4 ms·
> I see nothing wrong in using same public key to log in from a particular machine to a number of remote machines. There is nothing really wrong with it; it's
by bahjoite 10y ago
> I see nothing wrong in using same public key to log in from a particular machine to a number of remote machines.
There is nothing really wrong with it; it's a good way to reduce the burden of managing secrets. The downside though is when multiple remote machines need to be contacted because a private key was revoked. Then again, a common need for revocation is a compromise of the machine on which the private key(s) is stored, which can often mean a number of private keys need to be revoked. I think the ideal is still to have unique key pairs for each client-server combination.
- cvwright 10y agoIt's worth thinking this through one step further IMO. What kind of event would cause a private key to be compromised, so that it needs to be revoked? The most likely cases are that (1) the client machine was compromised, or (2) an un-encrypted backup was lost. In either case, I have a hard time seeing how one private key needs to be revoked but others on the same client machine don't.
- bahjoite 10y agoAgreed - it's what I meant by that third sentence. There are of course reasons to revoke one of a collection of keys, for example natural end-of-life rotation, weak key generation and accidental disclosure.