Discuss how to manage online and offline keys #4
Conversation
Co-Authored-By: lukpueh <[email protected]>
Co-Authored-By: lukpueh <[email protected]>
pep-0458.txt
Outdated
| @@ -504,22 +491,110 @@ MUST be offline and independent of other keys. For simplicity of key | |||
| management, without sacrificing security, it is RECOMMENDED that the keys of | |||
| the *targets* role be permanently discarded as soon as they have been created | |||
| and used to sign for the role. Therefore, the *targets* role SHOULD require | |||
| (1, 1) keys. Again, this is because the keys are going to be permanently | |||
| (2, 3) keys. Again, this is because the keys are going to be permanently | |||
There was a problem hiding this comment.
So that a key generation weakness is hopefully not fatal
There was a problem hiding this comment.
How does 2,3 help more than 2,2 or 3,3 if we're tossing the keys? I'm not sure I understand the threshold rationale. Should we clarify / change this? I'm okay with 1,1 or 2,2 or really anything given this is PEP 458.
There was a problem hiding this comment.
Ok, I see the point of contention now. Yes, (2, 2) should be reasonable.
pep-0458.txt
Outdated
| __ https://github.com/secure-systems-lab/securesystemslib/pull/170 | ||
|
|
||
| Regardless of where and how this online key is kept, its use SHOULD be | ||
| carefully logged, monitored, and audited. |
There was a problem hiding this comment.
If so, separating keys may make these tasks easier (especially timestamp from snapshot from all bin keys).
There was a problem hiding this comment.
Maybe, but for little added security, just extra maintenance burden
There was a problem hiding this comment.
I guess this may be true. It may or may not make auditing easier to have separate keys. Would these keys be stored in hardware in any way or all software?
There was a problem hiding this comment.
Probably all software, if I had to guess. HSMs are not cheap to buy or use.
There was a problem hiding this comment.
Having said that, cloud providers have good logging and auditing capabilities these days, even if the key service is software-not-hardware-backed...
|
@JustinCappos Hopefully the latest commit clarifies your two questions? |
More juicy details