Ask HN: How does your company manage its encryption keys? • Hacker News Board

Re: Ask HN: How does your company manage its encryption keys?

#101

Post by varikin » Tue, Jun 02, 2020, 4:18 PM UTC

toomuchtodo wrote: post #4

https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…

This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?

Re: Ask HN: How does your company manage its encryption keys?

#102

Post by techsupporter » Tue, Jun 02, 2020, 4:26 PM UTC

rrdharan wrote: post #80

jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

This is all generally good advice, but I think there's huge potential complexity lurking here: > 4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc. Would be great to see what folks think this concretely looks like for joe random startup in Capital City, Somewhere. e.g. Does…

> Does "really secure" mean "find a bank that still offers safety deposit boxes"?

Realistically? Yes. This is what several of the companies I've done contract work for have done. You can still find at least one bank or self-storage place (look for the ones that don't have a nationally-advertised brand and don't look like they're made entirely out of corrugated metal) that do regular safety deposit boxes in pretty much any city. They may only be offered at a couple of locations and I've noticed credit unions bailing the hell out of this market as fast as they can decommission the vaults but boxes still exist.

Let's assume all variables work in the other way, though. If you can't find a safety deposit box and don't have somewhere that's not your office you can drill into a floor or wall and you're storing a small device like Yubikeys or USB sticks, buy the heftiest portable gun safe you can find, one with a steel cable that loops back into the device, and stick it under your bathroom sink with the cable wrapped firmly around the water supply or drain pipe.

Re: Ask HN: How does your company manage its encryption keys?

#103

Post by mister_hn » Tue, Jun 02, 2020, 4:27 PM UTC

thieving_magpie wrote: post #14

Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.

Our company is so too.

Re: Ask HN: How does your company manage its encryption keys?

#104

Post by robszumski » Tue, Jun 02, 2020, 4:27 PM UTC

jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

This is similar to a system I have seen, other than the inclusion of a dense QR code as the backup, stored in a secure safe. And you need to test the entire process from scan to key resurrection. We saw that our offline signing laptop's camera was low enough quality that it was very hard (but possible) to read the key, because it was so dense.

Re: Ask HN: How does your company manage its encryption keys?

#105

Post by pas » Tue, Jun 02, 2020, 4:27 PM UTC

rrdharan wrote: post #80

jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

This is all generally good advice, but I think there's huge potential complexity lurking here: > 4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc. Would be great to see what folks think this concretely looks like for joe random startup in Capital City, Somewhere. e.g. Does…

All of those are excellent.

There's also the ability to just leave it at a lawyer/notary (they already handle deposits, they might even have a secure box at a bank, so you can piggy-back on them for this).

Directors/Founders of Random Co. should just make a few copies a few pieces of papers that contain the passphrase and store them at their own home and ask a few relatives to do the same for them. Depending on their recoverability/safety/accountability trade-off they can increase the number of copies, they can increase the separation between the parts (eg. keys and passprhases), and so on.

The big-big-big advantage of the yubikey approach is that it's a HSM, and you can't accidentally copy the key and leave it somewhere.

Re: Ask HN: How does your company manage its encryption keys?

#106

Post by woodrowbarlow » Tue, Jun 02, 2020, 4:29 PM UTC

rrdharan wrote: post #80

jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

This is all generally good advice, but I think there's huge potential complexity lurking here: > 4. Take care of the physical keys with proper storage and procedures. Do not store the keys together, have at least one in a really secure location, check if you have all the keys regularly, etc. Would be great to see what folks think this concretely looks like for joe random startup in Capital City, Somewhere. e.g. Does…

i think it's more useful to discuss the goal rather than the means; if the goal is resilience to theft and natural disaster, the means might range from "stick it in a fireproof safe in the boss' office" to "outsource to iron mountain" depending on threat model.

Re: Ask HN: How does your company manage its encryption keys?

#107

Post by asldfhasdf2 » Tue, Jun 02, 2020, 4:31 PM UTC

wrote our own kerberos-aaS clone with less features and vulnerable to more internal attacks than plain kerberos and more reliant in a central cert (not cert authority, cert), that is only used sporadically for cross services, not users (there's something else from major vendor there)

and that team now keeps growing and the feature never improves :)

Re: Ask HN: How does your company manage its encryption keys?

#108

Post by pas » Tue, Jun 02, 2020, 4:35 PM UTC

jwr wrote: post #51

Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…

GPG alternative:

https://docs.sequoia-pgp.org/sq/#subcommand-encrypt

https://sequoia-pgp.org/status/ is coming along nicely ( https://sequoia-pgp.org/blog/2020/04/26/202004-towards-sequo... )