Hacker News Reader

Comment by pooriaazimi | Hacker News Reader

If someone gets hold if your smart card, they can enter a wrong pass phrase to remove your private key, right? So, you have to have multiple of these smart cards (that all share the same private key), some in your wallet, some in your house and some in a bank or vault somewhere. Otherwise, you can lose access to your private keys forever.

Am I right, or I'm missing something?

View on HN

Depending on the cards and their configuration, you could generate the key outside (say, on a trusted machine at home) and upload it to the card. If the cards gets stolen, and you trust the security of the card to not leak the key, you could just get yourself a new one and upload the old key again.

The other philosophy is to generate the key on the RSA card, and never allow the card to export it. Then you consider the private key dispensable and will have to update all systems to accept a new card's private key.

update all systems to accept a new card's private key.

That sort of a chicken/egg problem though, right? It assumes you've got console or some other means of access that will take another credential.

I don't see a situation where you are unable to get console access as an acceptable situation. You don't need to be using a smart card to require local console access if things go bad. What about if the SSH server fails or someone applies a bad firewall rule that prevents SSH access?

You don't need multiple cards with the same private key. You can use multiple cards with different private keys, that are all authorized for your server(s). If you lose one card, just remove that card's public key from the authorized keys.

It does not matter if you lose your SSH private keys though as they are disposable and you can just generate new ones, it's not like they are being used to encrypt anything. To add your new public key to your servers you either get someone else who can SSH in and su to root to do it for you or you login locally (via kvm or similar). Larger deployments most likely have some centrally managed system for dealing with SSH keys.

Reply on news.ycombinator.com