Secure key storage and distribution

1. A method comprising:

under control of one or more computing devices configured with executable instructions,

receiving a private key encrypted with a security system public key associated with a security system;

causing the storage of the encrypted private key in a plurality of computing resources of the security system;

receiving from a client a request for the private key, the request including a blinding factor encrypted with the security system public key;

providing the request for the private key and the blinding factor encrypted with the security system public key to the plurality of computing resources;

receiving from each of the plurality of computing resources, a partially decrypted product of the private key and the blinding factor;

combining each of the partially decrypted products received from each of the plurality of computing resources to decrypt a product of the private key and the blinding factor; and

sending to the client the product of the private key and the blinding factor.

2. A method as recited in claim 1 , wherein combining each of the partially decrypted products is performed using threshold cryptography.

3. A method as recited in claim 1 , wherein the client is a subscriber to encrypted published data that can only be decrypted with the publication private key.

4. A method as recited in claim 1 , wherein each of the plurality of computing resources use a respective security system private key share to partially decrypt the product of the blinding factor and the publication private key.

5. A method as recited in claim 1 , wherein a security system private key is not stored at any of the computing resources.

6. A method as recited in claim 1 , wherein the publication private key may be used to decrypt data published by a publisher and encrypted using a publication public key.

7. A method as recited in claim 1 , wherein sending to the client the product of the private key and the blinding factor, includes:

prior to sending, encrypting the product of the private key and the blinding factor with a client public key.

8. A computing system, comprising:

one or more processors; and

a memory coupled to the one or more processors and storing program instructions that when executed by the one or more processors cause the one or more processors to:

receive from a client a request for a private key, the request including a blinding factor encrypted with a security system public key;

provide the request for the private key and the blinding factor encrypted with the security system public key to a plurality of computing resources;

receive from each of the plurality of computing resources, a partially decrypted product of the private key and the blinding factor;

combine each of the partially decrypted products received from each of the plurality of computing resources to decrypt a product of the private key and the blinding factor; and

send to the client the product of the private key.

9. The computing system of claim 8 , wherein the program instructions that when executed by the one or more processors further cause the one or more processors to:

receive the private key encrypted with the security system public key associated with the security system; and

cause a storage of the encrypted private key in the plurality of computing resources of the security system.

10. The computing system of claim 9 , wherein each of the plurality of computing resources store a portion of the encrypted private key.

11. The computing system of claim 8 , wherein each of the plurality of computing resources use a respective security system private key share to partially decrypt the product of the blinding factor and the publication private key.

12. The computing system of claim 8 , wherein a security system private key is not stored at any of the computing resources.

13. The computing system of claim 8 , wherein the publication private key may be used to decrypt data published by a publisher and encrypted using a publication public key.

14. The computing system of claim 8 , wherein each of the partially decrypted products are combined using threshold cryptography.

15. The computing system of claim 8 , wherein the client is a subscriber to encrypted published data that can only be decrypted with the publication private key.

16. A computer-implemented method for maintaining security, comprising:

under control of one or more computing systems configured with executable instructions,

receiving from a subscriber a request for a publication private key;

notifying a plurality of computing resources of the request for the publication private key; and

wherein the plurality of computing resources include executable instructions to perform the method, including:

multiplying an encrypted publication private key and a blinding factor to generate an encrypted product;

creating a partial decryption of the encrypted product; and

providing the partial decryption of the encrypted product to a delegate.

17. The computer-implemented method of claim 16 , wherein:

the delegate combines each of the partial decryptions of the encrypted product received from each of the computing resources to product a product; and

the delegate provides the product to the subscriber.

18. The computer-implemented method of claim 16 , wherein the blinding factor is provided by the subscriber.

19. The computer-implemented method of claim 18 , further comprising providing a blinding factor to the plurality of computing resources.

20. The computer-implemented method of claim 16 , wherein the product provided to the subscriber is used by the subscriber to obtain the publication private key.