4

I'm not really an expert on different key types but here it goes. My company never really managed keys. We have an SKS server that was set up to manage GPG keys for a couple of users sending encrypted documents.

Now a new requirement has come up: all users logging into servers will have to use SSH keys (i.e. ssh-keygen, creating rsa keys) or to use services like git.

Can I manage/does it make sense to manage GPG and SSH keys in the same tool? Is the existing SKS server the right tool to store these keys?

schroeder
  • 123,438
  • 55
  • 284
  • 319
JoeSlav
  • 61
  • 5

1 Answers1

1

GPG and SSH are actually designed for different scenarios. GPG is typically used to identify the user so it would make sense for each user to only have one GPG keypair. However, SSH is typically designed to identify the client device - in other words you want each computer to have its its own SSH keypair.

Personally I use Lastpass to manage my GPG key, but NO SSH keys - my SSH private keys are never shared and never leave the clients they were generated on. I researched various password/key managers many years back (even answering some Lastpass questions here as well: answer 1, answer 2), and liked the Lastpass cloud approach for convenience, sharing of passwords with family members, and their approach seems secure.

One keypair per client. Each SSH client should generate its own SSH key pair, which should not be shared with any other device. So if I have a desktop computer and a laptop, they should each generate their own keypair. From a security perspective, it is best if the private key is never transmitted across a network or shared with any other device - it is only ever used by the device that generated it. This approach allows for scenarios where if you get a new laptop you can simply unregister the public key associated with the old laptop without affecting your desktop key.

Registration. You will need an alternative login mechanism to be able to add the public key of each client, presumably to the SKS server. Ideally, this alternative login mechanism should also be protected by a second factor.

SSH is commonly used by cloud git repositories such as github so you might find it helpful to see how it works there - particularly, the public key registration process.

HTLee
  • 1,772
  • 15
  • 30
  • Thank you for your answer. fyi, the question was about centrally manage public keys, not private ones. When you write "presumably to the SKS server", that was the part I was researching :) cheers – JoeSlav Dec 27 '19 at 14:20