I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into and out of the network travels through an SSH tunnel from whatever service host, through the bastion, to the end user's machine.
So, traffic from the network's boundary to the end client is already encrypted. And, I already have a system setup for associating end users with SSH-RSA key pairs that are rotated periodically.
So, here's my crazy idea:
On any web app in the network that requires user authentication, have the end user provide their username on the network, as well as their public key. Have the web app's authentication service verify that this public key is indeed already associated with the end user in the network's keystore, then generate a challenge using the key. Client side, the end user decrypts the challenge using their private key and presents the end result to the server for authentication.
Getting the private key into the browser is easy enough. Whether or not loading the private key into a browser is even a good idea is another question, entirely.
But, more specifically:
- Are there any blazing "Oh, don't do that!" security flaws in the setup summarized above?
- What are a few standard packages used in Linux for generating challenges using an RSA public key?