3

When keeping OpenPGP keys for daily use on a smartcard (a Yubikey, say), what are, from a security point of view, the advantages of keeping the master key offline as compared to simply keeping the master key pair on the card? (Of course, just like in the case of using subkeys, redundant encrypted offline backups of the master key exist.)

I understand that subkeys may be revoked separately from the master key, but I fail to see a realistic threat model where this capability would matter. Here are the two most relevant threat scenarios that I can come up with where there would be a difference:

(1) An adversary gains access to a computer where the smarcard is used and manages to read out the private master key by exploiting a weakness or backdoor in the smartcard. Or, if readout is impossible, the adversary may create a revocation certificate or certify other keys.

(2) Same as (1), but the smartcard gets lost or stolen.

Frankly, I do not consider (1) or (2) relevant for someone like, say, a free software developer who is not directly targeted by powerful adversaries like state security agencies who may have the necessary knowledge and resources to defeat the smartcard. And someone who is individually targeted by powerful adversaries needs to also take care of other glaring security problems (like living in a place that is not guarded 100% of the time).

Personally, I feel reasonably secure keeping my master key on the encrypted Debian laptop that I use for daily work and that no one else has physical access to. (This approach is sometimes called trusted physical console.) The reason I'm interested in smartcards now is that I would like to use the key also on other computers to which third parties may theoretically have access.

Am I overlooking any real-world advantages of not keeping the master key on the daily-use smartcard? Have any attacks become known where the additional security of keeping the master key offline mattered?

On the other hand, one could argue that since one needs to keep offline backups of all the keys anyway, one may just as well use dedicated subkeys for daily work, since the amount of additional hassle does not seem to be particularly high.

2 Answers 2

2

I'm not a cryptographic expert but here is my point of view.

Both methods you talk about are storing the keys offline. Secrets stored in smart cards cannot be read. The goal of a smart card is to keep the private key out of the computer. You can communicate with your smart card to do cryptographic operation but you can't extract the private key. So your first scenario is a bit far from reality as it is unlikely to happen. The second scenario is also not realistic. Usually, you need to enter a pin code to use your smart card. So if someone steal your smart card, it can't use it. Some smart cards can be automatically deactivated after a number of wrong pin. Anyway, when you see that your smart card has been stolen, you can "revoke" it.

So I would say that from the security point of view smart card and offline storage of cryptographic keys are equals for your usage (storing openpgp keys). But for an everyday usage of your personal keys smart cards are a better solution. It's also easier to manage smart cards in organization than offline computer.

Here is good article to complete my answer : Strategies for offline PGP key storage

4
  • Thanks for your reply. I'm specifically interested in the security differences between storing only subkeys on the smartcard and storing the master key there as well. This is not really discussed in the LWN article. Dec 27, 2019 at 17:09
  • Yes, you should only store the subkeys that you're using on the smart card. And it can be interesting to store the master key on a seprated support used just for this specific case. This way, if for a particular reason someone is able to recover your subkey, then you can revocate it and your master key is still protected. You can find more informations in the part "Why ?" in this page.
    – Kn0wledge
    Dec 27, 2019 at 17:28
  • I know these pages, as well as the LWN article series. The "Subkeys" page of the Debian wiki motivates the use of subkeys when the private key is stored on disk. In that case it can indeed be lost or stolen if the computer is compromised. But smartcards present a second barrier to such attacks, that should be effective (except perhaps when targeted individually by the state-run security agencies, which is a threat that I'd like to exclude here). Dec 27, 2019 at 18:12
  • Smart cards are mainly used by organizations which have a lot to lose and can be the target of cyber espionage. For a personal use, storing the master key on a smart card (or directly on you computer) may be good enough. It only depends on the risk present(which, I agree with, you is pretty low) and if you're ready to take it or you want to lower it by adding security measures like the use of subkeys. If think you now have everything you need about the security advantages of using subkeys and/or smartcard. You just have to make your choice based on your use of the openpgp keys.
    – Kn0wledge
    Dec 27, 2019 at 18:35
0

Since asking the question, I have acquired a better understanding of the matter, which allows me to answer my question myself.

Smartcards, when working as designed, prevent an adversary from reading out the secret keys that are stored on them, but not from using them. Say that an adversary has gained access to the card, for example by breaking into the computer where it is plugged in. If the master private key is stored on the card, the attacker can now certify a new key of his making, and create a revocation certificate for the legitimate key. This is equivalent to hijacking the identity of the card owner, and it is not necessary to read out any private key for that.

Even if signing operations are protected with a push button, the attacker needs to hijack only two pushes in one way or other.

In summary, using a smart card or not and storing the master private key offline or not are two independent security considerations.

OpenPGP smartcards turn out to be less useful than many people may think. The threat models where a smartcard is useful have been discussed in a recent thread on the GnuPG-users mailing list.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .