On 06/17/2016 08:19 AM, James B. Byrne wrote:
On Thu, June 16, 2016 14:23, Valeri Galtsev wrote:
Oh, this is what he meant: Cert validity period. Though I agree
with you in general (shorter period public key is exposed smaller
chance secret key brute-force discovered),
Like many things that appear to be common-sense these assumptions have
no empirical basis. A properly generated RSA certificate and key of
sufficient strength -- RSA k>=2048bits -- should provide protection
from brute force attacks for decades if not centuries.
Yes. The primary concern is theft, not brute forcing. I would imagine
that those with the resources to brute-force keys have other ways to
intercept traffic.
The usual way a
private key gets compromised is by theft or by tampering with its
generation. Putting yourself on a hamster wheel of constant
certificate generation and distribution simply increases the
opportunities for key theft and tampering.
No it doesn't. If your key/cert pair exists only on the host where it
is used, then access to that host is required to exfiltrate the key. If
an attacker has ongoing access to a host, in order to acquire each key
as it is generated, then the expiration of the keys is irrelevant with
respect to the opportunities for theft. The opportunities are equal for
both cases of short certificate lives and long certificate lives.
There is, however, a difference if an attacker has only brief access.
If you shut out an attacker who has taken your key, then a short key
lifetime returns you to a secure state sooner than a long key lifetime.
In fact, you have the logic of the situation entirely backward. The
interaction between the opportunity for theft and the lifetime of the
certificate is proportional to the remaining lifetime of the certificate
at the time of the theft.
And remember that theft doesn't necessarily mean the attacker has login
access. A recent OpenSSL bug allowed an attacker to read portions of
memory, and could be used to acquire key material.
Really, unless one has evidence of penetration and theft of
the key store, what possible benefit accrues from changing secured
device keys on a frequent basis?
You aren't always going to have evidence. Be proactive.
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
