chiark / gitweb /
keyfunc.sh.in: Fix the OpenSSL `dgst' rune.
[distorted-keys] / keys.reveal
CommitLineData
53263601
MW
1#! /bin/sh
2###
3### Reveal shares of a secret distributed among keepers
4###
5### (c) 2011 Mark Wooding
6###
7
8###----- Licensing notice ---------------------------------------------------
9###
599c8f75
MW
10### This file is part of the distorted.org.uk key management suite.
11###
12### distorted-keys is free software; you can redistribute it and/or modify
53263601
MW
13### it under the terms of the GNU General Public License as published by
14### the Free Software Foundation; either version 2 of the License, or
15### (at your option) any later version.
16###
599c8f75 17### distorted-keys is distributed in the hope that it will be useful,
53263601
MW
18### but WITHOUT ANY WARRANTY; without even the implied warranty of
19### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20### GNU General Public License for more details.
21###
22### You should have received a copy of the GNU General Public License
599c8f75 23### along with distorted-keys; if not, write to the Free Software Foundation,
53263601
MW
24### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25
26set -e
27case "${KEYSLIB+t}" in t) ;; *) echo >&2 "$0: KEYSLIB unset"; exit 1 ;; esac
28. "$KEYSLIB"/keyfunc.sh
29
30defhelp <<HELP
d516ebd0 31RECOV KEEPER
53263601
MW
32Reveal a share of a recovery key distributed among keepers.
33
34If enough shares have been revealed, reconstruct the recovery private key.
d516ebd0 35The keeper nub is read from stdin.
53263601 36HELP
53263601
MW
37
38## Parse the command line.
d516ebd0 39case $# in 2) ;; *) usage_err ;; esac
53263601 40recov=$1 keeper=$2; shift 2
599c8f75 41checklabel "recovery key" "$recov"
53263601 42case "$recov" in
599c8f75
MW
43 */*) ;;
44 *) recov=$recov/current ;;
53263601
MW
45esac
46checkword "keeper set label" "$keeper"
47
c47f2aba
MW
48## Check that this is a sensible thing to do.
49if [ ! -f $KEYS/keeper/$keeper/meta ]; then
50 echo >&2 "$quis: unknown keeper set \`$keeper'"
51 exit 1
52fi
53if [ ! -d $KEYS/recov/$recov ]; then
54 echo >&2 "$quis: unknown recovery key \`$recov'"
55 exit 1
56fi
57if [ ! -f $KEYS/recov/$recov/$keeper.param ]; then
58 echo >&2 "$quis: recovery key \`$recov' not kept by keeper set \`$keeper'"
59 exit 1
60fi
61
53263601 62## Grab the key, because we'll need to read it several times.
c47f2aba 63mktmp
d516ebd0 64cat >$tmp/secret
53263601
MW
65
66## Read the threshold from the recovery metadata.
2661d8aa 67t=$(sharethresh $KEYS/recov/$recov/$keeper.param)
53263601
MW
68
69## Find out which keeper index it corresponds to.
70read n hunoz <$KEYS/keeper/$keeper/meta
71i=0
72foundp=nil
73while [ $i -lt $n ]; do
c47f2aba
MW
74 c_sysprepare $KEYS/keeper/$keeper/$i
75 nubbin=$(nubid <$tmp/secret)
76 nubid=$(cat $KEYS/keeper/$keeper/$i/nubid)
77 case "$nubbin" in "$nubid") foundp=t; break ;; esac
78 i=$(( $i + 1 ))
53263601
MW
79done
80case $foundp in
c47f2aba 81 nil) echo >&2 "$quis: nub doesn't match keeper \`$keeper'"; exit 1 ;;
53263601
MW
82esac
83
84## Establish the recovery staging area. See whether we've done enough
85## already.
c47f2aba 86reqsafe
53263601 87tag=$(echo $recov | tr / .)
c47f2aba
MW
88mkdir -p -m700 $SAFE/keys.reveal
89reveal=$SAFE/keys.reveal/$tag
599c8f75
MW
90if [ ! -d $reveal ]; then mkdir -m700 $reveal; fi
91cd $reveal
c47f2aba
MW
92if [ -f nub ]; then
93 echo >&2 "$quis: recovery key \`$recov' already revealed"
53263601
MW
94 exit 1
95fi
96
97## Decrypt the share.
599c8f75 98umask 077
c47f2aba
MW
99if [ -f $keeper.$i.share ]; then
100 echo >&2 "$quis: share $i already revealed"
101else
102 c_sysdecrypt $KEYS/keeper/$keeper/$i $tmp/secret \
103 <$KEYS/recov/$recov/$keeper.$i.share \
104 >$keeper.$i.new
105 mv $keeper.$i.new $keeper.$i.share
106fi
53263601
MW
107
108## See if there's enough for a recovery.
109n=0
c47f2aba 110for j in $keeper.*.share; do if [ -f "$j" ]; then n=$(( $n + 1 )); fi; done
53263601 111if [ $n -lt $t ]; then
c47f2aba 112 echo >&2 "$quis: share $i revealed; $(( $t - $n )) more required"
53263601 113else
c47f2aba 114 cat $KEYS/recov/$recov/$keeper.param $keeper.*.share >$keeper.shares
5c30c6e6 115 $bindir/shamir recover <$keeper.shares >nub.new
c47f2aba
MW
116 c_sysprepare $KEYS/recov/$recov/store
117 nubbin=$(nubid <nub.new)
118 nubid=$(cat $KEYS/recov/$recov/store/nubid)
119 case "$nubbin" in
120 "$nubid") ;;
53263601 121 *)
c47f2aba 122 echo >&2 "$quis: recovered nub doesn't match stored hash"
53263601
MW
123 exit 1
124 ;;
125 esac
c47f2aba
MW
126 mv nub.new nub
127 rm -f $keeper.*
128 echo >&2 "$quis: recovery key \`$recov' revealed"
53263601
MW
129fi
130
131###----- That's all, folks --------------------------------------------------