3 ms·

Used in such a way, the entirety of Github's SSH connections would be bottlenecked by this HSM. It wouldn't scale and it would be a single point of failure. As

Used in such a way, the entirety of Github's SSH connections would be bottlenecked by this HSM. It wouldn't scale and it would be a single point of failure. As lrvick points out, you'd have to use a certificate-based host key scheme like PKCS#11 to make this scalable. That's fine, but it is a different scheme than RSA host key identification.

lrvick 4y ago
I gave two options but they are separate. PKCS#11 is a protocol for talking to hardware security modules for generic cryptographic operations to keep a key out of system memory. You can totally take a single host key scheme and use HSMs or TEEs at scale. Openssh supports using openssl as a backend which in turn can use the PKCS#11 protocol to delegate private key operations to remote enclaves or TEEs. Nothing stops you from loading your key into a fleet of them and scaling horizontally just like you scale anything else.
- CGamesPlay 4y ago
  > Nothing stops you from loading your key into a fleet of them and scaling horizontally just like you scale anything else. Isn't having one key the root of the problem? If you've got one key, it has to be transferred to each HSM module, which means it's going to be in their deploy code. My understanding is that the safe way to scale PKI is to have an HSM generate a key internally, and have that key be signed by a CA in a different HSM, so private key material never leaves any HSM. I guess you're saying that SSH RSA host keys support this, but I'm only familiar with doing it using looks up correct terminology X.509 certificates like for HTTPS.
  - arianvanp 4y ago
    HSMs can key-wrap a key. E.g. Foo can encrypt the key X with Bars public key and then Bar can import key X.
  - fireflash38 4y ago
    > If you've got one key, it has to be transferred to each HSM module, which means it's going to be in their deploy code There's products out there that allow for keys to be securely shared amongst multiple HSMs, without the key ever existing in clear text outside the HSM.
fireflash38 4y ago
Most HSMs have modes that allow for load to be distributed amongst multiple HSMs.

lrvick 4y ago

I gave two options but they are separate. PKCS#11 is a protocol for talking to hardware security modules for generic cryptographic operations to keep a key out of system memory. You can totally take a single host key scheme and use HSMs or TEEs at scale. Openssh supports using openssl as a backend which in turn can use the PKCS#11 protocol to delegate private key operations to remote enclaves or TEEs. Nothing stops you from loading your key into a fleet of them and scaling horizontally just like you scale anything else.

CGamesPlay 4y ago
> Nothing stops you from loading your key into a fleet of them and scaling horizontally just like you scale anything else. Isn't having one key the root of the problem? If you've got one key, it has to be transferred to each HSM module, which means it's going to be in their deploy code. My understanding is that the safe way to scale PKI is to have an HSM generate a key internally, and have that key be signed by a CA in a different HSM, so private key material never leaves any HSM. I guess you're saying that SSH RSA host keys support this, but I'm only familiar with doing it using looks up correct terminology X.509 certificates like for HTTPS.
- arianvanp 4y ago
  HSMs can key-wrap a key. E.g. Foo can encrypt the key X with Bars public key and then Bar can import key X.
- fireflash38 4y ago
  > If you've got one key, it has to be transferred to each HSM module, which means it's going to be in their deploy code There's products out there that allow for keys to be securely shared amongst multiple HSMs, without the key ever existing in clear text outside the HSM.

fireflash38 4y ago

Most HSMs have modes that allow for load to be distributed amongst multiple HSMs.