The GNU Project has released the first test version of GNU Anastasis, a protocol and applications with its implementation designed for securely backing up encryption keys and access codes. The project is developed by the GNU Taler payment system developers in response to the need for a tool to recover keys lost due to storage system failures or forgotten passwords used to encrypt the key. The project code is written in C and is distributed under the GPLv3 license.
The main idea of the project is that the key is split into parts, and each part is encrypted and stored with an independent storage provider. Unlike existing key backup schemes that rely on paid services or friends/family, the method proposed in GNU Anastasis does not depend on full trust in the storage or the need to remember a complex password used to encrypt the key. Password protection for key backups is not considered a solution, as the password also needs to be stored or remembered somewhere (the keys will be lost due to amnesia or the owner's death).
In GNU Anastasis, the storage provider cannot utilize the key as they only have access to a part of it, and to assemble all components of the key into one, authentication is required from each provider, which uses different authentication methods. Authentication via SMS, email, receiving a regular paper letter, video call, knowledge of the answer to a predefined secret question, and the ability to make a transfer from a pre-specified bank account is supported. Such verifications confirm that the user has access to the email, phone number, and bank account, as well as the ability to receive letters at the specified address.
When saving the key, the user chooses the providers and the authentication methods to use. Before sending data to the provider, parts of the key are encrypted using a hash calculated based on formalized responses to several questions related to the owner's identity (full name, date and place of birth, social security number, etc.). The provider does not receive information about the users performing the backup, except for the details necessary for authenticating the owner. A certain amount may be paid to the provider for storage (support for such payments has already been added to GNU Taler, but the current two test providers operate for free). A utility with a graphical interface based on the GTK library has been developed to manage the recovery process.
Source: opennet.ru
