3 ms·
That's fine for orderly transitions, but if you're worried that your private host keys have been compromised then (a) you can't trust any new transitions and (b
by mjg59 4y ago
That's fine for orderly transitions, but if you're worried that your private host keys have been compromised then (a) you can't trust any new transitions and (b) if the new private keys are already on the systems then have they also been compromised?
- tialaramex 4y agoHowever, we don't need to have the new private keys in order to tell people about the new public keys using our old private keys. If a valid emergency private key lives in the safe, realistic bad guys (who don't do black bag jobs, they just read bug lists and act quickly) can't have that key until you put it into use. So you could have a situation where say, you schedule key replacement every 12 months, you always immediately generate and announce the next key, but it lives in the safe until the rotation happens or something goes wrong and you use it immediately.
- firstlink 4y agoThe automatic transition would not cause additional harm in the compromise scenario and would in fact marginally help. A client which has not got an out-of-band revocation/update of the host key is subject to complete mitm'ing and impersonation either way: tricking it into accepting a new fraudulent host key doesn't actually make this scenario worse, it only means the first attacker locks out his competition :). (An out-of-band key update still fixes the client.) OTOH, if the client happens to connect to the authentic host first, then it is saved. So, no net harm, marginal net benefit.