Single vs server specific ssh keys?

Question

This question has a bit to do with procedure. Is it better for a person to have one single ssh key pair and share the public key where needed. Alternatively is it better to have server specific keys? or maybe less restrictive have classes or rings of keys. One key for personal home servers, one for work, one for external stuff like github.

The downside to one key everywhere is clearly that is allows you to be easily tracked and the same public key connects the dots between services. Revocation is swift but absolute. More finite control is had when you have a key pair per server but it becomes much harder to manage. ssh breaks down when there are many ssh keys and you need to configure your .ssh/config file for each and every site to fix this. it's a lot of work.

So what are best practices?

Answer 1

Your question is quite broad, and not very specific. It is hard to give advice for such generalities as the recommendations would be different for different people.

As with most security questions start with "What are your protecting? From Whom? What are the consequences of losing this?".

Here are some starting points:

• Do you have multiple personas you want kept separate? e.g. Mr Anderson Vs Neo. If this is the case you will need different key-pairs for each of these personas.
• Do you need keys for work and personal? If so these should be different key-pairs, as your company may consider your key it's property, and may revoke it once you leave the company.
• Do you mind your activities being correlated across servers? For me personally the cross persona is more important then the cross service. I don't mind my GitHub/Souceforge/Stackexchange identities being correlated but it would be a shame if it was proven I was The Dread Pirate Roberts. If so, you need different key-pairs for each of these services.

As you say each key you maintain adds to the amount of effort you need to go to to maintain them. This also raises the possibility of using the wrong key in the wrong place and accidentally connecting your different keys.

The most likely scenario I can see would be someone with 3 personas, [professional , public personal, private personal]. I would be inclined to keep use separate machines for personal and professional, so that my personal private keys never touch my work computers and my works private keys never touch my personal computers. Then depending on the consequences of linking public personal and private personal I would either:

• Keep the keys on separate accounts of the same machine (low consequences)
• Keep the "public personal" private key on the machine and the "private personal" private key on an encrypted USB device, only plug this in when doing private stuff (medium consequences).
• Have a Tails OS or similar for your private work. Again "private personal" on an encrypted USB stick. (medium-high consequences)
• Dedicated, physically secure air-gapped machine and some luck (high consequences)