Question regarding shared keys

[David Tomaschik]

On 02/28/2011 05:38 PM, Denise Schmid wrote:
> Thanks all for your help.
> 
> Now, the story gets even more funny: They claim to have used PGP split-key, then encrypted the files with a randomized key, then encrypted the key with individual keys.
> 
> So far so bad. But now comes the best: They claim that, because one of the managers wasn't able to remember his mantra, they decided to _delete_ all encrypted data.
> 
> It sounds as if the whole thing is really nothing else but a bogus... Now as Vedaal wrote: Best thing that can happen is that they encrypted something later... 
> 
> But I see support for my opinion that the thing smells :-)
> 
> Thanks again
> 
> Denise


IANAL, and am also not a certified forensics expert, but this feels very
suspicious to me.  Normally, with split-key, you have a system where you
need, say, 3 out of 4, 5 out of 7, or something like that, pieces to
reconstruct the key.  There are a couple of different techniques for
this, but that's tool-dependent.  So if they did that (a best practice)
they should still be able to reconstruct it without that one manager.
Otherwise, what would happen to important data if one manager "departs"
suddenly (quits, fired, medical emergency, etc.)?

As a hint, IF they had the data written to disk in the plain
(unencrypted) before encrypting it, and haven't written a whole lot to
that disk since (i.e., no wiping programs) then a forensic investigator
might be able to recover some/all of the unencrypted data.

David