We are doing a proof of concept project for a client to introduce smart card authentication for his operations admins. Authentication in client's context means mainly SSH access. We encountered a problematic usage scenario: Admins often issue bulk commands against many hundreds of remote machines. This took previously insignificant amount of time, but takes tens of minutes with smart card.

I have run a few basic benchmarks and found out that smart card based cryptographic operation indeed takes hundred times more than for example openssl with on-disk keys. What takes openssl often less than a milisecond on average, smart card does rarely in less than 0.5 second. It still seems fast, but multiplied by hundreds it becomes a major part of the observed delay (together with other smart card/driver induced slow downs). I searched what speed is usual in smart cards or if there are other personal hardware cryptography modules designed for speed, but it seems to me that for personal usage the speed of 2048 bit RSA based algorithms is never less than several hundreds of miliseconds.

What is the good architecture for large scale hardware token usage? We can setup a key distribution server for short lived keys which could be added to ssh agent, so that only authentication to such server would be secured by smart card and other connection would be secured by provided software key, but I consider it the least attractive possibility.


I know a similar use case:

  • admins are required to use a token based authentication (HOTP) to access servers in a data center -> means manually typing a sequence of digits
  • commands can have to be replicated on hundreds of machines

The solution was to setup one single hop machine where the admins authenticate themselves. Then from that machine they are allowed to administer all other machines in same security zone of the data center without any further authentication. That way the authentication complexity in not a problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.