5 ms·

What percentage of ssh keys are encrypted, do you estimate or wager? I can't imagine that they haven't built factoring hardware but I agree that scale is a pr

What percentage of ssh keys are encrypted, do you estimate or wager? I can't imagine that they haven't built factoring hardware but I agree that scale is a problem. I also can't imagine that they need to use factoring hardware if say 80% (I'm just guessing, could be much higher) of the ssh private keys are just chillin' on disks unencrypted, there has to be tons of other exploits to get those.

tedunangst 12y ago
Server keys? Probably closer to 99.999% are just chillin' on disk. Client keys? How many people use github, but don't want to enter a password on every push and aren't hardcore about setting up agents (esp. on Windows)?
- ansible 12y ago
  Client keys? How many people use github, but don't want to enter a password on every push and aren't hardcore about setting up agents (esp. on Windows)? I encourage everyone to use encrypted keys on all platforms. You can set up the regular ssh-agent in git bash, and Atlassian's Source Tree can also use encrypted keys.
  - heinrich5991 12y ago
    What does that help? Doesn't the ssh-agent keep the keys in memory too?
  - kryptiskt 12y ago
    I don't see the point of encrypted keys, if my computer is compromised it is a trivial matter for an attacker to log input and get the password. If the computer is stolen, the disk encryption should be enough.
    - deleted 12y ago
      [deleted]
    - vacri 12y ago
      There are many ways to compromise a computer without installing something and having the user later provide input. Easiest example is a lost or stolen laptop - if it's not encrypted, you can get the contents of the disk, but the user isn't going to be around to provide more input.
    - vacri 12y ago
      There are many ways to compromise a computer without installing something and having the user later provide input. Easiest example is a lost or stolen laptop - if it's not encrypted, you can get the contents of the disk, but the user isn't going to be around to provide more input.
- jamiesonbecker 12y ago
  Client keys: chk out Userify :) (shameless plug follows) You keep your private key private client-side. (use an agent or not). Userify deploys user/sudo/key to your project servers. </plug>
  - akerl_ 12y ago
    Maybe I'm missing something, but under what scenario would I not be keeping my private key private and client-side? That being the whole point of it.
    - jamiesonbecker 12y ago
      Most key "management" systems like to hold onto your private key for you and provision your connection for you. That's insane and defeats the whole point (as you point out)!! As far as server-side, automation keys are often 'server' side (where the server is itself a client). Userify can manage and deploy those keys as well, but it's not super easy (yet) -- currently, you still have to 'invite' a (fake) user, create a new user account (company_backup_account or whatever), and then choose all the servers that you want that public key deployed to. That part could definitely be easier.. and soon will be.
- snowwrestler 12y ago
  On a Mac, you can store the key password in Keychain. The key is still protected but you don't need to enter the password on every push. Just create the key and then try to use it. An OS X password dialog window will pop up. Enter the key password and check the box to save it. Done.
- Florin_Andrei 12y ago
  Take a look at the YubiKey NEO. https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo... It's basically a smartcard in the form factor of a nano-USB-stick. You can generate a pair of public/private SSH keys, with the private key remaining forever on the token. Then setup gpg-agent in ssh-agent emulation mode (it's three lines in a file) and voila! you have hardware-backed authentication. I'll probably write a HOWTO soon, but until then have a look at this: http://forum.yubico.com/viewtopic.php?f=26&t=1171 http://forum.yubico.com/viewtopic.php?f=26&t=1171 It's unnecessarily complicated as described in the top post, but read the comments below, too. The real setup is dead simple - just a few lines in gpg-agent.conf and one of the .*profile files.
  - jamoes 12y ago
    Does using the Yubikey in this manner protect your keys even if your machine has malware on it? I read through this tutorial [1], and they say you need read/write access to the device, so it seems to me like malware could access your keys while the smartcard is plugged in. If this is the case, I'm not sure how this setup is any more secure than simply keeping your keys on a USB flash drive and plugging it in whenever you need to use ssh. [1] https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO
    - Florin_Andrei 12y ago
      The private SSH key never leaves the smartcard, not even during authentication. It is not exposed to the OS or any process, at all. You can't extract it at all (maybe the NSA can, who knows). The actual authentication takes place on the token, not in a process on your Unix system. The only thing that the malware can do is issue an authentication request while the token is plugged in. That's all. If the PIN is not cached, you'll be prompted to enter it, and you'll be like "why is it asking me to enter the PIN?" Maybe they could run a spy debugger on gpg-agent, but again, this would not give them your private key.
      - jamoes 12y ago

tedunangst 12y ago

Server keys? Probably closer to 99.999% are just chillin' on disk. Client keys? How many people use github, but don't want to enter a password on every push and aren't hardcore about setting up agents (esp. on Windows)?

