Re:Keybase is not softer than TOFU
by groestl on Wednesday March 27, 2019 @05:54PM
(#19506493)
A side note on the last part: @cert-authority is an underrated feature of OpenSSH. More companies should use it to make their infrastructure safer to use.
[ Parent
| on HN ]
Re:Keybase is not softer than TOFU
by chupasaurus on Wednesday March 27, 2019 @07:36PM
(#19507408)
It has flaws in usage: issuer cert per group isn't easy to manage (and makes pubkeys 1000+ characters long), you have to distribute CRLs, one error in sshd_config could make server unmanagable (multiplied by your config manager). I haven't seen a pure SSH CA automation project too.
Can you elaborate on the first issue?
Re:Keybase is not softer than TOFU
by chupasaurus on Thursday March 28, 2019 @06:57PM
(#19517488)
You can make a certificate with multiple principals, but in order to add/remove some group access you'll have to reissue the public cert (and add previous to CRL with removal of some), which is OK for short-lived certs. With multiple issuers, you can add/remove public keys for different CAs but the resulting meta public key will be a set of keys actually.