I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I copy the privatekey to my phone, laptop, etc? The main Problem that annoys me is all the different Passphrases that I would then write into a Password manager anyways...

  • It would be better to have a private key per device, and multiple public keys on the server. If one key gets compromised, remove that public key from the server and you can keep using the other keys. Of course it's good practice to protect keys with a passphrase, but you don't have to if you don't want to. – Securist Nov 16 '18 at 12:33

You should have a different private key for each device. Here's the reason that i can think of :

  • This keys are for authentication so if you share them, you won't be able to discrimate the different users/devices connecting to your server. Should a problem happens you'll probably want to know the device involved.

  • The security of Public key authentication is based on the secret of private keys. The more a secret is duplicated the more difficult it is to keep it secret.

  • If you have a security breach on one device (or the device is stolen), it won't compromise the security of the other devices and you'll have the opportunity to ban this specific device.

Security often comes with a cost. Money, time, skills, comfort of use. If the cost of having multiple passphrases is to high, you could use a password manager to store and remind them.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.