I have been wondering what are the benefits and cons of using an OTP (one time password) versus a keyfile to, for example, decrypt a keepass database, connect to a server via SSH, or other uses.
Edit: Also.. which would be more secure?
2 Answers
A keyfile is an element of a PKI. I mean it is heavy to manage and is intended to be used for a long time period and and be deployed on a large infrastructure whereas an OTP, by definition, is useful for one session only and it is somehow a lightweight but robust solution for simple lightweight applications because as soon as someone finds your OTP it is no longer useful for him/her.
You are writing "keypass" but tagged your question "keepass". Hm, so are you talking of a password safe? Or are you talking of an SSH key to login to an ssh server?
The ssh pubkey mechanism usually stores your private key in a file protected by a passphrase. This file could be copied and stolen and brute forced. This second factor (the ssh key file) can be copied and thus is not a unique second factor. Ideally the OTP token is a hardware device that can not easily be copied and thus is a "unique" second factor.
For OTP authentication you always need an authentication backend. If this backend is down or not available, you can not authenticate. On the other hand it is good, that you need an authentication backend, since you can manage all the OTP tokens.
SSH keys do not need a managemment. But then they are hard to manage! ;-)
So if you have many users or many machines to authenticate to, you should consider a manageable solution. Which usually comes with OTP and not ssh keys. If you are only one user with a few machines, you could also got with ssh keys. You also might take a loot at privacyIDEA, which originally is a authentication and management system for OTP authenticators of any kind but also can manage SSH keys since 1.2.
