1

I found two places that describe OpenStack SSH keys, but nothing seems to say whether or not they're generated on VMs.

Generating these on the VMs could lead to problems, since VM images are often so standardized that it may lead to a reduction of randomness applied to the generation of keys.

What OpenStack SSH key generation configuration reduces this potential source of vulnerability, e.g. is there a way to force OpenStack to use a dedicated source of randomness like an HRNG?

I am asking this because I have read here (How can you securely generate keys on AWS?) and other places that SSH keys generated on VMs have slightly more risk than those generated on bare metal due to several vulnerabilities directly related to virtualization.

Also, a technically minded acquaintance pointed out the same issue earlier about the vulnerabilities from potentially weak VM entropy, too, at the RSA conference.

Even if virtualization doesn't reduce entropy, there could still be other problems.

That is why I want to know,

How do I reduce the vulnerability of the OpenStack SSH key generation process?

OpenStack can inject a public ssh key into an instance on launch --https://www.mirantis.com/blog/openstack-security-tip-create-a-keypair-for-accessing-vms/

Mike Ounsworth
  • 57,707
  • 21
  • 150
  • 207
Nathan Basanese
  • 640
  • 1
  • 9
  • 20
  • // , Please also advise or comment if I should change the question or tags. – Nathan Basanese Jan 11 '19 at 00:43
  • 1
    If you are really concerned about the potential collision caused by psuedo random number generators within a VM, you could leverage a service like Amazon KMS to generate and store your keys for you. Going further, if you need a key local, you could also simply use an HSM service to hold a Key Encryption Key that you call when an application runs to store a local key in memory until it is no longer used. Then the local key is re-encrypted and the HSM connection closed. These are your most practical solutions. – Connor Peoples Jan 11 '19 at 01:38

0 Answers0