bc-envelope-cli 0.35.0

Gordian Envelope Command Line Tool.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

# `envelope` - SSKR Example

This example demonstrates the use of SSKR to shard a symmetric key that encrypted a message. The shares are then enclosed in individual envelopes and the seed can be recovered from those shares, allowing the future decryption of the message.

Dan has a cryptographic seed he wants to backup using a social recovery scheme. The seed includes metadata he wants to back up also, making it too large to fit into a basic SSKR share.

```
DAN_SEED=ur:seed/oxadgdhkwzdtfthptokigtvwnnjsqzcxknsktdaosezofptpbtlnlyjzkefmaxkpfyhsjpjecxgdkpjpjojzihcxfpjskphscxgsjlkoihaakskggsjljpihjncxinjojkkpjncxiejljzjljpcxjkinjycxhsjnihjydwcxiajljtjkihiajyihjykpjpcxhsieinjoinjkiainjtiocxihjzinjydwcxjkihiecxiejlcxihinkpjkjnjliecxjyihjnjojljpcxinjtiainieiniekpjtjycxkpjycxjzhsidjljpihcxihjycxiejljzjljpihcxjnhsiojthscxhsjzinjskphsdmluwmoxny
```

Dan encloses his seed in an envelope.

```
DAN_ENVELOPE=`envelope subject type ur $DAN_SEED`
echo $DAN_ENVELOPE

│ ur:envelope/tpsotantjzoxadgdhkwzdtfthptokigtvwnnjsqzcxknsktdaosezofptpbtlnlyjzkefmaxkpfyhsjpjecxgdkpjpjojzihcxfpjskphscxgsjlkoihaakskggsjljpihjncxinjojkkpjncxiejljzjljpcxjkinjycxhsjnihjydwcxiajljtjkihiajyihjykpjpcxhsieinjoinjkiainjtiocxihjzinjydwcxjkihiecxiejlcxihinkpjkjnjliecxjyihjnjojljpcxinjtiainieiniekpjtjycxkpjycxjzhsidjljpihcxihjycxiejljzjljpihcxjnhsiojthscxhsjzinjskphsdmfmflcnfy
```

Dan examines the contents of his envelope.

```
envelope format $DAN_ENVELOPE

│ Seed
```

Dan generates a public/private key pair that will allow him to recover his seed from any single share if he retains his private key.

```
envelope generate keypairs | read DAN_PRIVATE_KEY DAN_PUBLIC_KEY
```

Dan splits the envelope into a single group 2-of-3. The output of the `envelope` tool contains the list of share envelopes separated by spaces. He then assigns this to a shell array.

```
SHARE_ENVELOPES=(`envelope sskr split -g 2-of-3 --recipient $DAN_PUBLIC_KEY $DAN_ENVELOPE`)
```

Dan sends one envelope to each of Alice, Bob, and Carol.

```
SHARE_ENVELOPE_ALICE=${SHARE_ENVELOPES[1]}
SHARE_ENVELOPE_BOB=${SHARE_ENVELOPES[2]}
SHARE_ENVELOPE_CAROL=${SHARE_ENVELOPES[3]}
```

Dan ➡️ ☁️ ➡️ Alice, Bob, Carol

Bob examines the contents of his envelope, but can't recover the original seed: the SSKR share can only recover the seed with a threshold of other shares, and the SealedMessage can only be decrypted by Dan's private key.

```
envelope format $SHARE_ENVELOPE_BOB

│ ENCRYPTED [
│     'hasRecipient': SealedMessage
│     'sskrShare': SSKRShare
│ ]
```

By himself, Bob can't recover the seed.

```
envelope sskr join $SHARE_ENVELOPE_BOB

│ Error: invalid SSKR shares
```

At some future point, Dan retrieves two of the three envelopes so he can recover his seed.

```
envelope sskr join $SHARE_ENVELOPE_BOB $SHARE_ENVELOPE_CAROL | envelope extract ur

│ ur:seed/oxadgdhkwzdtfthptokigtvwnnjsqzcxknsktdaosezofptpbtlnlyjzkefmaxkpfyhsjpjecxgdkpjpjojzihcxfpjskphscxgsjlkoihaakskggsjljpihjncxinjojkkpjncxiejljzjljpcxjkinjycxhsjnihjydwcxiajljtjkihiajyihjykpjpcxhsieinjoinjkiainjtiocxihjzinjydwcxjkihiecxiejlcxihinkpjkjnjliecxjyihjnjojljpcxinjtiainieiniekpjtjycxkpjycxjzhsidjljpihcxihjycxiejljzjljpihcxjnhsiojthscxhsjzinjskphsdmluwmoxny
```

Dan can also recover his seed from a single share by decrypting it with his private key.

```
envelope decrypt --recipient $DAN_PRIVATE_KEY $SHARE_ENVELOPE_BOB | envelope extract wrapped | envelope extract ur

│ ur:seed/oxadgdhkwzdtfthptokigtvwnnjsqzcxknsktdaosezofptpbtlnlyjzkefmaxkpfyhsjpjecxgdkpjpjojzihcxfpjskphscxgsjlkoihaakskggsjljpihjncxinjojkkpjncxiejljzjljpcxjkinjycxhsjnihjydwcxiajljtjkihiajyihjykpjpcxhsieinjoinjkiainjtiocxihjzinjydwcxjkihiecxiejlcxihinkpjkjnjliecxjyihjnjojljpcxinjtiainieiniekpjtjycxkpjycxjzhsidjljpihcxihjycxiejljzjljpihcxjnhsiojthscxhsjzinjskphsdmluwmoxny
```