Live data from Hacker News

Ask HN: How does your company manage its encryption keys?

news.ycombinator.com

51–60 of 246 posts

Re: Ask HN: How does your company manage its encryption keys?

#51
Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups):

1. Buy a bunch of Yubikeys, minimum of 2.

2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to always require touch.

3. Use GPG to encrypt your backups to multiple recipients (all of the YubiKeys).

4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc.

5. Test restores at least once per quarter, with a randomly selected key.

The advantages of this solution is that it is simple, works pretty well, and gets you a lot of mileage with relatively little inconvenience. You don't have the risk of keys being copied, and guarding physical keys is easier than digital ones.

You still have the problem of guarding the passphrases to the Yubikeys (if you use them), but that is much less of a problem than guarding the encryption keys. A passphrase without the physical key is useless.

This setup works for organization from size 1 up to fairly large ones.

Note that some recently fashionable security consultants crap on GPG from great height, but do not provide an alternative. It's a tool that while having multiple flaws, does many jobs better than anything else out there.

Re: Ask HN: How does your company manage its encryption keys?

#53
post #8

Not sure the "right" way to do it. But this is what we did: For context: We run a centralised salt-master, salt master unencrypts content using gpg filters as part of variable generation (salt "pillars"). So it's encrypted at rest and encrypted in our git repositories. What we do/did, is: * grab a pair of differently branded USB sticks. * LUKS encrypt the USB sticks; we used a keyfile which is encrypted on our machin…

Bit rot is a thing.

It'd be better to take a page out of the cryptocurrency handbook and print the keys out as QR codes (maybe with a simple password so it can only be restored if you know the pw).

Re: Ask HN: How does your company manage its encryption keys?

#56

Can't speak to my current employer as it's above my pay-grade to know, but at Job-1 we did the following: - All "hot" keys were stored in an offline credential manager in specific vaults depending on who needed access to them. Only staff with actual clearance could request temporary access to a vault (fully background checked, 1 year employment, etc). - Copies of each vaulth and our master CA cert were written to 4 e…

An expanded version of this would make a valuable book (or blog post at least).

Re: Ask HN: How does your company manage its encryption keys?

#57
post #49

Earlier quoted context omitted.

We make no distinction between dev keys and production. Consider them production. Since it's of interest to HN, I am working on educating our very small team on how keys should be protected and used. I am the youngest developer by about 15 years. It's a very rural company and it often feels like all learning and passion for development stalled around 2005. It's a company that gave me a chance to grow into a developme…

aha, sounds fair. I don't judge too harshly- anyone who has black and white principles on these matters has never worked in any other industry most likely... all you can do is your best to steer the ship and convey the downsides. I think it's important too because it helps us understand how much friction people will tolerate. In many cases, even a small amount of friction will cause people to stop functioning complet…

Thanks for the kind words. Good luck to you as well.

Re: Ask HN: How does your company manage its encryption keys?

#58

Can't speak to my current employer as it's above my pay-grade to know, but at Job-1 we did the following: - All "hot" keys were stored in an offline credential manager in specific vaults depending on who needed access to them. Only staff with actual clearance could request temporary access to a vault (fully background checked, 1 year employment, etc). - Copies of each vaulth and our master CA cert were written to 4 e…

An expanded version of this would make a valuable book (or blog post at least).

[deleted]

Re: Ask HN: How does your company manage its encryption keys?

#59

I highly second the people saying KMS (AWS KMS, Google KMS, or KeyVault). * The pricing for just storing keys is incredibly cheap. * At least with Google KMS you can't delete the keys without a 24 hour waiting period (and you can alert on the deletion attempt), so that's a huge safeguard. * You get key access auditing out of the box.

AWS KMS also enforces a waiting period of between 7 and 30 days before it will let you delete a key.

There’s also a feature you can enable that automatically rotates your key once a year. KMS is great!

Re: Ask HN: How does your company manage its encryption keys?

#60

I highly second the people saying KMS (AWS KMS, Google KMS, or KeyVault). * The pricing for just storing keys is incredibly cheap. * At least with Google KMS you can't delete the keys without a 24 hour waiting period (and you can alert on the deletion attempt), so that's a huge safeguard. * You get key access auditing out of the box.

This is fine if you're committed to using (say) AWS KMS for your encryption needs as a service with its per-API-call pricing.

The costs of that obviously scale in a completely different way from the per-key storage costs (which are actually zero, I think).

Post reply on HN