Re:Sign arbitrary data with your SSH keys
by jasode on Saturday November 13, 2021 @07:30AM
(#29209312)
>There are cases where information [...] associated with a public key)may indeed need to be protected, [...] But public keys should be considered public without exceptions.
Your answer actually stumbled into the reason why so-called "public" keys may not want to be published. There are 2 different objectives:
- public key as part of a encryption pair : publishing this is no big deal as it shouldn't compromise SHA256 private key for decryption. So "security by obscurity" isn't necessary.
- public key as an identity for metadata/tracing : some may not want public keys to be known for correlation ... e.g. That's why Bitcoin wallet software generates new public+private keys for each transaction even though exposing a public key doesn't compromise ECDSA encryption.
Your answer actually stumbled into the reason why so-called "public" keys may not want to be published. There are 2 different objectives:
- public key as part of a encryption pair : publishing this is no big deal as it shouldn't compromise SHA256 private key for decryption. So "security by obscurity" isn't necessary.
- public key as an identity for metadata/tracing : some may not want public keys to be known for correlation ... e.g. That's why Bitcoin wallet software generates new public+private keys for each transaction even though exposing a public key doesn't compromise ECDSA encryption.