Distributed authentication

A method performed by a user device, the method comprising:

• receiving, from a dealer device, multiple shares of a distributed private key, where the distributed private key is paired with a public key used by an authentication device to authenticate a user;
• receiving, from the authentication device via a challenge device, a challenge seeking to authenticate the user;
• generating multiple partial responses to the challenge based on the challenge and on the shares of the distributed private key;
• and
• providing the partial responses to a combiner device, wherein:
• each partial response received by the combiner device corresponds to one of the shares of the distributed private key,
• the combiner device generates a complete response from a threshold number of partial responses received from a set of devices including the user device,
• a total number of members of a set of shares of the distributed private key is greater than a number of devices in in the set of devices,
• a device of the set of devices receives multiple members of the set of shares;
• and
• the combiner device transmits the complete response to the authentication device.

A system, comprising:

• a microprocessor;
• a non-transitory machine-readable storage device that stores instructions that are executable by the microprocessor to:
• operate a data store to store a public key that is paired with a private key, where the private key has been split into a set of shares, and where members of the set of shares have been distributed to members of a set of devices, wherein:
• a size of the set of shares is such that a number of members of the set of shares exceeds a number of members of the set of devices, and
• a one device of the set of devices receives multiple members of the set of shares;
• operate a challenge generation module to issue an authenticating challenge to be distributed to members of the set of devices;
• and
• operate an authentication module to, based on the public key, grant access to a resource upon receiving an authenticating response from the members of the set of devices, wherein:
• the authenticating response is a response that would be generated by signing the authenticating challenge with the private key, and
• the authenticating response is generated by the cooperation of a quorum of the members of the set of shares on the members of the set of devices.