2

I'm asking about best practices relating to key generation, use, and management.

On a few occasions, and for various reasons, I've created SSH and GnuPG keys while logged in over SSH to a remote multi-user server at work (and to my desktop machine at work, from home).

It struck me while I was tapping in the passphrases for my newly generated keys that I have no control over the machine that I'm logged in to, or over the link inbetween. I kind of trust the sysadmins at work, and SSH is secure, but none the less... it felt weird to send my fresh passphrases over the link like that.

What do you think? Is it wiser to generate the keys (SSH, GnuPG, or other) locally and then transfer the private keys over SSH, or am I just being paranoid about the whole thing?

Also, if I'm right to be at least slightly paranoid, what's your thought about where to store private keys? Should they all be in one physical place? Should I make heavy use of gpg-agent and ssh-agent always?

I'm working from two separate machines, logging in to a few separate multi-user servers using SSH to do work. I sign Git commits with GnuPG from about four locations (locally and remotely).

I'm working on a mix of Mac OS X (with MacPorts) and Linux machines (with Pkgsrc), but always on the command line.

2

What do you think? Is it wiser to generate the keys (SSH, GnuPG, or other) locally and then transfer the private keys over SSH, or am I just being paranoid about the whole thing?

This does not really make a difference, at least if the system administrators didn't tamper with the software stack (but why should they, getting hold of the private keys anyway?).

As long as the private key is on the remote machine, there is no difference how it got there. The system administrators can have access to it. A passphrase will also only add additional effort into getting the keys, as they could also get access to your input.

Also, if I'm right to be at least slightly paranoid, what's your thought about where to store private keys? Should they all be in one physical place? Should I make heavy use of gpg-agent and ssh-agent always?

This depends on your requirements, level of paranoidity, trust in the system administrators and finally use of the key.

If you need a private SSH key on the machine for accessing some services (let's say, GitHub), simply generate a new one only used on this machine, and only accepted for authenticating on the services/machines needed.

Regarding OpenPGP/GnuPG, things depend on your requirements. It seems you want to sign software, and I have the feeling this happens for your company. If the key is directly linked to the company and only created for this purpose, I don't see any objections not having it on their machines.

If you need to use your own key for any reasons, create a subkey which you can at least limit to signing and revoke at any time without hassles. Using subkeys is good practice, anyway! Lots of OpenPGP power users actually store their private primary keys offline and actually only use it for key management.

Forwarding gpg-agent's socket seems to be well possible, and of course will reduce the system administrator's access to the key (they have no access to the full key any more, but only can use it, at least starting with GnuPG 2.1 which removed all private key operations to the agent).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.