Is password + second factor more secure than public key auth now? (SSH)

Question

I ask this question because, I think, we now can reasonably assume the following:

1. NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and boasted) about this capability in the wild.
2. NSA has a database of stolen keys: They can somehow get SSH keys. The slides imply they have a database of stolen keys (I think it says something like, 'check to see if key in DB').
3. It is easier to steal the private/public keys than it is to steal the TOTP from my air-gap'd phone/ipod touch.

If it is true that agencies can easily acquire keys, then would it not make more sense to use password + google TOTP second factor authentication for each SSH login?

It seems google's TOTP second factor authentication does not work out-of-the-box if publickeyauth is used. So, there is a temptation to disable public keys and use only password + second factor.

Taking the latest leaks into account, if I have to choose between public key auth and password + TOTP second auth, which is better in terms of security? (I explicitly cannot use both).

(I don't care about convenience, they are both the same for me).

Thank you.

Answer 1

If the second factor is something that you have, and that cannot be copied, then it can be very secure.

RSA tokens (as was shown by the Lokheed Martin breach) may be physically secure, but if the backend is hacked, then they can be completely compromised. Which is why the mass recall/replace of RSA tokens was carried out.

The answer will depend entirely on your risk/threat model. If you are an NSA target I would imagine it won't matter either way. (In reality it doesn't look like there is any proof they can break SSH - just that they are very good at getting around it)

How well does your infrastructure/processes protect an SSH key? How good are your users at protecting a 2nd factor? Is that 2nd factor an SMS? Or a physical device? Or a phone call?

You can see why this is not an easy question to give a definitive answer to.

Answer 2

Your threat model (the largest surveillance state actor out there) has one benign consequence. Surveillance agencies do not like it when people know they are being watched (because then people change their behavior in less predictable ways). Thus, if your second factor cannot be intercepted in transit, or you can learn about its use very soon they will be unlikely to consider your authentication mechanism as the weakest link and candidate point of entry. They will try elsewhere (okay, this isn't as rosy as one could imagine - including the use of "rubberhose cryptoanalysis").

In most developed countries of the 'free world' (I can almost hear Eric Arthur Blair spin in his grave) telecommunications operators are likely to be under 'gag orders' and can participate in active intercept efforts. Your phones may be cloned, and SMS-traffic may be undetectably altered. Last, but not least: there aren't any "airgapped" iPhones.

Answer 3

It depends what type of Second Authentication it is..

if it something like a randomly generated key (TOTP), it depends how often it is changed (usally 30 secs to 1 min) and by the time the NSA gets the keys and uses it, it will be changed

Then you have something like Fingerprint scan, which it static and doesn't change, so be more specific with what type of Two Factor auth.

in terms of whether or not SSH is less secure than Password + TFA , we have to assume that with the information we are given, the NSA can currently De-crypt some SSH traffic, while it is more difficult to deal with something more dynamic like TOTP.

Sources:

http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://www.spiegel.de/international/world/nsa-documents-attacks-on-vpn-ssl-tls-ssh-tor-a-1010525.html

Sorry for wikipedia link xD

Answer 4

Apart from the actual security you can achieve there is another point to be viewed when talking about ssh: Denial Of Service.

Every ssh-server experiences an almost continuous stream of login attempts, which will have very different consequences for the server depending on the fact if you allow password-based logins, password with TFA or no password based logins at all.

• standard password login: the "user" is asked for her password, the hash has to be compared to the local database --> considerable load on the server
• Password + Two Factor Authentication: the same as above but additionally (if the attacker provided the correct password) the connection must remain open to provide sufficient time for the 2nd factor --> (slightly more) load on the server.
• Only key-based login allowed: the server closes the connection as soon as no key is offered, doesn't even wait for the password --> less load on the server.

Of course you can mitigate that resource problem by using something like fail2ban.

So if you don't expect to be targeted by a real powerful player™: stay with key based login for ssh.