Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We're trying to create a secure communication channel for our company security team, and having a public displayed PGP public key on our website is a nice to have (as Apple and AWS do). The problem is, the key will need to be shared with the entire team.
Considering key management issues, what is the right way to "share" a PGP private key with the whole team? How do Apple, AWS and some other companies do it?
Strictly speaking, you don't. A single PGP key goes to a single address/identity.
In practice, you will need some form of re-encrypt process.
A mailing list daemon could monitor the incoming mailbox for "securityTeam@foo.com" and it has access to the private key for that address, as well as access to a keyring of public keys for the members of the list.
When a pgp encrypted email comes in, the daemon would decrypt the message, then re-encrypt it to each public key in it's keyring, and dispatch copies of the message to each member of the list.
This also has the advantage of disconnecting list membership from the public facing, single PGP key.
For example: If people are added to, or leave the team who should have access, just remove or add their public keys to/from the daemon's keyring. One member's key gets compromised somehow, just replace that one. You have to change the public facing key, just change that, and all members keep their own.
Any sort of literally "shared" solution has problems if one or more of the above examples come up.
Someone in the security team will still have to be responsible for the DevOps maintenance of this email daemon, of course.
PGP Private keys are NEVER shared with anyone because it will help anyone to decrypt the messages that are encrypted using your public key.
Suppose you and me are talking something secret over a public network. I will use your Public PGP key to encrypt the data and send it to you over the network but in order to decrypt the email, you would have to use your Private key to decrypt the email.
But If I was you and wanted a PGP key pair for whole of the team, I would first ask the each member of the team to send me their public keys and then I would use those public keys to encrypt the private key that is meant to be shared with the team and email the encrypted stuff. In this case no one apart from the required team members will be able to see the actual private key.
Hope you understood what I meant.
At my company we do share the PGP key between the two of us that monitor the inbox (there are other members of the team that do not have the key). We only get a 2-3 security issues reported a month so don't need anything more sophisticated. The decrypted message is then forwarded on to the appropriate people.
As someone stated above, the key is tied to an identity and in this case the identity is the company's vulnerability management team.
The responses above seem to have only considered receiving email, you also have to consider sending email as well as you generally need to have confidential conversations with the finder.
