0018 Keys: two of three (depositor's device, family, Nodeone), signatures by Ed25519

09-Keys is a draft

This is the decision record for the new document 09-Keys. secretary v0.2 (11/16, “signing and locking with my own key, and how to recover the key”) follows this document.

What

1. Each original is locked with its own content key per file, and that key is wrapped with the depositor’s owner key. Sealed records are wrapped separately with a seal key.
2. Lock on the device, then send. The store receives only locked files. The original fingerprint is written exactly as the device took it.
3. The owner key is split into three shares, and any two together restore it: the depositor’s device, family (the successor), and Nodeone. If there is no family, the depositor’s second device.
4. Recovery waits 7 days and notifies all devices and the family. Succession follows the procedure in 01-Permissions with a 30-day wait. The successor cannot open seals (the seal key is not in the shares).
5. Depositor signatures use Ed25519 (this closes 02-Fingerprint section 8). The signing key is derived from the owner key.
6. When an original is sent to an outside company, as for transcription, the device briefly hands the content key to the server for each job. The server unlocks it only in memory and then discards it. We state that this part is guarded by promise, not by lock (the answer to 01-Permissions section 6, item 1).

Documents updated: 09-Keys (new, draft v0.1), 02-Fingerprint sections 2, 4 and 8 (v0.5), 05-Glossary section 12.

Why

• HGP-0005 of the September specification clashed with principle 3. HGP-0005 says “the speaker should not have to think about keys; the key is in the custodian’s device”. Principle 3 says “even Nodeone’s operators cannot open it”. Splitting into two of three keeps both: the depositor has nothing to memorize, and Nodeone alone cannot open it.
• Recovery and succession in one mechanism. The family share is also the successor share, so losing a phone and passing away take the same path. Only the procedure (waiting period, checks) differs.
• Seals are not put in the shares. 00-Principles section 3 set that “a seal is for the depositor alone, even the successor cannot open it, and the key is kept somewhere not connected to the internet”. If the seal key is lost, the sealed records stay closed forever. We say this in advance.
• Ed25519: short, fast and widely used, and it was a candidate in the September specification and in 02-Fingerprint section 8. C2PA certificates would require a certificate authority for individual depositors.
• Transcription: to send directly from a phone to a transcription company, the company key (API key) would have to be on the phone. That breaks the common rule that secrets are not kept in repositories or apps.

Other options

Option	Why not chosen
A paper recovery phrase	The depositor must guard it. HGP-0005 section 2: “a design that requires a seed phrase is a failed design”. If lost, it is over
Shares held by other institutions	Fits records to be opened decades later (time lock, HGP-0005 section 8-1). Too slow for everyday recovery, and no such institution exists yet. To be revisited for time lock
Nodeone keeps the key as it is	Breaks principle 3
The server locks it on receipt	The server sees the original the moment it receives it. Used only when locking on the device is not possible
C2PA X.509 signatures	Individuals would need a certificate authority. To be revisited for institutional depositors

What it affects

• secretary (v0.2, 11/16): locking on the device, the owner key and three shares, the recovery screen (7-day notice), choosing family, the seal key, Ed25519 signatures, handing over a one-time key for transcription, ledger encryption: "user-key", event: "encrypted", sha256_stored.
• arkive: the entrance that receives originals locked by secretary (decision 0004). It does not open originals and checks them only by the stored fingerprint. Keys for arkive’s own depositors come after the login version.
• Nodeone operations: the key that guards Nodeone’s share and where it is kept, and the identity check procedure for recovery.
• 01-Permissions section 6, item 1: this decision is the answer. Changing 01 takes one line, after approval by the head of Nodeone.

Cost

Zero won. If security keys are handed out for seals, tens of thousands of won each.