdir; fi
69 keeper
=${k%:*} t
=${k#*:}
71 done >$rdir/keepers.new
72 kparam
=$rdir/keepers.new
75 if [ ! -f
$kparam ]; then echo >&2 "$quis: no keepers specified"; exit 1; fi
77 ## Make the new key and issue the shares.
78 tmp
=$
(mktmp
); cleanup rmtmp
82 ec_keygen secret
$rdir/new
/pub
83 while read keeper k
; do
84 read n hunoz
<$KEYS/keeper
/$keeper/meta
85 shamir issue
$k/$n secret |
{
87 echo "$param" >$rdir/new
/$keeper.param
91 ec_encrypt
$KEYS/keeper
/$keeper/$i.pub
-o
$rdir/new
/$keeper.
$i.share
98 ## If there's an existing instance of this key, transfer the recovery blobs.
99 if [ ! -d
$rdir/current
]; then
102 seq=$
(readlink
$rdir/current
)
103 mem
=$
(userv root claim-mem-dir
)
104 reveal
=$mem/keys.reveal.
$recov.current
/secret
105 if [ ! -f
$reveal ]; then
106 echo >&2 "$quis: current $recov key not revealed"
109 find $rdir/current
-type f
-name
'*.recov' -print |
while read name
; do
110 name
=${name#$rdir/current/}
111 case "$name" in */*) mkdir
-p
-m755
$rdir/new
/${name%/*} ;; esac
112 ec_decrypt
$reveal -i
$rdir/current
/$name |
113 ec_encrypt
$rdir/new
/pub
-o
$rdir/new
/$name
117 ## Tidy up and commit.
119 while [ -d
$seq ]; do seq=$
(( seq + 1 )); done
120 case $kparam in *.new
) mv keepers.new keepers
;; esac
126 ###----- That's all, folks --------------------------------------------------