Blinded passwords for a distributed storage system

1. A method for execution by a storage network comprises:

performing a key derivation function on a password to produce a key;

generating a set of blinded passwords based on the key;

transmitting the set of blinded passwords to a set of storage units;

receiving at least a decode threshold number of confidential information responses, wherein each of the confidential information responses is based on at least one received blinded password;

regenerating a set of keys using the at least a decode threshold number of the confidential information responses;

decrypting a set of encrypted encoded data slices of the confidential information using the set of keys to reproduce a set of encoded data slices; and

dispersed storage error decoding a decode threshold number of the set of encoded data slices to produce recovered data.

2. The method of claim 1 , wherein the receiving at least a decode threshold number of confidential information responses includes each of the confidential information responses including an encrypted encoded data slice and an associated passkey.

3. The method of claim 2 , wherein the associated passkey includes at least a first passkey generated by a corresponding storage unit of the set of storage units in accordance with a formula of: passkey 1=bpass1={circumflex over ( )}e1 modulo p, where e1 is a recovered random number associated with the encrypted encoded data slice and a corresponding original random number.

4. The method of claim 1 , wherein the set of blinded passwords are generated based on a key and includes generating a first blinded password in accordance with a formula of: blinded password 1=[[MGF(KEY)]{circumflex over ( )}2]{circumflex over ( )}b1 modulo p, where b1 is a random number of a set of random numbers.

5. The method of claim 1 , wherein the regenerating a set of keys using passkeys of the confidential information includes generating a first key of the set of keys in accordance with a formula of key 1=passkey1{circumflex over ( )}v1 modulo p; where b1*v1=1 modulo q and where q=(p−1)/2.

6. The method of claim 1 further comprises decrypting an encrypted data slice 7 using the first key 1 to produce an encoded data slice 1 of the set of encoded data slices.

7. The method of claim 1 , wherein the key derivation function includes at least one algorithm requiring increased time or memory resources while attempting each of a plurality of candidate passwords.

8. A computing device of a group of computing devices of a storage network, the computing device comprises:

an interface;

a local memory; and

a processing module operably coupled to the interface and the local memory, wherein the processing module functions to:

perform a key derivation function on a password to produce a key;

generate a set of blinded passwords based on the key;

transmit the set of blinded passwords to a set of storage units;

receive at least a decode threshold number of confidential information responses, wherein each of the confidential information responses is based on at least one received blinded password;

regenerate a set of keys using the at least a decode threshold number of the confidential information responses;

decrypt a set of encrypted encoded data slices of the confidential information using the set of keys to reproduce a set of encoded data slices; and

disperse storage error decode a decode threshold number of the set of encoded data slices to produce recovered data.

9. The computing device of claim 8 , wherein the receive at least a decode threshold number of confidential information responses includes each of the confidential information responses including an encrypted encoded data slice and an associated passkey.

10. The computing device of claim 9 , wherein the associated passkey includes at least a first passkey generated by a corresponding storage unit of the set of storage units in accordance with a formula of: passkey 1=bpass1{circumflex over ( )}e1 modulo p, where e1 is a recovered random number associated with the encrypted encoded data slice and a corresponding original random number.

11. The computing device of claim 8 , wherein the set of blinded passwords are generated based on a key and includes generating a first blinded password in accordance with a formula of: blinded password 1=[[MGF(KEY)]{circumflex over ( )}2]{circumflex over ( )}b1 modulo p, where b1 is a random number of a set of random numbers.

12. The computing device of claim 8 , wherein the regenerate a set of keys using passkeys of the confidential information includes generating a first key of the set of keys in accordance with a formula of key 1=passkey1{circumflex over ( )}v1 modulo p; where b1*v1=1 modulo q and where q=(p−1)/2.

13. The computing device of claim 12 further comprises decrypting an encrypted data slice 1 using the first key 1 to produce an encoded data slice 1 of the set of encoded data slices.

14. The computing device of claim 8 , wherein the key derivation function includes at least one algorithm requiring increased time or memory resources while attempting each of a plurality of candidate passwords.

15. A distributed storage network (DSN) system comprises:

a plurality of DSN storage units;

a dispersed storage client module including:

an interface;

a local memory; and

a processing module operably coupled to the interface and the local memory, wherein the processing module functions to:

perform a key derivation function on a password to produce a key;

generate a set of blinded passwords based on the key;

transmit the set of blinded passwords to a set of storage units;

receive at least a decode threshold number of confidential information responses, wherein each of the confidential information responses is based on at least one received blinded password;

regenerate a set of keys using the at least a decode threshold number of the confidential information responses;

decrypt a set of encrypted encoded data slices of the confidential information using the set of keys to reproduce a set of encoded data slices; and

disperse storage error decode a decode threshold number of the set of encoded data slices to produce recovered data.

16. The distributed storage network (DSN) system of claim 15 , wherein the receive at least a decode threshold number of confidential information responses includes each of the confidential information responses including an encrypted encoded data slice and an associated passkey.