ansible 12y ago
Client keys? How many people use github, but don't want to enter a password on every push and aren't hardcore about setting up agents (esp. on Windows)? I encourage everyone to use encrypted keys on all platforms. You can set up the regular ssh-agent in git bash, and Atlassian's Source Tree can also use encrypted keys.
- heinrich5991 12y ago
  What does that help? Doesn't the ssh-agent keep the keys in memory too?
- kryptiskt 12y ago
  I don't see the point of encrypted keys, if my computer is compromised it is a trivial matter for an attacker to log input and get the password. If the computer is stolen, the disk encryption should be enough.
  - deleted 12y ago
    [deleted]
  - vacri 12y ago
    There are many ways to compromise a computer without installing something and having the user later provide input. Easiest example is a lost or stolen laptop - if it's not encrypted, you can get the contents of the disk, but the user isn't going to be around to provide more input.
  - vacri 12y ago
    There are many ways to compromise a computer without installing something and having the user later provide input. Easiest example is a lost or stolen laptop - if it's not encrypted, you can get the contents of the disk, but the user isn't going to be around to provide more input.
jamiesonbecker 12y ago
Client keys: chk out Userify :) (shameless plug follows) You keep your private key private client-side. (use an agent or not). Userify deploys user/sudo/key to your project servers. </plug>
- akerl_ 12y ago
  Maybe I'm missing something, but under what scenario would I not be keeping my private key private and client-side? That being the whole point of it.
  - jamiesonbecker 12y ago
    Most key "management" systems like to hold onto your private key for you and provision your connection for you. That's insane and defeats the whole point (as you point out)!! As far as server-side, automation keys are often 'server' side (where the server is itself a client). Userify can manage and deploy those keys as well, but it's not super easy (yet) -- currently, you still have to 'invite' a (fake) user, create a new user account (company_backup_account or whatever), and then choose all the servers that you want that public key deployed to. That part could definitely be easier.. and soon will be.
snowwrestler 12y ago
On a Mac, you can store the key password in Keychain. The key is still protected but you don't need to enter the password on every push. Just create the key and then try to use it. An OS X password dialog window will pop up. Enter the key password and check the box to save it. Done.
Florin_Andrei 12y ago
Take a look at the YubiKey NEO. https://www.yubico.com/products/yubikey-hardware/yubikey-neo/ https://www.yubico.com/products/yubikey-hardware/yubikey-neo... It's basically a smartcard in the form factor of a nano-USB-stick. You can generate a pair of public/private SSH keys, with the private key remaining forever on the token. Then setup gpg-agent in ssh-agent emulation mode (it's three lines in a file) and voila! you have hardware-backed authentication. I'll probably write a HOWTO soon, but until then have a look at this: http://forum.yubico.com/viewtopic.php?f=26&t=1171 http://forum.yubico.com/viewtopic.php?f=26&t=1171 It's unnecessarily complicated as described in the top post, but read the comments below, too. The real setup is dead simple - just a few lines in gpg-agent.conf and one of the .*profile files.
- jamoes 12y ago
  Does using the Yubikey in this manner protect your keys even if your machine has malware on it? I read through this tutorial [1], and they say you need read/write access to the device, so it seems to me like malware could access your keys while the smartcard is plugged in. If this is the case, I'm not sure how this setup is any more secure than simply keeping your keys on a USB flash drive and plugging it in whenever you need to use ssh. [1] https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO https://blog.habets.se/2013/02/GPG-and-SSH-with-Yubikey-NEO
  - Florin_Andrei 12y ago
    The private SSH key never leaves the smartcard, not even during authentication. It is not exposed to the OS or any process, at all. You can't extract it at all (maybe the NSA can, who knows). The actual authentication takes place on the token, not in a process on your Unix system. The only thing that the malware can do is issue an authentication request while the token is plugged in. That's all. If the PIN is not cached, you'll be prompted to enter it, and you'll be like "why is it asking me to enter the PIN?" Maybe they could run a spy debugger on gpg-agent, but again, this would not give them your private key.
    - jamoes 12y ago