RE: Palm to FreeBSD using ssh

From: Mark Senior (Mark.Senior_at_gov.ab.ca)
Date: 08/29/05

  • Next message: Timothy Luoma: "Re: Palm to FreeBSD using ssh"
    Date: Mon, 29 Aug 2005 13:18:26 -0600
    To: "Timothy Luoma" <lists@tntluoma.com>
    
    

     

    (snip)
    >
    > > - client theft - how likely is the device that stores your private
    > > keys to be stolen (or lost)? The more likely this is, the more you
    > > should tend to use encrypted keys. In the case of a
    > portable device,
    > > I would weigh theft as by far the highest risk.
    >
    > The key is a "DSA Private Key" which I assumed was safe.
    >

    The exchange of data over the network is safe enough against snooping or
    alteration, (assuming the attacker doesn't know the private key) whether
    you use an RSA or DSA key.

    Theft is a different threat though - the type of key doesn't matter
    then, the strength of the passphrase that's protecting it is what
    matters. If the private key is stored unencrypted on a palm pilot and
    someone steals it, then any servers that allow logins with that key are
    at risk until you can delete the corresponding public keys from your
    authorized_keys files.

    > > - client compromise - how likely is the device that stores
    > you private
    > > keys to be compromised? A Windows worm can compromise a
    > Unix box, if
    > > the Windows box stores unencrypted ssh keys for the Unix box.
    > > Encrypting keys provide some defence in depth against this.

    I was thinking of the palm pilot itself - the Mac is another storage
    place, which can be be considered separately. Presumably there's no
    need for this tradeoff there, as openssh is pretty well tested and
    supports encrypted private keys in the client.

    Regards
    Mark

    This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.

    This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail.


  • Next message: Timothy Luoma: "Re: Palm to FreeBSD using ssh"