Date: Thu, 30 Aug 2007 16:37:21 GMT From: Lukasz Komsta <luke@novum.am.lublin.pl> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/115949: new port security/ssss - Shamir's Secret Sharing Scheme Message-ID: <200708301637.l7UGbLID042873@www.freebsd.org> Resent-Message-ID: <200708301640.l7UGe2gC052829@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 115949 >Category: ports >Synopsis: new port security/ssss - Shamir's Secret Sharing Scheme >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Thu Aug 30 16:40:02 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Lukasz Komsta >Release: 6.2 >Organization: Skubiszewski Medical University, Lublin, Poland >Environment: >Description: ssss is an implementation of Shamir's secret sharing scheme for UNIX/linux machines. It is free software, the code is licensed under the GNU GPL. ssss does both: the generation of shares for a known secret and the reconstruction of a secret using user provided shares. The software was written in 2006 by B. Poettering, it links against the GNU libgmp multiprecision library (version 4.1.4 works well) and requires the /dev/random entropy source. >How-To-Repeat: >Fix: # This is a shell archive. Save it in a file, remove anything before # this line, and then unpack it by entering "sh file". Note, it may # create directories; files and directories will be owned by you and # have default permissions. # # This archive contains: # # /usr/ports/security/ssss/ # /usr/ports/security/ssss/Makefile # /usr/ports/security/ssss/distinfo # /usr/ports/security/ssss/pkg-descr # /usr/ports/security/ssss/pkg-plist # /usr/ports/security/ssss/files # /usr/ports/security/ssss/files/patch-Makefile # /usr/ports/security/ssss/files/patch-manpage # echo c - /usr/ports/security/ssss/ mkdir -p /usr/ports/security/ssss/ > /dev/null 2>&1 echo x - /usr/ports/security/ssss/Makefile sed 's/^X//' >/usr/ports/security/ssss/Makefile << 'END-of-/usr/ports/security/ssss/Makefile' X# New ports collection makefile for: seccure X# Date created: 30 August 2007 X# Whom: Lukasz Komsta X# X# $FreeBSD$ X# X XPORTNAME= ssss XPORTVERSION= 0.5 XCATEGORIES= security XMASTER_SITES= http://point-at-infinity.org/ssss/ X XBUILD_DEPENDS= ${LOCALBASE}/include/gmp.h:${PORTSDIR}/math/libgmp4 XLIB_DEPENDS= gmp.7:${PORTSDIR}/math/libgmp4 X XMAINTAINER= luke@REMOVE_IT.novum.am.lublin.pl XCOMMENT= Shamir's Secret Sharing Scheme X XMAN1= ssss.1 X X.include <bsd.port.mk> END-of-/usr/ports/security/ssss/Makefile echo x - /usr/ports/security/ssss/distinfo sed 's/^X//' >/usr/ports/security/ssss/distinfo << 'END-of-/usr/ports/security/ssss/distinfo' XMD5 (ssss-0.5.tar.gz) = 24227252aa195a146d09de1df10357a1 XSHA256 (ssss-0.5.tar.gz) = 5d165555105606b8b08383e697fc48cf849f51d775f1d9a74817f5709db0f995 XSIZE (ssss-0.5.tar.gz) = 17435 END-of-/usr/ports/security/ssss/distinfo echo x - /usr/ports/security/ssss/pkg-descr sed 's/^X//' >/usr/ports/security/ssss/pkg-descr << 'END-of-/usr/ports/security/ssss/pkg-descr' Xssss is an implementation of Shamir's secret sharing scheme for UNIX/linux machines. It is free software, the code is licensed under the GNU GPL. ssss does both: the generation of shares for a known secret and the reconstruction of a secret using user provided shares. The software was written in 2006 by B. Poettering, it links against the GNU libgmp multiprecision