3 ms·

The signing key for Firefox stored on a single hardware yubikey available to a single person?

by anon7000 2mo ago

computerfriend 2mo ago
Multiple hardware devices can have the same key.
- _bernd 2mo ago
  Yes but then you have to take extra care of this one special system which generates the key on this local system and which transfers the key material to the HSM. Sure it's a valid use case but depending on your requirements this could be a no go. But sharing key files with developers comes also with a price tag.
pamcake 2mo ago
Could be multiple individuals, each with a different key. https://eprint.iacr.org/2020/540 https://eprint.iacr.org/2020/540 https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing
- kevincox 2mo ago
  SSS doesn't support signing AFAIK. When I last looked into it GPG/PGP doesn't support shared signing. You can use SSS to encrypt the signing key, but then you need to fully materialize the signing key to actually sign the release. Which makes the exact situation that occurred here possible. The only way to do multi-signer PGP is outside of the PGP protocol, you just need to sign the artifact multiple times then have the verifier assert that a sufficient number of signatures are present. But again, this isn't supported by the regular PGP tools.
  - pamcake 2mo ago
    You are right that SSS requires temporarily rematerializing the raw key at the moment of signing. Even so it would be a huge improvement: > Which makes the exact situation that occurred here possible. Not so. The situation here was operator errror and someone mistakenly committing signing key in cleartext to repo. So this exact situation would not be possible. They could also have a process of signing on a dedicated instance (possibly with its own shard) which would remove key exposure completely from operator machines. This is all achivable with existing tooling and without changing implementations on verifier side. The first link shows how an actual threshold signature scheme for PGP could be constructed.

The signing key for Firefox stored on a single hardware yubikey available to a single person?

computerfriend 2mo ago

Multiple hardware devices can have the same key.

_bernd 2mo ago
Yes but then you have to take extra care of this one special system which generates the key on this local system and which transfers the key material to the HSM. Sure it's a valid use case but depending on your requirements this could be a no go. But sharing key files with developers comes also with a price tag.

pamcake 2mo ago

Could be multiple individuals, each with a different key. https://eprint.iacr.org/2020/540 https://eprint.iacr.org/2020/540 https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

kevincox 2mo ago
SSS doesn't support signing AFAIK. When I last looked into it GPG/PGP doesn't support shared signing. You can use SSS to encrypt the signing key, but then you need to fully materialize the signing key to actually sign the release. Which makes the exact situation that occurred here possible. The only way to do multi-signer PGP is outside of the PGP protocol, you just need to sign the artifact multiple times then have the verifier assert that a sufficient number of signatures are present. But again, this isn't supported by the regular PGP tools.
- pamcake 2mo ago
  You are right that SSS requires temporarily rematerializing the raw key at the moment of signing. Even so it would be a huge improvement: > Which makes the exact situation that occurred here possible. Not so. The situation here was operator errror and someone mistakenly committing signing key in cleartext to repo. So this exact situation would not be possible. They could also have a process of signing on a dedicated instance (possibly with its own shard) which would remove key exposure completely from operator machines. This is all achivable with existing tooling and without changing implementations on verifier side. The first link shows how an actual threshold signature scheme for PGP could be constructed.