1

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? or maybe less restrictive have classes or rings of keys. One key for personal home servers, one for work, one for external stuff like github.

The downside to one key everywhere is clearly that is allows you to be easily tracked and the same public key connects the dots between services. Revocation is swift but absolute. More finite control is had when you have a key pair per server but it becomes much harder to manage. ssh breaks down when there are many ssh keys and you need to configure your .ssh/config file for each and every site to fix this. it's a lot of work.

So what are best practices?

  • What are you protecting from who? What is your position in the convenience vs security continuum? Are you wishing to separate your different activities? – David Waters Jan 19 '15 at 1:14
  • Guess I am just looking for the best middle ground. I was just posturing extremes. I don't need protecting from anybody. I'm just an average joe. – Biff Jan 19 '15 at 2:43
2

Your question is quite broad, and not very specific. It is hard to give advice for such generalities as the recommendations would be different for different people.

As with most security questions start with "What are your protecting? From Whom? What are the consequences of losing this?".

Here are some starting points:

  • Do you have multiple personas you want kept separate? e.g. Mr Anderson Vs Neo. If this is the case you will need different key-pairs for each of these personas.
  • Do you need keys for work and personal? If so these should be different key-pairs, as your company may consider your key it's property, and may revoke it once you leave the company.
  • Do you mind your activities being correlated across servers? For me personally the cross persona is more important then the cross service. I don't mind my GitHub/Souceforge/Stackexchange identities being correlated but it would be a shame if it was proven I was The Dread Pirate Roberts. If so, you need different key-pairs for each of these services.

As you say each key you maintain adds to the amount of effort you need to go to to maintain them. This also raises the possibility of using the wrong key in the wrong place and accidentally connecting your different keys.

The most likely scenario I can see would be someone with 3 personas, [professional , public personal, private personal]. I would be inclined to keep use separate machines for personal and professional, so that my personal private keys never touch my work computers and my works private keys never touch my personal computers. Then depending on the consequences of linking public personal and private personal I would either:

  • Keep the keys on separate accounts of the same machine (low consequences)
  • Keep the "public personal" private key on the machine and the "private personal" private key on an encrypted USB device, only plug this in when doing private stuff (medium consequences).
  • Have a Tails OS or similar for your private work. Again "private personal" on an encrypted USB stick. (medium-high consequences)
  • Dedicated, physically secure air-gapped machine and some luck (high consequences)
  • Thanks. I guess I was looking to see if there were any other solutions to this problems. DPR is what resonated with me actually but I am not doing anything like that. Is there any real downside to using one key per realm like you mention. One personal public, personal private, one professional? – Biff Jan 19 '15 at 3:46
  • The only down side of multiple certs is convenience, 3 should be a manageable number, just put steps in place to ensure that is it hard to use the wrong one. – David Waters Jan 19 '15 at 4:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.