library (version 4.1.4 works well) and requires the /dev/random entropy source. X XWWW: http://point-at-infinity.org/ssss/ XAuthor: B. Poettering END-of-/usr/ports/security/ssss/pkg-descr echo x - /usr/ports/security/ssss/pkg-plist sed 's/^X//' >/usr/ports/security/ssss/pkg-plist << 'END-of-/usr/ports/security/ssss/pkg-plist' Xbin/ssss-combine Xbin/ssss-split END-of-/usr/ports/security/ssss/pkg-plist echo c - /usr/ports/security/ssss/files mkdir -p /usr/ports/security/ssss/files > /dev/null 2>&1 echo x - /usr/ports/security/ssss/files/patch-Makefile sed 's/^X//' >/usr/ports/security/ssss/files/patch-Makefile << 'END-of-/usr/ports/security/ssss/files/patch-Makefile' X--- Makefile.orig Thu Aug 30 17:28:27 2007 X+++ Makefile Thu Aug 30 18:06:38 2007 X@@ -1,17 +1,19 @@ X-all: ssss-split ssss-combine ssss.1 ssss.1.html X+DESTDIR=/usr/local X+ X+all: ssss-split ssss-combine X X ssss-split: ssss.c X- $(CC) -W -Wall -O2 -lgmp -o ssss-split ssss.c X+ $(CC) -W -Wall -O2 -I/usr/local/include -L/usr/local/lib -lgmp -o ssss-split ssss.c X strip ssss-split X+ mv ssss.manpage.xml ssss.1 X X ssss-combine: ssss-split X ln -f ssss-split ssss-combine X X-ssss.1: ssss.manpage.xml X- xmltoman ssss.manpage.xml > ssss.1 X- X-ssss.1.html: ssss.manpage.xml X- xmlmantohtml ssss.manpage.xml > ssss.1.html X- X clean: X- rm -rf ssss-split ssss-combine ssss.1 ssss.1.html X+ rm -rf ssss-split ssss-combine ssss.1 X+ X+install: all X+ install -m0755 ssss-split $(DESTDIR)/bin X+ install -m0755 ssss-combine $(DESTDIR)/bin X+ install -m0644 ssss.1 $(DESTDIR)/man/man1 END-of-/usr/ports/security/ssss/files/patch-Makefile echo x - /usr/ports/security/ssss/files/patch-manpage sed 's/^X//' >/usr/ports/security/ssss/files/patch-manpage << 'END-of-/usr/ports/security/ssss/files/patch-manpage' X--- ssss.manpage.xml.orig Sun Jan 15 12:10:01 2006 X+++ ssss.manpage.xml Sat Mar 10 23:58:04 2007 X@@ -1,162 +1,62 @@ X-<?xml version="1.0" standalone='no'?> X-<!DOCTYPE manpage SYSTEM "http://masqmail.cx/xmltoman/xmltoman.dtd">; X- X-<?xml-stylesheet type="text/xsl" X-href="http://masqmail.cx/xmltoman/xmltoman.xsl" ?> X- X-<manpage name="ssss" section="1" X- desc="Split and Combine Secrets using Shamir's Secret Sharing Scheme."> X- X-<synopsis> X- <cmd>ssss-split -t <arg>threshold</arg> -n <arg>shares</arg> [-w <arg>token</arg>] X- [-s <arg>level</arg>] [-x] [-q] [-Q] [-D] [-v]</cmd> X- <cmd>ssss-combine -t <arg>threshold</arg> [-x] [-q] [-Q] [-D] [-v]</cmd> X-</synopsis> X- X-<description> X-<p>ssss is an implementation of Shamir's Secret Sharing Scheme. The X-program suite does both: the generation of shares for a known secret, X-and the reconstruction of a secret using user-provided shares.</p> X-</description> X- X-<section name ="Commands"> X- <p><opt>ssss-split</opt>: prompt the user for a secret and generate a set of X- corresponding shares.</p> X- X- <p><opt>ssss-combine</opt>: read in a set of shares and reconstruct X- the secret.</p> X-</section> X- X-<options> X- X- <option> X-<p><opt>-t <arg>threshold</arg></opt></p> <optdesc> X-<p>Specify the number of X- shares necessary to reconstruct the secret.</p></optdesc> X- X-</option> X- X- <option> X-<p><opt>-n <arg>shares</arg></opt></p> X-<optdesc> X- <p>Specify the number of shares to be generated.