How to set up Split-Authority Decryption (Shamir M-of-N)
Configure M-of-N custodian quorum decryption using Shamir Secret Sharing. For the most sensitive scopes: privileged-document storage, defence-graded archives, M&A material.
Split-Authority Decryption is SkyeConnex's high-assurance access-control feature on the Sovereign tier. The decryption secret is split among M-of-N custodians using Shamir Secret Sharing; M custodians must independently authorise the unwrap operation for the protected scope to be decrypted. No single custodian — including the customer organisation's own administrators — can compel access alone.
Use this for scopes where the cost of unilateral access is too high: classified handling, privileged legal documents, defence research, M&A material in escrow.
The procedure
-
STEP 01
Select the scope and quorum parameters
Decide what files / folders constitute the protected scope. The scope can be a folder, a tag set, a project, or specific files. Decide M and N. Common configurations: 2-of-3 (any two of three custodians), 3-of-5 (any three of five), 4-of-7. Higher N provides more failure tolerance; higher M provides more access friction. For defence-grade scopes, 3-of-5 is typical. M must be ≤ N. Recovery of a lost custodian is possible by re-sharing — see step 5.
-
STEP 02
Identify and onboard custodians
Custodians should be distinct individuals with separate authentication credentials and independent reporting lines. For defence-grade scopes, custodians are typically a mix of internal officers and external advisors (chief legal officer, CISO, CFO, external counsel). Each custodian receives a SkyeConnex custodian account and undergoes platform-specific onboarding (2FA, recovery key generation, custodian role acceptance signed into the audit log).
-
STEP 03
Generate the split and provision shares
From Settings → Split-Authority Decryption, generate the Shamir split. The platform produces N shares of the wrap key. Each share is delivered to its custodian through an out-of-band channel — typically a one-time download link the custodian generates after authenticating. The original key is destroyed after the splits are confirmed received; from that point, no single custodian (and no SkyeConnex admin) holds the full key.
-
STEP 04
Test the quorum workflow
Attempt to access a file in the protected scope. The platform prompts for M custodian authorisations. Each authorising custodian receives a request, reviews the request context (who is asking, what file, what time), and approves or denies via the platform. When M authorisations are received, the platform reconstructs the wrap key, performs the unwrap, and serves the file. The reconstruction is ephemeral — the reconstructed key is held in memory only for the read operation, then discarded.
-
STEP 05
Document custodian replacement and rotation
Custodian replacement (departures, role changes) requires re-sharing. From Settings → Split-Authority, initiate a re-share. The existing quorum must approve the re-share, after which new shares are generated and delivered. Periodic re-sharing (quarterly or annually) is a defensible operational hygiene practice. Document the procedure in your security policy.
Common questions
What happens if a custodian loses their share?
If M custodians can still produce shares, the lost share is recoverable: initiate a re-share with the existing quorum's approval, and a new share is generated for the affected custodian. If you've lost N - M + 1 custodian shares, the scope is unrecoverable — by construction. This is the trade-off Shamir Secret Sharing provides: strong access control comes with strong recovery friction.
Can SkyeConnex compel custodian access?
No. The platform's role in Split-Authority Decryption is to enforce the quorum and perform the unwrap when M shares are presented; we do not hold any share. A subpoena to SkyeConnex cannot compel decryption because the necessary capability does not exist on our infrastructure.
How does this interact with duress mode?
Duress mode is a separate primitive — a secondary password unwraps a limited shadow scope under coercion. Split-Authority Decryption applies to high-assurance scopes that should remain inaccessible even under coercion. The two can coexist: most files use the standard wrap; specific scopes require quorum authorisation.
What's the latency impact?
First access to a protected scope is gated on custodian authorisations — typically minutes to hours depending on custodian availability. Once authorised, the unwrap is held for a configurable duration (default 1 hour) so subsequent reads within that window are immediate. The latency model maps well to read-heavy / time-bounded workflows; not appropriate for high-frequency interactive use.
Want help configuring this?
A 45-minute briefing walks through this configuration on your tenant, live.