There's a reason gpg supports --armor; print a backup copy of any important keys and stick it in a safe deposit box.
Ask HN: How does your company manage its encryption keys?
221–230 of 246 posts
Re: Ask HN: How does your company manage its encryption keys?
#222Earlier quoted context omitted.
This is the best answer I know of. A secret management system is what you want, for several reasons: 1) Secrets checked into code means when the code gets stolen, this is an unimaginably major breach. Code tends to get stolen eventually and most tech shops will never know / only know years later because they don't have access to the channels who will sell your code. 2) You can track secrets you have in storage, who h…
I'm always a bit antsy about Vault. You do end up having all your secrets in one place.
Security and convenience are general opposites. You have to find a compromise that suits your organisations risk profile. For example my BIL works as an engineer on a mass rapid transit system and they have air gapped all their systems.
Re: Ask HN: How does your company manage its encryption keys?
#223Lastpass?
Re: Ask HN: How does your company manage its encryption keys?
#224The more complex your system grows, the more often it will fail and shoot you in the foot. I'd advise against systems like Hashicorp Vault - they just increase the complexity and while they have their merits in complex setups, you seem to be too small to be able to operate such a system. Have an offline backup printed along with the disaster recovery checklist and documentation and put them in a safe in your company…
> an offline backup printed
have you ever tried typing a private key from a piece of paper? once i was in a similar situation and gave up and just drove to the colo.
Re: Ask HN: How does your company manage its encryption keys?
#225The more complex your system grows, the more often it will fail and shoot you in the foot. I'd advise against systems like Hashicorp Vault - they just increase the complexity and while they have their merits in complex setups, you seem to be too small to be able to operate such a system. Have an offline backup printed along with the disaster recovery checklist and documentation and put them in a safe in your company…
> an offline backup printed have you ever tried typing a private key from a piece of paper? once i was in a similar situation and gave up and just drove to the colo.
An elliptic curve key (NaCl etc) is 32 bytes. Here's two such keys for you, as a demo:
$ entropy 32|zbase32-encode
pu3zrux6t6cqrmmyesdxtppxiudxjcndrx3bomjuyaupa61493no
$ entropy 32|phrase-encode
afar-pimple-unwind-imagine-buckets-today-duke-sober-dehydrate-rebel-online-nudged-bamboo-saxophone-eluded-tattoo-pause-bays-ungainly-tasked-jingle-topic-null-enragedRe: Ask HN: How does your company manage its encryption keys?
#226Someone at my company generated the keys. They then put them on a network share without any security restrictions. They've been there for 5 years with no rotation. At least 2 are checked into source control.
like every startup ever in the last startup I worked, all jwt tokens were created from a 10 letter long shared "secret" stored in json config files all over the place :p even dev environments had same key lol
like enterprise companies too!
Re: Ask HN: How does your company manage its encryption keys?
#227https://www.vaultproject.io/ We use Hashicorp's Vault product to manage SSH credentials, TLS certificates, as well as application secrets across thousands of users, tens of thousands of virtual machines, and hundreds of applications. We pay for the enterprise version, but the free version is more than capable for most needs. Avoid a password manager if you can, it leads to poor security practices and availability iss…
How do you store the vault seal keys?
Re: Ask HN: How does your company manage its encryption keys?
#228Some on a USB hardware dongle under lock and key. We also run HSMs and the key cards to those require quorum. So the CTO, Founder and head of devops each have multiple cards at home and work such that any two of them can make a quorum with all their cards, or all three can make a quorum with some of their cards.
Re: Ask HN: How does your company manage its encryption keys?
#229Earlier quoted context omitted.
> an offline backup printed have you ever tried typing a private key from a piece of paper? once i was in a similar situation and gave up and just drove to the colo.
An elliptic curve key (NaCl etc) is 32 bytes. Here's two such keys for you, as a demo: $ entropy 32|zbase32-encode pu3zrux6t6cqrmmyesdxtppxiudxjcndrx3bomjuyaupa61493no $ entropy 32|phrase-encode afar-pimple-unwind-imagine-buckets-today-duke-sober-dehydrate-rebel-online-nudged-bamboo-saxophone-eluded-tattoo-pause-bays-ungainly-tasked-jingle-topic-null-enraged
While you're right, I'd recommend against both for the specific use-case. You just added another layer. The extra software needs to be available, maybe it's not developed anymore and won't compile on your system, maybe they changed the alphabet from which the words are generated, ...
OpenSSH private keys are armoured by default, gpg-keys can be exported and imported in an armored format - and everything else can be just printed as hex representation with whatever tool (e.g. `od -Ax ` or any other).
Re: Ask HN: How does your company manage its encryption keys?
#230Here's what works for small and medium organizations for data which needs to be encrypted at rest, but is not often accessed (so, backups): 1. Buy a bunch of Yubikeys, minimum of 2. 2. Create GPG keys and store them on YubiKeys. Follow this guide: https://github.com/drduh/YubiKey-Guide (if you want to, keep the secret keys, but in case of multiple YubiKeys I would not keep them anywhere). Remember to set the keys to…
This is great advise, and depending on your organization and stack, best when coupled with Vault.
Vault stores all secrets needed by running services (ACL tokens, access keys, credentials for databases, PKI for certificates, what have you).
For the rest (Vault unseal keys/cert keys/operator token, other operator secrets), secure those with the GPG keys mentioned above and store them in some way that suits you (GNU Pass/git-secret/there are several alternatives).
Where you draw the line between what's stored in Vault and not will depend on your org and its needs.