<div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-size:small"><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 27, 2019 at 7:47 PM Paul F Fraser <<a href="mailto:paulf@a2zliving.com">paulf@a2zliving.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF">
<p>Hi,</p>
<p>Trying to work out for my project, how best to handle a master
password for relatives and others to access data after death,
including data about ongoing subscriptions etc..</p>
<p>Some thoughts</p>
<ol>
<li>Password in sealed envelope which would be obvious if
accessed.</li>
<li>Pin number in sealed envelope which could decrypt the
password.</li>
<li>Split password and have friends or relatives have parts.</li>
<li>Shamir secret sharing with friends or relatives.</li>
<li>etc..</li>
</ol>
<p>More to the point, is how would you (with a technical background)
like to access yout parents password for example?</p>
<p>How best would a non technical person, possibly very old, access
the passsword with minimum friction<br></p></div></blockquote><div><div class="gmail_default" style="font-size:small">So as it happens, I pushed out this draft last week. The code is not quite ready yet but it will be very soon. I just have to get the version that produced the draft to pass all the unit tests:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><a href="http://mathmesh.com/Documents/draft-hallambaker-mesh-udf.html">http://mathmesh.com/Documents/draft-hallambaker-mesh-udf.html</a></div><br></div><div><div class="gmail_default" style="font-size:small">UDF is simply a modern way to present and use PGP fingerprint-ish types of data.</div><br></div><div><div class="gmail_default" style="font-size:small">So a 128 bit key looks like this:</div><div class="gmail_default" style="font-size:small"><span style="background-color:rgb(249,249,249);font-family:"Roboto Mono",monospace;font-size:14px">Key: EA6Q-YPKA-WZH4-64VU-ADGN-4UGM-TSXQ</span></div><br></div><div><div class="gmail_default" style="font-size:small">The data format has a one byte type identifier followed by n bytes of data. In this case it is a 132 bit key. intended to be used as input to a KDF so the encryption can still be 256 bit.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">We can share the keys using Shamir secret sharing, for example, this is 3 shares with a quorum of 2:</div><div class="gmail_default" style="font-size:small"><pre id="gmail-s-1_1_1-8" style="background-color:rgb(249,249,249);font-family:"Roboto Mono",monospace;border:1px solid rgb(238,238,238);margin-top:0px;margin-bottom:0px;padding:1em;overflow-x:auto;font-size:14px">Share 0: SAQB-7EV5-OUJG-ZWXJ-BRRC-HMOB-TEZT-Q
Share 1: SAQQ-EGJ5-VFXI-TZS7-MTBX-VBJS-MXE4-C
Share 2: SARO-JH55-3XFK-N4OV-XUSN-CWFD-GJQH-2</pre></div><div class="gmail_default" style="font-size:small">OK, so far nothing you haven't seen before but this is actually documented and written up so its a bit more than a suggestion.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Now for the new part. We can create a UDF URI. So lets say our secret was: </div><div class="gmail_default" style="font-size:small"><span style="font-family:"Noto Sans",Arial,Helvetica,sans-serif;font-size:14px">ED3O-CIJB-M57X-LCGZ-RAIX-K4KK-2WIU-XE </span><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">We create a UDF URI with a domain name where we are going to store the document:</div><div class="gmail_default" style="font-size:small"><span style="font-family:"Noto Sans",Arial,Helvetica,sans-serif;font-size:14px">udf://<a href="http://example.com/ED3O-CIJB-M57X-LCGZ-RAIX-K4KK-2WIU-XE">example.com/ED3O-CIJB-M57X-LCGZ-RAIX-K4KK-2WIU-XE</a></span><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">We can turn that into a QR code.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">To resolve the URI, the app first takes the Content Digest fingerprint of the secret. We use twice the precision of the input.</div><div class="gmail_default" style="font-size:small"><pre id="gmail-s-1_2_2-20" style="background-color:rgb(249,249,249);font-family:"Roboto Mono",monospace;border:1px solid rgb(238,238,238);margin-top:0px;margin-bottom:0px;padding:1em;overflow-x:auto;font-size:14px">MAQJ-VVJB-TKX5-BNL6-7WPI-UEU4-QJVZ-GV2C-XUOJ-5QHC-YGBS-BKE7-76U3-RHNU</pre></div><div class="gmail_default" style="font-size:small">Now we do Web Service Discovery to find the Web Service Endpoint and splice the fingerprint on the end.:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><span style="font-family:"Noto Sans",Arial,Helvetica,sans-serif;font-size:14px"><a href="https://example.com/.well-known/mmm-udf/MAQJ-VVJB-TKX5-BNL6-7WPI-UEU4-QJVZ-GV2C-XUOJ-5QHC-YGBS-BKE7-76U3-RHNU">https://example.com/.well-known/mmm-udf/MAQJ-VVJB-TKX5-BNL6-7WPI-UEU4-QJVZ-GV2C-XUOJ-5QHC-YGBS-BKE7-76U3-RHNU</a> </span><br></div><br></div><div><div class="gmail_default" style="font-size:small">So now we have a mechanism for going from a QR Code to locate an encrypted copy of your document in the cloud and decrypting it without putting the encryption key at risk.</div><br></div><div><br></div><div class="gmail_default" style="font-size:small">I am pretty sure that we could use this mechanism to make payment of invoices easier. Existing electronic means based on email are insecure and account based schemes only solve the problem for the biller, not the customer.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">It could probably be used to achieve HIPPA compliance. The key thing is that the documents in the cloud are encrypted but the keys are never in the cloud.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">This is one of my bootstraps for the Mathematical Mesh. Instead of insisting on going all electronic cold, provide people with the on-ramp. The process of resolving the linked document could be used to trigger a binding of credentials that allow us to make use of Mesh Secure Transactions (different name for secure email not based on SMTP, not trying to replace regular email, just eliminate the clutter that makes securing email so hard).</div></div></div></div>