Timeline for Is it bad practice to reuse a private key password across multiple keys?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 2 at 21:54 | comment | added | security_paranoid | @Ja1024 yeah I understand what you’re saying now… it does seem like using the same passphrase for multiple keys would be a bit redundant in the sense that at that point you might as well just share the key pair across the services itself with a passphrase, as you said. | |
| Dec 2 at 20:53 | comment | added | Ja1024 | I think you should either have a single key pair with a passphrase, or multiple key pairs with different passphrases (or stored on different tokens). Having multiple keys but the same passphrase seems like an odd choice that barely increases security (if at all). | |
| Dec 2 at 20:35 | comment | added | security_paranoid | @Ja1024 When you said it makes more sense to use the same key pair more multiple purposes, I thought you meant without a passphrase. So do you mean different keys with the same passphrase? Actually, that does make more much more sense… seeing as the passphrase is only meant to stay “in your head.” | |
| Dec 2 at 20:26 | comment | added | Ja1024 | If you want to actually separate services like SSH, TLS etc. (which makes perfect sense), then you need different passphrases. Or even better: different hardware tokens. | |
| Dec 2 at 20:24 | comment | added | Ja1024 | What kind of attack would allow the attacker to get a decrypted private key but not the corresponding passphrase? Because that's the only case where it would make sense to have different key pairs with the same passphrase. Otherwise, you might as well have a single key. | |
| Dec 2 at 20:05 | comment | added | security_paranoid | @Ja1024 because if the key pair is compromised, say, during authentication or while decrypted on disk, then you wouldn’t want it to have multiple uses where is can be compromised multiple times. | |
| Dec 2 at 16:50 | answer | added | Serge Ballesta | timeline score: 1 | |
| Dec 2 at 12:04 | comment | added | Ja1024 | Why have multiple key pairs in the first place when you don't actually separate them through different passphrases? In this case, it makes more sense to use the same key pair for multiple purposes (e.g., SSH authentication and TLS client authentication). | |
| Dec 2 at 10:18 | answer | added | Gh0stFish | timeline score: 1 | |
| Dec 2 at 9:37 | history | asked | security_paranoid | CC BY-SA 4.0 |