Secure and convenient secret management in distributed computer systems

摘要

Team administration of large, distributed computer systems might become challenging when it comes to access control mechanisms. Some devices provide multi-user environment and use of centralized authentication servers while other do not have these features what brings the need for creating shared secrets among all the administrators. Shared secrets are also quite frequently used to provide database and datastore accesses for application servers. This article summarizes different approaches for a secret sharing system discussing their features and security. The author first shows an example of improper secret sharing system design discussing its consequences. Finally the paper presets a secure design pattern for such a system covering a proper use of cryptography, a zero-knowledge server and a convenient user interface at the same time.