Re: Requiring non-empty passphrase.
From: Brian Lund (blund_at_iastate.edu)
Date: 04/28/04
- Previous message: Wes Strickling: "RE: openssh with DSL and DHCP -- ListenAddress?"
- In reply to: Steven Carter: "Requiring non-empty passphrase."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 28 Apr 2004 15:28:23 -0500 To: secureshell@securityfocus.com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I would say no. Public keys are not encrypted with passphrases, it is
the private keys that are encrypted. When a client wants to log in
with their key, it must be decrypted before it can be used for
authentication. The trick is that this decryption of the private key
is done on the client side and the server never sees the private key
in any form, encrypted or otherwise.
Now if you are the system admin you could do something like allowing
only keys generated on the server to be used for login or something
using some clever scripts. But if any user can put a random public
key in the server and log in using the associated private key, there
is no way given current public/private key standards to tell if that
private key was encrypted or not. All you as the system admin have
access to is the public key which is the same either way.
Quite frankly I think that this is the lesser of two evils. The idea
behind public/private key authentication is I (the user) convince you
(the server) that I know something (in this case my private key)
without actually telling you what it is. So not only do you not know
my secret, but neither would anyone else who's listening in. I
suppose I could tell you I've encrypted my private key, but would you
just take my word for it? And if I actually gave you the key to
verify that, even if it was encrypted all you would need to do is
guess my passphrase to pretend to be me, which gives no more security
than simple password authentication. And more importantly, that's all
anyone else who's listening in would have to do.
Maybe too much information, but I hope I helped answer your question :)
- --
Brian Lund
Iowa State Cyber Corps
blund@iastate.edu
PGP Key ID: 0x22314551
Steven Carter wrote:
|Is there a way to require public keys with non-empty passphrases?
Kind of
|like PermitEmptyPasswords except for public keys.
|
|Thanks,
|
|Steven.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iQEVAwUBQJAT5oqYB0pVl1HtAQLc6ggAh1WDMWwWmHFmU8xAQkRjuq5A2H7hFZ9l
HP75YXKOUw0KNg2O9p7HNnJ9fG/bcB3Z37kRWjlw6fKYngDvUQMjUw3CmlL9G6Ra
Rr5XgyqKrJuWYOMNPori2fwiAuXBYAGC2mfP9s1/ZCqJdZr6wF2IdSAXU4QKQZbh
qxFUS+pqnNrpqgG3NFJkZz0JG12gAlotBudjhSXbv+A203FrDrmlJBUejejwFSYH
kt08IvnqtZh81QkwhpoPpIRkbxuqRiTm8pNJO+NeV36f2EjfTbiAyuOC+Xs8dEJY
DL9hDvXTYJvUuFb/0qlEtafdOJswMnFeTEhNZk8K+9NsmZhrUhrHQg==
=ZSfz
-----END PGP SIGNATURE-----
- Previous message: Wes Strickling: "RE: openssh with DSL and DHCP -- ListenAddress?"
- In reply to: Steven Carter: "Requiring non-empty passphrase."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
