12 ms·
For my private keys, I export them into PEM format, convert that into a QR code, and print them out. This goes in my fire-resistant Fort Knox vault [1] for saf
by chrissnell 9y ago
For my private keys, I export them into PEM format, convert that into a QR code, and print them out. This goes in my fire-resistant Fort Knox vault [1] for safe keeping. The vault is bolted to the cement floor and cannot be carted away.
I use intermediate certs for my internal CA and do keep those private keys online for quick and easy generation of new certs but the root cert private key only exists in physical form under my control. It's a bit of a pain to convert the root key back into digital form but I only have to do this every couple of years when the intermediate cert expires.
I got into a habit of writing shell scripts for every certificate related task to make it easier. I use the dialog(1) utility to prompt me for input when that's needed. If things are easy, you're more likely to do them.
[1] https://www.ftknox.com/vaults/legend-vault/ https://www.ftknox.com/vaults/legend-vault/
- toomuchtodo 9y agoLove that vault suggestion, but for a lot of folks, a safety deposit box might be sufficient (with your own enclosure within it using tamper evident stickers). Having moved 5+ times in the last decade, I'd dread thinking about having to move that safe you linked to.
- dom0 9y agoMovable safe? Doesn't sound very safe to me...
- chrissnell 9y agoWe are a military family so we typically move every two or three years. My vault weighs about 900 pounds but the movers never have any trouble with it. In fact, the guy that installed it was an old man driving a pick up truck. He used an amazing motorized dolly that had no problem pushing it around and could climb stairs.
- deleted 9y ago[deleted]
- nathancahill 9y ago> cannot be carted away > old man driving a pick up truck literally carted it away hmm emoji.
- chrissnell 9y agoMy vault is bolted 4" into reinforced concrete using bolts that are only accessible from inside the vault. Unless you have the combination to open the vault first, you're going to have to rip out the slab to get this thing out of my garage. http://ftknox.com/wp-content/uploads/2013/09/ANCHOR-LAYOUT-DD-rev-04-28-11.pdf http://ftknox.com/wp-content/uploads/2013/09/ANCHOR-LAYOUT-D...
- IncRnd 9y agoThat safe is a pretty strong lynchpin. Nice.
- Tharre 9y agoHow do you check that your printer isn't secretly storing your key somewhere? I've looked for open source/open hardware printers some time ago, unsuccessfully. I've written my main key down on paper by hand as a backup, but it's a tedious task. As you mentioned fire-resistance, do you also use some sort of fire resistant paper? Because I don't think anything in made of paper would survive an actual fire.
- dom0 9y ago> I've looked for open source/open hardware printers some time ago You want a pen plotter. Or its cheaper, more expensive cousin, the Axidraw. > As you mentioned fire-resistance, do you also use some sort of fire resistant paper? Because I don't think anything in made of paper would survive an actual fire. Actually there are document safes with built-in insulation which will keep regular paper documents safe for time X under fire conditions Y (it's some EU standard classification). Certain ways of mounting safes makes them intrinsically fire-safe(r) as well.
- graedus 9y ago> cheaper, more expensive Huh. It's cheaper (worse quality) but costs more money?
- cuckcuckspruce 9y agoI took it as cheaper to purchase, more expensive to operate.
- xelxebar 9y agoI was confused too, so looked up the prices. The pen plotter seems to be in the neighborhood of $225 USD [1] while the AxiDraw is $475 USD [2]. [1] https://www.amazon.com/pen-plotter/s?ie=UTF8&page=1&rh=i%3Aaps%2Ck%3Apen%20plotter https://www.amazon.com/pen-plotter/s?ie=UTF8&page=1&rh=i%3Aa... [2] https://shop.evilmadscientist.com/productsmenu/846 https://shop.evilmadscientist.com/productsmenu/846
- dom0 9y ago
- sillysaurus3 9y agoI didn't expect to see "Strategies for PGP key storage" to include "Store them in my $16k vault." It'd be amusing if someone stole your vault, but left its contents.
- jvz 9y agoDo you encrypt your keys before exporting? How do you ensure you'll remember the passphrase, if so?
- xelxebar 9y agoAt least with gpg2 exported private keys are encrypted by default. In fact, $ gpg2 --export-private-keys won't even ask you for a password because of this.
- subleq 9y agoWhat's the point of storing data inside a combination safe? Isn't that equivalent to encrypting the data with the combination to the safe and storing it wherever?
- icebraining 9y agoNo, because if someone found the paper, they could easily copy it (take a photo) and then take their time to "attack" it in a safe space.
- ransom1538 9y agoFor your PEM formatted keys, why a vault? Don't vaults just advertise "what is in here is SUPER important"? Police love vaults. Wouldn't it be safer on a sd hiding case in a few places (mom's house in attic, one under your oven?) https://www.amazon.com/US-Mint-Quarter-Covert-Compartment/dp/B0036VJHXG https://www.amazon.com/US-Mint-Quarter-Covert-Compartment/dp...
- chrissnell 9y agoI should have explained this better: the vault is not to keep the private key safe from home intruders, it’s to keep the key safe from loss and fire and anyone that might compromise my CA machine. It acts as an air gap of sorts. Once in a blue moon when the intermediate cert expires, I pull out the QR code and scan it and convert it to a PEM on a burner laptop, VM, or phone. There I generate a new intermediate and securely delete the root PEM file and put the QR back in the vault. Then I copy the inermediate off the burner machine and go about my business.
- jopsen 9y agoGlue the QR code onto an old boarding pass and keep it in your photo album... then stick a broken yubikey into your grandmothers coffin for plausible deniability. - the latter is a joke ofcourse! :) For plausible deniability it's a lot less controversial to mix a broken yubikey in concrete and cast it as pavement.
- watersb 9y agoYubiKeys are hard to break without obvious tampering. Better use an unbroken one. :-)
- j7ake 9y agoI have tried printing QR code of keys but with no success (the phone does not recognise the image) what do you use to generate the image that is sufficiently resolved to print and be functional ?