Quorum

Quorum is a simple CLI for generating key shares, and using them to encrypt data. It's intended to wrap small files, like sensitive private keys. Quorum uses Shamir Secret Sharing to split an ed25519 private key. Messages are encrypted using ECIES with AES-GCM. You should use it in a highly monitored key ceremony, and then distribute the key shares to trusted parties. After the ceremony, ensure that no one party has a full quorum of shares.

Usage: quorum <COMMAND>

Commands:
  generate  Generate key shares to be distributed among share-holders
  encrypt   Encrypt using key shares
  decrypt   Decrypt using key shares
  help      Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help information
  -V, --version  Print version information

Examples

Generate a default quorum

Three of five shares will be required to decrypt ciphertext. Public key and private share key files are written to the provided path.

➜  ~ quorum generate /tmp
➜  ~ ls /tmp/
quorum.pub
quorum_share_0.priv
quorum_share_1.priv
quorum_share_2.priv
quorum_share_3.priv
quorum_share_4.priv
➜  ~ cat /tmp/quorum.pub
-----BEGIN QUORUM PUBKEY-----
BONpYZpA8M2wcYIRvHY3CK529Fmnz+uKim2f2sUqRRnpVdroCu+ODDa+T2Hh2P8V
dlZml1BFWQSqouSff8bYdbI=
-----END QUORUM PUBKEY-----
➜  ~ cat /tmp/quorum_share_0.priv
-----BEGIN QUORUM SHARE-----
AXZA8SCcpRbRceRZjxwksopOKSbFwW3rOVS1QSmzIsyQ
-----END QUORUM SHARE-----

Encrypt a message

Encrypt a message with the quorum public key.

➜  ~ echo "attack at dawn" | quorum encrypt /tmp/quorum.pub
-----BEGIN QUORUM CIPHERTEXT-----
BOe+ISgYxTST4xcUxiCIGxi1Rn0ELXLZyADE95YClwGOfG+qYrEz71v/uy1STXXO
63Bzi/6FI8XZbDG+tPfCfNlHyVezne7BHBaIKiOPiNBcqqFcJsAi289Se53PmiGa
92gmllkaug5W/hvCN6NQLA==
-----END QUORUM CIPHERTEXT-----

Decrypt the ciphertext

Decrypt the ciphertext with a different three shares to recover the message.

➜  ~ quorum decrypt /tmp/quorum_share_0.priv /tmp/quorum_share_1.priv /tmp/quorum_share_2.priv
-----BEGIN QUORUM CIPHERTEXT-----
BOe+ISgYxTST4xcUxiCIGxi1Rn0ELXLZyADE95YClwGOfG+qYrEz71v/uy1STXXO
63Bzi/6FI8XZbDG+tPfCfNlHyVezne7BHBaIKiOPiNBcqqFcJsAi289Se53PmiGa
92gmllkaug5W/hvCN6NQLA==
-----END QUORUM CIPHERTEXT-----
attack at dawn