You can secure your secrets by splitting them with an algorithm into any number of shares.
You set the threshold of what number of shares it takes to reconstruct the original secret.
Any extra shares can be lost and you will not loose your original secret.
For larger files
The limit of a secret is 128 characters.
Skip this part if you are only securing the passphrase of one wallet, or your secret is less than 128 characters.
If you want to encrypt more than that, you could put it in a text file and then symmetrically encrypt that with a password of up to 128 characters, and split that password into a number of shares.
GnuPG is an appropriate tool to do this.
If you want to print out the encrypted messages, you should use the ASCII armor feature of GPG, else it will be an unprintable binary file.
- Write your text file.
vi secrets.txt
- Encrypt your text file.
gpg -c -a secrets.txt
-c is for symmetric encryption. (with a password)
-a is for ASCII armor. (so you can print it)
This will ask for a password twice.
You will be left with secrets.txt and secrets.txt.asc.
- Remember this password for the next part.
- Delete your text file.
rm secrets.txt
Now, only the encrypted text file remains.
Split your secret
This will use Shamir’s Secret Sharing Scheme.
In this example, I will make 5 shares, while only needing 3 shares to reconstruct the secret.
ssss-split -t 3 -n 5 -w "passpass"
-t sets threshold of necessary shares
-n is the number of total shares
-w is the prefix that is on the resultant output lines
- This opens a prompt like:
Generating shares using a (3,5) scheme with dynamic security level. Enter the secret, at most 128 ASCII characters:
- Enter the password that you used to make
secrets.txt.asc, or your shorter wallet passphrase. - It outputs the shares on screen. You have to copy and save the output lines, or print them.
- Output looks like:
passpass-1-cb0f23f1dd3fe4cd659d7f572096737f2d3a4ef35727eb43d702f9033ce862bc67222e52dd793552a2733c8c0f0cfaa7948a2b8ea1025e95ffa47d496aa0010824221a061818b8081baa78 passpass-2-bf895fe8b18fb3d2b601fcd954a1d83578e15a6ebde93394ee48179b60c374a44371ee7c517289e141bae5ea0ae015516aee33bc619e4b7b967657e6c2d2a0211878d1f6697e5e3b75e78b passpass-3-a7d741ad00e0e87a72738b6e030e421947db3f6d4f207eb2ec84ef3e6aa483841cdae70fccf0ee5a4a96b98c81f10eb5c368ef9cf76d18c8b247e652c985f1309d15bd2cff686d5002ad16 passpass-4-7b7082532be84991f21a8dcc03159f67959426ab63b5b3735abdb001901a6a0fddc3db73c9dcb50382609dddfa99060b81748ec77508057056511b04f191f8061c95c2f66d9defe880a516 passpass-5-632e9c169a8712393668fa7b54ba054baaae43a8917cfe55587148a49a7d9d2f8268d200545ed2b8894cc1bb71881def28f252e7e3fb56c37260aab0fac6a91799f8ae2cfb8bdc83f7ef99
Combine Your Secret
When you are ready to combine the secret and read it, you run the following command:
ssss-combine -t 3
You will see the following prompt:
Enter 3 shares separated by newlines: Share [1/3]:
Enter any three shares in any order and it will output your secret like so:
Resulting secret: <Your Secret>
Physical Format
Do not keep the encrypted message with the share. The share is only protected by the split. If you have the minimum threshold of shares, you have the secret.
Only one share should be in any location/format at a time.
It would look like so:
passpass-5-632e9c169a8712393668fa7b54ba054baaae43a8917cfe55587148a49a7d9d2f8268d200545ed2b8894cc1bb71881def28f252e7e3fb56c37260aab0fac6a91799f8ae2cfb8bdc83f7ef99
The ASCII armored print-out will easily fit on a printed page. Here is what this document looks like in as a GPG encrypted, ASCII armored text file:
-----BEGIN PGP MESSAGE-----
