11

A friend just showed me how to combine padlocks to achieve a lock that opens when k out of n people turn their keys.

I was wondering if there was something similar for encryption; using n or fewer public keys encrypt a piece of data so it can only be unlocked if at least k out of n specific private keys are applied.

I've tried ideas of stacking normal public key encryption, but without luck. I'm sure somebody must have done research on the topic, but I have no idea what such a thing is called. Maybe it's even widely accessible through standard encryption libraries?

otus
  • 32,132
  • 5
  • 70
  • 165
Thomas Ahle
  • 211
  • 1
  • 5
  • 1
    Out of curiosity, can you describe or link to the padlock trick you reference? (referring to physical padlocks, right?) – Don Faulkner Jun 05 '12 at 18:44
  • 1
    Sure, I believe the idea is from knut theory. Say you have one wire to which the 'gold' is fastened and two padlocks. You want that if either of the locks are opened, the 'gold' wire is completely freed. You do this by letting the golden wire go first clockwise around the first, then clockwise around the second, then anticlockwise around the first and finally anticlockwise around the second. It can be thought of as aba^-1b^-1. If you remove either, the other cancels out. It generalizes to any k out of n padlocks. – Thomas Ahle Jun 05 '12 at 22:44

2 Answers2

11

Yes, it's called secret sharing.

-3

I don't know of anything that does that.

I guess you could use a data scheme with high redundancy and reconstruction attributes, like a CRC type algorithmn, with properties where if you have like 2/3rd of the bytes, it can reconstruct the entire input. Encode the 1st, 4th, 7th byte, etc, with one key, the 2nd, 5th, etc with the second, and 3rd, 6th, etc with the third.

Overall though, I don't think computer encryption really works like that - it's fundamentally different from a padlock, which is an access control scheme, not data hiding.

  • 1
    The redundancy approach is actually exactly what is used by the suggested approaches.They avoid revealing any actual bytes, but if the message has entropy H in an K/N scheme, each person does get HK/N bits. – Thomas Ahle Sep 03 '14 at 09:47