in client/shares/shares.go [180:214]
func CombineUnwrappedShares(keyCfg *configpb.KeyConfig, unwrappedShares []UnwrappedShare) ([]byte, error) {
// Reconstitute DEK.
var combinedShares []byte
switch keyCfg.KeySplittingAlgorithm.(type) {
// DEK wasn't split, so combined shares is just the sole share.
case *configpb.KeyConfig_NoSplit:
if len(unwrappedShares) != 1 {
return nil, fmt.Errorf("number of unwrapped shares is %v but expected 1 for 'no split' option", len(unwrappedShares))
}
combinedShares = unwrappedShares[0].Share
// Reverse Shamir's Secret Sharing to reconstitute the whole DEK.
case *configpb.KeyConfig_Shamir:
if len(unwrappedShares) < int(keyCfg.GetShamir().GetThreshold()) {
return nil, fmt.Errorf("only successfully unwrapped %v shares, which is fewer than threshold of %v", len(unwrappedShares), keyCfg.GetShamir().GetThreshold())
}
var err error
combinedShares, err = CombineShares(unwrappedShares, int(keyCfg.GetShamir().GetShares()), int(keyCfg.GetShamir().GetThreshold()))
if err != nil {
return nil, fmt.Errorf("Error combining DEK shares: %v", err)
}
default:
return nil, fmt.Errorf("Unknown key splitting algorithm")
}
if len(combinedShares) != int(DEKBytes) {
return nil, fmt.Errorf("Reconstituted DEK has the wrong length")
}
return combinedShares, nil
}