0

Whether it be a private key for a TLS certificate, an SSH server, or a code signing cert, is it bad practice to use the same password across multiple?

My assumption would be no, seeing as a key compromise does not necessarily compromise the private key password.

Then again, if the password is found out, then every key will essentially become password-less.

Improve this question
7
  • 1
    Why have multiple key pairs in the first place when you don't actually separate them through different passphrases? In this case, it makes more sense to use the same key pair for multiple purposes (e.g., SSH authentication and TLS client authentication).
    – Ja1024
    Commented Dec 2 at 12:04
  • @Ja1024 because if the key pair is compromised, say, during authentication or while decrypted on disk, then you wouldn’t want it to have multiple uses where is can be compromised multiple times.
    – security_paranoid
    Commented Dec 2 at 20:05
  • What kind of attack would allow the attacker to get a decrypted private key but not the corresponding passphrase? Because that's the only case where it would make sense to have different key pairs with the same passphrase. Otherwise, you might as well have a single key.
    – Ja1024
    Commented Dec 2 at 20:24
  • If you want to actually separate services like SSH, TLS etc. (which makes perfect sense), then you need different passphrases. Or even better: different hardware tokens.
    – Ja1024
    Commented Dec 2 at 20:26
  • @Ja1024 When you said it makes more sense to use the same key pair more multiple purposes, I thought you meant without a passphrase. So do you mean different keys with the same passphrase? Actually, that does make more much more sense… seeing as the passphrase is only meant to stay “in your head.”
    – security_paranoid
    Commented Dec 2 at 20:35

2 Answers 2

Reset to default
1

Re-using passwords anywhere is generally considered to be a bad practice, because it increases the chances for the password to be compromised, and means that if an attacker does get hold of the password somehow they can use it in more places to compromise more stuff. But whether or not it's a significant problem depends on your circumstances.

For instance, if you've got two different TLS certs installed on the same server, then protecting the keys with different passwords provides limited protection (especially if you store those passwords in the same place), because an attacker who's got access to one can probably already get access to both.

On the other hand, if the password for every single private key across your whole organisation is the same, then that's obviously more of a problem, because that password might now be used on dozens of different systems, and could allow access to all kinds of things. And if also means that if that password ever gets compromised (or someone who knows it leaves), then you have to go and change it everywhere.

So in short: yes, it's bad practice - but there might be times where you consider it to be an acceptable trade-off.

Improve this answer
1

It mainly depends on the usage of the certificates and their password. What is essential is that if a key is compromissed, only the lock it secures can be opened.

For that reason, you should never reuse the same simple password on distinct internet sites: if an attacker gets the control of one site, they could intercept the password and use it on other sites.

Here, if you have to type the password on distinct servers (through a terminal emulator), you should choose different passwords because they depend on distinct security zones. If you only type the passwords on the same local machine, you could use the same one.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .