Multi-party split-key authentication

A method comprising:

• receiving, at a keymaster, a request for a root certificate;
• generating, at the keymaster, a key pair including a secret key and a public key based on the request;
• generating, at the keymaster, the root certificate based on the secret key, the root certificate including the public key;
• splitting the secret key into a plurality of shards via the keymaster;
• providing a first shard of the plurality of shards from the keymaster to an agent;
• deleting the first shard at the keymaster, wherein a second shard of the plurality of shards is retained by the keymaster;
• receiving, at the keymaster, a partially signed message signed with the first shard from the agent, the agent operating within a domain of a target resource, and wherein the partially signed message includes a partially signed client certificate for a client system seeking access to a target resource;
• generating, at the keymaster, a fully signed message based on the partially signed message and using the second shard, wherein the fully signed message includes a fully signed client certificate;
• and
• issuing the fully signed message to the agent.

A memory device storing instructions that, when executed, cause a processor to perform a method comprising:

• receiving, at a keymaster, a request for a root certificate;
• generating, at the keymaster, a key pair including a secret key and a public key based on the request;
• generating, at the keymaster, the root certificate based on the secret key, the root certificate including the public key;
• splitting the secret key into a plurality of shards via the keymaster;
• providing a first shard of the plurality of shards from the keymaster to an agent;
• deleting the first shard at the keymaster, wherein a second shard of the plurality of shards is retained by the keymaster;
• receiving, at the keymaster, a partially signed message signed with the first shard from the agent, the agent operating within a domain of a target resource, and wherein the partially signed message includes a partially signed client certificate for a client system seeking access to a target resource;
• generating, at the keymaster, a fully signed message based on the partially signed message and using the second shard, wherein the fully signed message includes a fully signed client certificate;
• and
• issuing the fully signed message.