6 ms·
Root keys are more of a pain to swap out, but AD does a pretty good job of handling the grunt work of distributing them across the organization. And the leaf ke
by excalibur 8y ago
Root keys are more of a pain to swap out, but AD does a pretty good job of handling the grunt work of distributing them across the organization. And the leaf keys should live on HSMs as well. You might be able to get by with a hardcoded root key if you're willing to accept the tradeoff, but that situation isn't going to work for the rest.
- lclarkmichalek 8y agoAD and similar things def help, but it's still hard, especially once your deployment gets big or complicated - at the last place I worked we had tons of linux hosts + google cloud load balancers + aws load balancers + a tiny AD domain + various others. I think once you hit a certain size, it's incredibly hard to keep homogeneity. Leaf keys on HSMs is interesting. Personally, I view HSM and TPM stored keys about having an immutable identity for the device. Leaf keys are usually a bit more complicated - in the environments I work in, leaf keys are often tied to a service, not the host. The short lived nature also reduces the impact of ex-filtration. Anyway, yeah, depends on the deployment and the org.