Re:Tomu, a tiny ARM microprocessor which fits in your USB port
by sametmax on Thursday August 09, 2018 @06:30AM
(#17722986)
Ok, so you if you want 9 keys (3 persons in your family has access, have one local spare, and one off site), and 4 services, you need to do 36 registrations of keys ?
Is there a standard to automate that ?
Re:Tomu, a tiny ARM microprocessor which fits in your USB port
by dspillett on Thursday August 09, 2018 @09:32AM
(#17724005)
You don't need one key per service, so that is as little as 5 keys (3 for active users plus the on-site and off-site spares).
You may choose to have more than one key per person, to reduce the amount of re-registering needed if one key is lost, though remember that this is the second factor so you also already have passwords that vary by service (and if you give people multiple keys they will most likely carry them together to lose them all at the same time rather than individually anyway).
In the case of key loss on a properly secure service registering a new key could be problematical if you don't have any other key that is still appropriately registered - you might be permanently locked out unless there is an admin function who has a key registered so can do it for you.
Look at multi-key options for encrypted filesystem for one way that this can work. Often the filesystem or block device has a symmetric key that is in turn encrypted by each of the keys that you wish to be able to open it. It is the same symetric key every time, though you can't unlock my copy of it with your key nor can I unlock your's. Once unlocked we could both add a third user by encrypting the base key with their public key (PKI is not required, but is not uncommon).