5

How does one evaluate the risk of storing a private key (secret) on services like the AWS elastic load balancer, or for the purpose of my question: any service non-self managed service that could benefit from SSL ?

In security, I consider "my identity" a key aspect. We have Certificate Signing Request to address this problem on the generation part of the pipeline but it's up to me to manage the rest of the pipeline.

My current ideas:

  • I know that I still have to believe that the authority chain is not compromised (vs PGP/distributed processes).
  • I still have to believe that the physical access to my servers in the data center is not compromised
  • They are asking me to create yet another vector of attack. My problem is that the aws services are certainly a target of interest to many attackers. If there is no current problem, there will be, sometime in the future. And they have their own sysadmins, helpdesk, etc that, may or may not, have have access to the keys.
  • I do not do it. I store my private keys on my own servers. Traffic is routed and handled at my servers.
  • If I had to do it, I would reduce attack time windows by refreshing those keys periodically (I have yet to analyse the consequences of this approach)

Am I being to paranoid or is security being (once more) neglected ?

(I feel that having SSL is a trend but the security of the thing isn't taken seriously anymore)

  • I'm finding it hard to pick out where the setup / scenario ends, and your actual question begins. Could you maybe bold the actual question that you'd like answered? – Mike Ounsworth Nov 15 '17 at 19:35
  • My issue is: I don't want do let aws elb to know my private key (even if I know that I have other issues that I'm not addressing). If I have to do it, I want to evaluate the risk – Gil Brandao Nov 16 '17 at 12:02
  • @Aron - we do not change US to UK spelling or vice-versa. We leave it how the OP originally wrote it. – Rory Alsop Sep 13 '18 at 7:39
1

Is HSM an option?

  • CloudHSM: AWS will try to sell you "CloudHSM" for this: https://aws.amazon.com/cloudhsm/ -- I think you pretty much have to take their word (legally enforceable contract or something) for it when they say that it's an actually HSM on real hardware with no back door.

  • Keyless SSL: CloudFlare offers something called "Keyless SSL" where you host the HSM in house. https://www.cloudflare.com/ssl/keyless-ssl/

I know that I still have to believe that the authority chain is not compromised (vs PGP/distributed processes).

If your server box is taken over (either by physical access or otherwise) then the hackers also have your SSL private keys. Unless they are in a Hardware Security Module (HSM). From which they are hard/impossible to extract. (Even with physical access, a large budget and lots of time.)

  • By "authority chain" I think the OP means trusting the CA that issued the cert to not also issue fraudulent certs for your domain. An HSM doesn't solve that problem. – Mike Ounsworth Nov 15 '17 at 21:12
  • @ Mike: Thanks. Maybe. Dunno. @GilBrandao : Could you help me understand what you mean? – StackzOfZtuff Nov 16 '17 at 7:32
  • CloudHSM may be an interesting solution. It is not a perfect solution since it has to be integrated with the SAAS software, but is a start. I wasn't aware of this product – Gil Brandao Nov 16 '17 at 12:06
  • @GilBrandao: I see. What about the "authority chain" bit. What did you mean by that? – StackzOfZtuff Nov 16 '17 at 14:25
  • SSL is a centralized process. AFAIK, I have to trust that the issuer (or anyone in the certificate chain) won't leak his keys, neither creates a certificate for my domain and deliver it to some rogue actor. If it does, the rogue actor may steal my identity and my clients deliver their data to them and not me. Yet, the security of the client machine is also important (but is not my responsibility ;) Yet this is an elaborate attack. Security is a process and the risks must be evaluated some how – Gil Brandao Nov 16 '17 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.