Distribution and recovery of a user secret

A method comprising:

• receiving, at a server system, a primary key segment from a user device, the primary key segment associated with a user account maintained at the server system for a user;
• storing, by the server system, the primary key segment in a data repository in association with the user account;
• subsequently
• receiving, by the server system, a request from a recovery device for the primary key segment;
• determining, by the server system, whether the recovery device is in possession of a shared key segment corresponding to the primary key segment, wherein the shared key segment was previously used to compute a set of M shares, wherein M is an integer greater than 2 and wherein the M shares were computed such that the shared key segment is reconstructible using any subset of the shares that includes at least a threshold number t of the M shares and is not reconstructible using any subset of the shares that includes fewer than the threshold number t of the M shares, wherein the threshold number t is greater than 1 and less than M, and wherein the M shares were distributed among M shareholder devices,
• wherein the determining includes determining whether the recovery device has obtained at least the threshold number t of the M shares from the shareholder devices;
• and
• in response to determining that the recovery device is in possession of the shared key segment, sending the primary key segment to the recovery device.

A method comprising:

• initiating, at a recovery device, a recovery process with a server system for recovery of a user secret that was previously enrolled in a recovery service of the server system, wherein as a result of the previous enrollment, the server system stores a primary segment generated from the user secret and a set of M shareholder devices each stores a respective one of a set of M shares of a shared segment generated from the user secret, wherein M is an integer greater than 2 and wherein the shared segment is reconstructible using any subset of the shares that includes at least a threshold number t of the M shares and is not reconstructible using any subset of the shares that includes fewer than the threshold number t of the M shares, wherein the threshold number t is greater than 1 and less than M;
• obtaining, by the recovery device, from at least the threshold number t of the M shareholder devices, the respective shares stored thereby, such that at least the threshold number t of the M shares are obtained;
• reconstructing, by the recovery device, the shared segment using the at least the threshold number t of the M shares;
• providing, by the recovery device, a proof to the server system that the recovery device has reconstructed the shared segment;
• receiving, at the recovery device, the primary segment from the server system, wherein the primary segment is received in response to the proof;
• and
• reconstructing, by the recovery device, the secret using the received primary segment and the reconstructed shared segment.

An electronic device comprising:

• a user interface;
• a network interface;
• and
• a processing subsystem comprising at least one programmable microprocessor, the processing subsystem being coupled to the user interface and the network interface and configured to:
• generate a secret, wherein the secret is a cryptographic key used to encrypt user data;
• identify a set of M shareholder devices, wherein M is an integer greater than 2;
• generate, from the secret, a primary segment and a shared segment such that the primary segment and the shared segment are necessary and sufficient inputs to an algorithm to reconstruct the secret;
• compute, based on the shared segment, a set of M shares such that the shared segment is reconstructible using any subset of the shares that includes at least a threshold number t of the M shares and is not reconstructible using any subset of the shares that includes fewer than the threshold number t of the M shares, wherein the threshold number t is greater than 1 and less than M;
• provide, via the network interface, the primary segment to a server system for storage;
• and
• provide, via the network interface, a different one of the M shares to each of the M shareholder devices for storage.

A server system comprising:

• a network interface;
• a data repository to store user data associated with a user account;
• and
• a processing subsystem comprising at least one microprocessor, the processing subsystem being coupled to the network interface and the data repository and configured to:
• receive, via the network interface, a primary key segment from a user device, the primary key segment associated with a user account maintained at the server system for a user;
• store the primary key segment in the data repository in association with the user account;
• subsequently
• receive a request from a recovery device for the primary key segment;
• determine whether the recovery device is in possession of a shared key segment corresponding to the primary key segment, wherein the shared key segment was previously used to compute a set of M shares, wherein M is an integer greater than 2 and wherein the M shares were computed such that the shared key segment is reconstructible using any subset of the shares that includes at least a threshold number t of the M shares and is not reconstructible using any subset of the shares that includes fewer than the threshold number t of the M shares, wherein the threshold number t is greater than 1 and less than M, and wherein the M shares were distributed among M shareholder devices,
• wherein the determining includes determining whether the recovery device has obtained at least the threshold number t of the M shares from the shareholder devices;
• and
• send, in response to determining that the recovery device is in possession of the shared key segment, the primary key segment to the recovery device.