4 ms·
I'm not sure if I understand the reasoning here. The article says a 1024-bit RSA key is considered unsafe, but still says you should "probably want to upgrade"
by Etheryte 5y ago
I'm not sure if I understand the reasoning here. The article says a 1024-bit RSA key is considered unsafe, but still says you should "probably want to upgrade" if you're on a 2048-bit key. Why would that be the case? The given arguments, key size, speed etc, are complete non-arguments to me as compared to going through my keys and updating them everywhere where necessary.
- latch 5y agoCreate new keys and start using them for any new setup you do. If you want to do a bit more, setup the newly created keys in the 1 or 2 most critical places.
- chasil 5y agoRegular key rotation is a best practice that improves security. Even if the underlying ciphers have not changed, the value of a stolen key will decay when there is a planned sunset. In the lack of a rotation strategy, a stolen key is a gift that keeps on giving. OpenBSD introduced the signify command, and a 6-month key rotation, that will allow trust when the OS is downloaded over insecure channels (cleartext FTP and http). https://www.openbsd.org/papers/bsdcan-signify.html https://www.openbsd.org/papers/bsdcan-signify.html Debian is migrating to the conceptually-similar aptsign. https://blog.jak-linux.org/2021/06/20/migrating-away-apt-key/ https://blog.jak-linux.org/2021/06/20/migrating-away-apt-key...