Ask HN: How do you manage your private keys?

#1

Post by bobsoap » Mon, Sep 23, 2019, 7:57 PM UTC

I'm sure many here need to juggle different servers or services between jobs, clients, playgrounds, and projects.

1. How do you organize your private key(s)? One for all, one per client, one per project, one per client/project/machine?

2. How do you move your keys between devices/machines? USB copy? File in password manager? Something like Keybase? This point is obviously moot if you have different keys per device.

Personally, I'm trying to segment my projects logically and share keys as little as possible, but not to the point of obnoxiousness. I certainly try to keep devices separated in case one gets compromised.

As for key management, I've been simply keeping them in directories, but I've been looking into Keybase's git integration lately for that, hence the question.

Re: Ask HN: How do you manage your private keys?

#2

Post by tsukurimashou » Mon, Sep 23, 2019, 9:22 PM UTC

what is your name, email, date of birth, social security number and credit card number please

Re: Ask HN: How do you manage your private keys?

#3

Post by spartas » Mon, Sep 23, 2019, 9:54 PM UTC

Don't copy your keys. Don't manage or "organize" your keys. Don't share your keys.

The leaky abstractions around what you're doing with keys is a security illusion, and you need to stop.

Re: Ask HN: How do you manage your private keys?

#4

Post by ngenstyle » Mon, Sep 23, 2019, 10:19 PM UTC

Does anyone have any actual useful/helpful comments?

Re: Ask HN: How do you manage your private keys?

#5

Post by kickopotomus » Mon, Sep 23, 2019, 10:29 PM UTC

spartas wrote: post #3

Don't copy your keys. Don't manage or "organize" your keys. Don't share your keys. The leaky abstractions around what you're doing with keys is a security illusion, and you need to stop.

This is a pretty good example of a useless comment. Telling the person to simply stop doing what they are currently doing is not a solution. Perhaps, instead, you could offer a different way to handle the situation outlined by the question.

Re: Ask HN: How do you manage your private keys?

#6

Post by spartas » Mon, Sep 23, 2019, 11:13 PM UTC

kickopotomus wrote: post #5

spartas wrote: post #3

Don't copy your keys. Don't manage or "organize" your keys. Don't share your keys. The leaky abstractions around what you're doing with keys is a security illusion, and you need to stop.

This is a pretty good example of a useless comment. Telling the person to simply stop doing what they are currently doing is not a solution. Perhaps, instead, you could offer a different way to handle the situation outlined by the question.

Sorry.

Generate new keys for each service, device, client, and server. Don't share them. Don't copy them.

Re: Ask HN: How do you manage your private keys?

#7

Post by JohnFen » Mon, Sep 23, 2019, 11:34 PM UTC

I segment my private keys into two broad groups -- ones I use for certs and long-term crypto, and ones I use for encrypted communications. The cert/long-terms keys are kept on a flash drive (plus a backup drive kept elsewhere) that is under physical lock and key when not actively needed.

The comms crypto keys are kept on a different flash drive that I'm less rigorous about, as I need to have it handy in order engage in the communications. I mitigate this loss of rigor by replacing them reasonably frequently.

All the flash drives involved are encrypted themselves, as well.

Re: Ask HN: How do you manage your private keys?

#8

Post by snowwrestler » Mon, Sep 23, 2019, 11:38 PM UTC

I always generated new keys on new devices. I never moved a private key off the device where it was generated. It just felt like doing so creates all sorts of opportunities for mistakes and loss. While it's more work to add or rotate public keys than it is to move private keys, IMO it's also safer.

When I had to manage keys for a bunch of servers and services, at first I segmented them by scope of potential compromise. For example, I had one key pair for my hosting environment, and a separate one for Github, since I had access to more repos than just the apps I was hosting.

But eventually I stopped doing that because the weak point was the device; if my device was stolen, so were all the private keys, no matter how many there were. So, might as well just have one key per device.

I always set passwords on my private keys, and stored the password in an encrypted file: either KeePass, or Keychain on my Mac.

I managed all my SSH hosts a .ssh/config file, so I could connect on the command line with just a nickname.

Edit: this was all to manage an infrastructure for developing and hosting a few dozen websites.

Re: Ask HN: How do you manage your private keys?

#9

Post by aeternum » Tue, Sep 24, 2019, 12:05 AM UTC

spartas wrote: post #6

kickopotomus wrote: post #5

Earlier quoted context omitted.

This is a pretty good example of a useless comment. Telling the person to simply stop doing what they are currently doing is not a solution. Perhaps, instead, you could offer a different way to handle the situation outlined by the question.

Sorry. Generate new keys for each service, device, client, and server. Don't share them. Don't copy them.

This still isn't very useful. Suppose you have a database, and an elastic number of workers that need to connect.

Re: Ask HN: How do you manage your private keys?

#10

Post by [deleted] » Tue, Sep 24, 2019, 12:53 AM UTC

snowwrestler wrote: post #8

I always generated new keys on new devices. I never moved a private key off the device where it was generated. It just felt like doing so creates all sorts of opportunities for mistakes and loss. While it's more work to add or rotate public keys than it is to move private keys, IMO it's also safer. When I had to manage keys for a bunch of servers and services, at first I segmented them by scope of potential compromis…

[deleted]