Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 317

Example: AutoSED Key Sharing, Network Working Group Internet Draft draft-mcgrew-tss-03

Get Dell EqualLogic PS6210XS PDF manuals and user guides View all Dell EqualLogic PS6210XS manuals
Add to My Manuals
Save this manual to your list of manuals

Page 317 highlights

When AutoSED generates a backup set, this set consists of three shares with a threshold of two, which adds security and reliability to a sensitive process. To destroy a set of shares, you could erase every share. However, if you erase only two shares from a backup set, the remaining share cannot recover the key and is useless. Example: AutoSED Key Sharing Consider an enclosure with 22 active drives and 2 spares: 1. When the array is first set up, AutoSED generates shares for all the active drives, which are in Set A. Because spares are excluded, Set A has 22 shares with a threshold of 11 (11-of-22). The array then generates and displays a backup, Set B, which is 2-of-3. 2. Remove a drive. Immediately, AutoSED destroys Set A, which means erasing the rest of Set A (the remaining 21 shares). AutoSED generates a new Set C containing the 21 active drives and having a threshold of 11-of-21. If another drive is removed, then AutoSED destroys Set C, and replaces it with Set D and a threshold of 10-of-20. 3. If both drives are removed by the same adversary, it now possesses one share from Set A and one share from Set C. However, each of those shares is useless by itself and also cannot be combined with each other. The adversary must simultaneously remove at least 11 drives to obtain enough shares from the same set. Set B has remained usable. However, the same process applies: 1. Suppose one of the shares from Set B is compromised. Immediately, the administrator should destroy Set B, which means erasing the rest of Set B (the remaining 2 shares). 2. Then, the administrator should generate a new backup set, resulting in Set E. If a share from Set E is compromised, destroy Set E by erasing the remaining 2 shares, and generate Set F. The stolen share from Set B and the stolen share from Set E are useless individually and also cannot be combined. Also, they cannot be combined with the shares stolen from Set A and Set C. Further reading: Shamir, Adi, How to Share a Secret, Communications of the ACM, 22(11):612-613, 1979 McGrew, David, Threshold Secret Sharing, Network Working Group Internet Draft (draft-mcgrew-tss-03) Trusted Computing Group, Enterprise SSC v1.0 Specification About Self-Encrypting Drives (SEDs) and AutoSED 317

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
  • 241
  • 242
  • 243
  • 244
  • 245
  • 246
  • 247
  • 248
  • 249
  • 250
  • 251
  • 252
  • 253
  • 254
  • 255
  • 256
  • 257
  • 258
  • 259
  • 260
  • 261
  • 262
  • 263
  • 264
  • 265
  • 266
  • 267
  • 268
  • 269
  • 270
  • 271
  • 272
  • 273
  • 274
  • 275
  • 276
  • 277
  • 278
  • 279
  • 280
  • 281
  • 282
  • 283
  • 284
  • 285
  • 286
  • 287
  • 288
  • 289
  • 290
  • 291
  • 292
  • 293
  • 294
  • 295
  • 296
  • 297
  • 298
  • 299
  • 300
  • 301
  • 302
  • 303
  • 304
  • 305
  • 306
  • 307
  • 308
  • 309
  • 310
  • 311
  • 312
  • 313
  • 314
  • 315
  • 316
  • 317
  • 318
  • 319
  • 320
  • 321
  • 322
  • 323
  • 324
  • 325
  • 326
  • 327
  • 328
  • 329
  • 330
  • 331
  • 332
  • 333
  • 334
  • 335
  • 336
  • 337
  • 338
  • 339
  • 340
  • 341
  • 342
  • 343
  • 344
  • 345
  • 346
  • 347
  • 348
  • 349
  • 350
  • 351
  • 352
  • 353
  • 354
  • 355
When AutoSED generates a backup set, this set consists of three shares with a threshold of two, which adds security and reliability
to a sensitive process.
To destroy a set of shares, you could erase every share. However, if you erase only two shares from a backup set, the remaining
share cannot recover the key and is useless.
Example: AutoSED Key Sharing
Consider an enclosure with 22 active drives and 2 spares:
1.
When the array is
first
set up, AutoSED generates shares for all the active drives, which are in Set A. Because spares are
excluded, Set A has 22 shares with a threshold of 11 (11-of-22). The array then generates and displays a backup, Set B, which is
2-of-3.
2.
Remove a drive. Immediately, AutoSED destroys Set A, which means erasing the rest of Set A (the remaining 21 shares).
AutoSED generates a new Set C containing the 21 active drives and having a threshold of 11-of-21. If another drive is removed,
then AutoSED destroys Set C, and replaces it with Set D and a threshold of 10-of-20.
3.
If both drives are removed by the same adversary, it now possesses one share from Set A and one share from Set C. However,
each of those shares is useless by itself and also cannot be combined with each other. The adversary must simultaneously
remove at least 11 drives to obtain enough shares from the same set.
Set B has remained usable. However, the same process applies:
1.
Suppose one of the shares from Set B is compromised. Immediately, the administrator should destroy Set B, which means
erasing the rest of Set B (the remaining 2 shares).
2.
Then, the administrator should generate a new backup set, resulting in Set E. If a share from Set E is compromised, destroy Set
E by erasing the remaining 2 shares, and generate Set F. The stolen share from Set B and the stolen share from Set E are
useless individually and also cannot be combined. Also, they cannot be combined with the shares stolen from Set A and Set C.
Further reading:
Shamir, Adi,
How to Share a Secret
, Communications of the ACM, 22(11):612-613, 1979
McGrew, David,
Threshold Secret Sharing
, Network Working Group Internet Draft (draft-mcgrew-tss-03)
Trusted Computing Group, Enterprise SSC v1.0
Specification
About Self-Encrypting Drives (SEDs) and AutoSED
317