3 ms·

"Exposes" is a strong word. Public keys are meant to be public. The only reason you might think twice about handing them over is they can de-anonymize you if yo

"Exposes" is a strong word. Public keys are meant to be public. The only reason you might think twice about handing them over is they can de-anonymize you if you were practising identity hygiene. Having a public register of public keys makes it easy to give people access to your organization, CI/CD etc.

cryptonector 4y ago
Public keys are not meant to be public. They can be public in that making them public doesn't compromise the corresponding private keys. And generally making them public helps scale key management. There are cryptographic protocols where public keys are kept private. For example TLS with client certificates (the client's certificate gets sent encrypted to the server). Ditto SSHv2 (the client need not reveal all its public keys, and it does get to authenticate the server before revealing its identity and public keys).
- enasterosophes 4y ago
  You're right, but my intention was to tackle unfounded nervousness, not to draft a technical document explaining all the ins and outs of keypair cryptography.
- Reitet00 4y ago
  > For example TLS with client certificates (the client's certificate gets sent encrypted to the server). Hmm... I was under the impression that up until TLS 1.3 the client cert was sent in the clear during session negotiation...
  - cryptonector 4y ago
    Yes, you're right, in 1.3 it goes encrypted, while in <1.3 it goes in the clear.
Galanwe 4y ago
> "Exposes" is a strong word. Public keys are meant to be public That's a very strong overstatement. With this argument, you could argue that data leaks involving names, emails, etc are fine, because emails and names are meant to be public.
- danw1979 4y ago
  Public keys are not PII though, unlike your real name.
  - kevincox 4y ago
    They can be once they are linked to your GitHub account which may have your real name.
FatActor 4y ago
Well, yeah, but I just got a chill realizing if I'm just dinking around trying to ssh into a random addresses that I'll be sending my public keys for auth which can be correlated. Not a big deal, but I forgot about that leak, so "expose" made me read further and be reminded that clearly I am not a blackhat, or any color hat for that matter.

cryptonector 4y ago

Public keys are not meant to be public. They can be public in that making them public doesn't compromise the corresponding private keys. And generally making them public helps scale key management. There are cryptographic protocols where public keys are kept private. For example TLS with client certificates (the client's certificate gets sent encrypted to the server). Ditto SSHv2 (the client need not reveal all its public keys, and it does get to authenticate the server before revealing its identity and public keys).

enasterosophes 4y ago
You're right, but my intention was to tackle unfounded nervousness, not to draft a technical document explaining all the ins and outs of keypair cryptography.
Reitet00 4y ago
> For example TLS with client certificates (the client's certificate gets sent encrypted to the server). Hmm... I was under the impression that up until TLS 1.3 the client cert was sent in the clear during session negotiation...
- cryptonector 4y ago
  Yes, you're right, in 1.3 it goes encrypted, while in <1.3 it goes in the clear.

Galanwe 4y ago

> "Exposes" is a strong word. Public keys are meant to be public That's a very strong overstatement. With this argument, you could argue that data leaks involving names, emails, etc are fine, because emails and names are meant to be public.

danw1979 4y ago
Public keys are not PII though, unlike your real name.
- kevincox 4y ago
  They can be once they are linked to your GitHub account which may have your real name.

FatActor 4y ago

Well, yeah, but I just got a chill realizing if I'm just dinking around trying to ssh into a random addresses that I'll be sending my public keys for auth which can be correlated. Not a big deal, but I forgot about that leak, so "expose" made me read further and be reminded that clearly I am not a blackhat, or any color hat for that matter.