jA0ECQMC6xU1xh4khwb/0uoBWl8DRUokhR6yag6WMA6rBCvHTOI5wQ2RWxPqcCsn HXIF9lP9zTvUS65sJ1DYrJYfegLsc8fBEgX2PtdCh1o+uCcjIiH/PzUlAkhCXlAq NxlSjATwLjagm6m/uVw8Zj/9pO7P2fYwNdfJ1ig1IfvJ58lml23XOmwBhKbiuh+x FabZvz2eOIndHIQGAXMoVL6rSFLvy+G1uZ5eQljL17mmGOJPhvcjwxOqt3Dyf2HL KDCujrc6SfH/NJ2NBGIbFTksEILKIjKUH9+4h79MVCHAI31vP0YRbbx7hBA/IfDd kiLC+QCtpiLPRRISLWZZGSkfmt+0xfEzWFvkdxDSfEavUtPJMYWJMjUCmTZQewWQ +EHROMYF+TiP0BjKe6XtyHVP5srOsDWzkOd06G15EdXRoxCH85ptmrlAZRaSI8km wQ2ZFwndNhBEV5YE1IzK8s5ARbFB5S++0JQAkWsbof/i1eVp+CZiR5J0NPqPm49H qmV+3UGM6gzHLUS/evPt44omjmo+iCf4g7mmsuiekFescJhWeB+e0NmbFsLcXfw2 gV4HN56t2I+nFSjZ9NGXy0SshrDec9AgXw1rgtW3NpZyBV0yyGPPjFzlYXZF8fqY rq1MD5n6GPYySOdsVmcs184SUUn40LyMz6QPu6J2SdVWpXqTTqxQ63J0W4ac98CN YQ5a209J6lHrvoE3O1WVSXxG3Br0mMmFOTupYwa9Fid0EBGNAp8qyP6fj+3cSh82 cJQn+7H41rhB2E5+f5GGG9s3OUM1XUq1hwOiKbTfNHpS2P78PZY6OfCebeSD2oIm Yb9M05U4BR0siMqADYG/WxUfL0QJDgozLKrKdzhWTLKwbg693xGkh+fv5M8XAp1H jyuw616/yu8VCijmlGZ8vrpn+P0Wz3ogJB2531MLs4z6dR7uxlMaMq3iyWUpYYpw gXa0MnSKZIGegAJ6lKjqQZdFOUP1RnaJlcHmh96GzBHY14rv7YN9a8m3LH/KSXH1 kNgys+gk1NqTiSWVWEWvNOOxaC54o5MKdAkqY3RjfO0Z19fv6TbtbaGsnl6IEbGW xKZQ1Ib/G2yduaQliHDNQj8xgn9HNlG69920OdILJFxMtB8Nl9C0pqVz9w/4Ph70 Q2lKm8bu+qxrsZBHJjAoilglg+yRLVyvJtz9SzF2F/K0DE7wO3LavyXtnD87ZcZy 7ULK2ScDRQQ9LCgbBGYkWRLK6IEsIo2GJQ/fdTr8IpxZmU0cyi1mgBPzq8Ie/6Uh nxA9uLLbQD7jaW1jq3vchIakV/7IT0rn+AZt/NE0lAi6XoN65LGtzbmuSzB50J5c SLttMIBUK81gL+rDrMgurMe7VsejJd/kZLTmQtE5J4Rp6V8P2uIX1IOc/L4H2kfI kUodOt9ktdVKD0u2hPqc826p/mcCvtChgmTxJLtMpqhUeVXRYcj7pcMVWH/rM8uX utYecLdrrAN06L/FV/UZfP2SMD5sz8ebc6gYKyCNRXMSBYVfIuLmTo5/ptfxxPfJ xhdwrZ4Rvw7i7PTmD6fAptskJ7EQ44EBmb3oWS8nwiS8c5kxwkDlM0SB5jginYqd tXvc+6DqnJp59He2YWYxfCy3u9j+jhuQsqNY87cwAP2S0Zs+bElWUFXE6TRlvnnW Sq83IzU1DuPAdW69blUFCkEsecvbHcUak+nmaI7ByS4kflTdJXVPbISbTfct9mx3 kLwSEsWWwqeLr/h9/enbgrRlCnTtbp3/SYBoXoWbKES2ut6H9hU/OjSYecuRDqgB BwHkNh8nd/uBUe8DP+Xnpm2ykgIGa0bKleicjBPEKUmlkDtSC8HNxXwOzsU5eiRb tmO/DlPOoGGzFn+zsKakl9VqrbOYSgzOMageTPCGUWSHodj1bLWxs3uqmFC1sW1G wLSgELA6H5Lb/TpRdKQP+TpTxbvi1dxs4b2UVZY/J2whgeVan8chgUMGRwFbR84u gzHgp4w8fguqqpnMwmQkkouxioeAt4vkPluqhN/MuH2Plotin8NUFX+3g82pK6/M wBOWVKPwK7JVl3lnatds+Ag5kGJgjDj7+GSLuKZatis9lROyIcgASfLOuK/Ayc6/ rADCXTo1f4gq4O067NhlzcfHrQUAPpL4/s8gvjOAFyCags6uDOOVGPE5TvCPYyov fkxgJz4GLnhqPPsS+X9DK3eMGfPh9YQVgwk1pqTU5pFWF233AnzgxvnMgX44OMRy XzD0ZWdNjdGoXw4IGvYKCwKCvg== =9VGA -----END PGP MESSAGE-----
The prefix (in this case passpass) will help to sort your shares. For the example of several wallet passphrases, you could just have several sets of shares with different prefixes and keep a share from each set in each location. A print-out of shares for 3 secrets could look like:
lima-5-632e9c169a8712393668fa7b54ba054baaae43a8917cfe55587148a49a7d9d2f8268d200545ed2b8894cc1bb71881def28f252e7e3fb56c37260aab0fac6a91799f8ae2cfb8bdc83f7ef99 echo-2-bf895fe8b18fb3d2b601fcd954a1d83578e15a6ebde93394ee48179b60c374a44371ee7c517289e141bae5ea0ae015516aee33bc619e4b7b967657e6c2d2a0211878d1f6697e5e3b75e78b bravo-4-7b7082532be84991f21a8dcc03159f67959426ab63b5b3735abdb001901a6a0fddc3db73c9dcb50382609dddfa99060b81748ec77508057056511b04f191f8061c95c2f66d9defe880a516
My Resiliency Considerations
- I would keep some as physical print-outs, some as files on devices, some as physical off-site, and some as files on line.
- The minimum threshold should be met if no physical, or no off-site, or no online, or no digital can be reached.
- Threshold should not be met with only one type (all online, or all physical in one location).
- The secret should not be lost in the event of house fire, network outage, or EMP.
- The secret should not be compromised in the event of account hack, device theft, or burglary.
- No powerful, resourceful organization should be able to find a minimum threshold of shares. (Don’t hide all shares on your own properties.)
Additional Security Considerations
- Use GPG to secure your email communications with asymmetrical encryption.
- Proton mail does this by default.
- Use GPG to encrypt any files you may keep in the public cloud, but don’t want publicly readable such as backups, notes, financial or legal documents, etc.
- Use disk encryption on all of your computers and devices so a device loss is not a privacy loss.