</p> X-</optdesc> X-</option> X- X- <option><p><opt>-w <arg>token</arg></opt></p> X-<optdesc> X- <p>Text token to name shares in order to avoid confusion in case one X- utilizes secret sharing to protect several independent secrets. The X- generated shares are prefixed by these tokens.</p> X-</optdesc> X-</option> X- X- <option><p><opt>-s <arg>level</arg></opt></p> X-<optdesc> X- <p>Enforce the scheme's security level (in bits). This option X- implies an upper bound for the length of the shared secret X- (shorter secrets are padded). Only multiples of 8 in the range X- from 8 to 1024 are allowed. If this option is ommitted (or the X- value given is 0) the security level is chosen automatically X- depending on the secret's length. The security level directly X- determines the length of the shares.</p> X-</optdesc> X-</option> X- X- <option><p><opt>-x</opt></p> X-<optdesc> X- <p>Hex mode: use hexadecimal digits in place of ASCII characters for X- I/O. This is useful if one wants to protect binary data, like X- block cipher keys.</p> X-</optdesc> X-</option> X- X- <option><p><opt>-q</opt></p> X-<optdesc> X- <p>Quiet mode: disable all unnecessary output. Useful in scripts. X- </p> X-</optdesc> X-</option> X- <option><p><opt>-Q</opt></p> X-<optdesc> X- <p>Extra quiet mode: like <opt>-q</opt>, but also suppress X-warnings.</p> X-</optdesc> X-</option> X- X- <option><p><opt>-D</opt></p> X-<optdesc> X- <p>Disable the diffusion layer added in version 0.2. This option X- is needed when shares are combined that where generated with X- ssss version 0.1.</p> X-</optdesc> X-</option> X- X- <option><p><opt>-v</opt></p> X-<optdesc> X- <p>Print version information.</p> X-</optdesc> X-</option> X-</options> X- X-<section name="Example"> X-<p> X- In case you want to protect your login password with a set of ten X- shares in such a way that any three of them can reconstruct the X- password, you simply run the command X-</p> X- X-<p> X- ssss-split -t 3 -n 10 -w passwd X-</p> X- X-<p> X- To reconstruct the password pass three of the generated shares X- (in any order) to X-</p> X- X-<p> X- ssss-combine -t 3 X-</p> X- X-</section> X-<section name="Notes"> X-<p> X-To protect a secret larger than 1024 bits a hybrid technique has to be X-applied: encrypt the secret with a block cipher and apply secret X-sharing to just the key. Among others openssl and gpg can do the X-encryption part: X-</p> X-<p> X-openssl bf -e < file.plain > file.encrypted X-</p> X-<p> X-gpg -c < file.plain > file.encrypted X-</p> X- X-</section> X- X-<section name="Security"> X-<p> X-<opt>ssss</opt> tries to lock its virtual address space into RAM for X-privacy reasons. But this may fail for two reasons: either the current uid X-doesn't permit page locking, or the RLIMIT_MEMLOCK is set too X-low. After printing a warning message <opt>ssss</opt> will run even without X-obtaining the desired mlock. X-</p> X- X-</section> X- X-<section name="Author"> X- This software (v0.5) was written in 2006 by B. Poettering X- (ssss AT point-at-infinity.org). Find the newest version of X- ssss on the project's homepage: <url X- href="http://point-at-infinity.org/ssss/"/>. X-</section> X- X-<section name="Further reading"> X- <url href="http://en.wikipedia.org/wiki/Secret_sharing"/>; X-</section> X- X- X-</manpage> X+.TH ssss 1 User Manuals X+.SH NAME X+ssss \- Split and Combine Secrets using Shamir's Secret Sharing Scheme. X+.SH SYNOPSIS X+\fBssss-split -t \fIthreshold\fB -n \fIshares\fB [-w \fItoken\fB] [-s \fIlevel\fB] [-x] [-q] [-Q] [-D] [-v] X+ X+ssss-combine -t \fIthreshold\fB [-x] [-q] [-Q] [-D] [-v] X+\f1 X+.SH DESCRIPTION X+ssss is an implementation of Shamir's Secret Sharing Scheme. The program suite does both: the generation of shares for a known secret, and the reconstruction of a secret using user-provided shares. X+.SH COMMANDS X+\fBssss-split\f1: prompt the user for a secret and generate a set of corresponding shares. X+ X+\fBssss-combine\f1: read in a set of shares and reconstruct the secret. X+.SH OPTIONS X+.TP X+\fB-t \fIthreshold\fB\f1 X+Specify the number of shares necessary to reconstruct the secret. X+.TP X+\fB-n \fIshares\fB\f1 X+Specify the number of shares to be generated. X+.TP X+\fB-w \fItoken\fB\f1 X+Text token to name shares in order to avoid confusion in case one utilizes secret sharing to protect several independent secrets. The generated shares are prefixed by these tokens. X+.TP X+\fB-s \fIlevel\fB\f1 X+Enforce the scheme's security level (in bits). This option implies an upper bound for the length of the shared secret (shorter secrets are padded). Only multiples of 8 in the range from 8 to 1024 are allowed. If this option is ommitted (or the value given is 0) the security level is chosen automatically depending on the secret's length. The security level directly determines the length of the shares. X+.TP X+\fB-x\f1 X+Hex mode: use hexadecimal digits in place of ASCII characters for I/O. This is useful if one wants to protect binary data, like block cipher keys. X+.TP X+\fB-q\f1 X+Quiet mode: disable all unnecessary output. Useful in scripts. X+.TP X+\fB-Q\f1 X+Extra quiet mode: like \fB-q\f1, but also suppress warnings. X+.TP X+\fB-D\f1 X+Disable the diffusion layer added in version 0.2. This option is needed when shares are combined that where generated with ssss version 0.1. X+.TP X+\fB-v\f1 X+Print version information. X+.SH EXAMPLE X+In case you want to protect your login password with a set of ten shares in such a way that any three of them can reconstruct the password, you simply run the command X+ X+ssss-split -t 3 -n 10 -w passwd X+ X+To reconstruct the password pass three of the generated shares (in any order) to X+ X+ssss-combine -t 3 X+.SH NOTES X+To protect a secret larger than 1024 bits a hybrid technique has to be applied: encrypt the secret with a block cipher and apply secret sharing to just the key. Among others openssl and gpg can do the encryption part: X+ X+openssl bf -e < file.plain > file.encrypted X+ X+gpg -c < file.plain > file.encrypted X+.SH SECURITY X+\fBssss\f1 tries to lock its virtual address space into RAM for privacy reasons. But this may fail for two reasons: either the current uid doesn't permit page locking, or the RLIMIT_MEMLOCK is set too low. After printing a warning message \fBssss\f1 will run even without obtaining the desired mlock. X+.SH AUTHOR X+This software (v0.5) was written in 2006 by B. Poettering (ssss AT point-at-infinity.org). Find the newest version of ssss on the project's homepage: \fBhttp://point-at-infinity.org/ssss/\f1. X+.SH FURTHER READING X+\fBhttp://en.wikipedia.org/wiki/Secret_sharing\f1 END-of-/usr/ports/security/ssss/files/patch-manpage exit >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200708301637.l7UGbLID042873>