We updated our RSA SSH host key

Re:We updated our RSA SSH host key by 1970-01-01 on Friday March 24, 2023 @09:10AM (#35288554)

I think you're looking for something like PCI DSS compliance, which requires you to store keys in a HSM, and is much more prescriptive with key management.

[ Parent | on HN ]

Re:We updated our RSA SSH host key by bob1029 on Friday March 24, 2023 @09:21AM (#35288681)

PCI-DSS is incredibly aggressive with key management considerations. They get down to radio frequency concerns in pin pad hardware, etc.

It took us ~2 years of back & forth with various parties & auditors to get per-client exclusions for accepting end-customer debit PIN codes in-branch on an iPad screen. These banks do not have fully-compliant solutions and must have exceptions on file.

[ Parent | on HN ]

Re:We updated our RSA SSH host key by joezydeco on Friday March 24, 2023 @09:26AM (#35288751)

Wasn't SPoC supposed to help with that?

[ Parent | on HN ]

Re:We updated our RSA SSH host key by bob1029 on Friday March 24, 2023 @09:41AM (#35288930)

It showed up too late. We did our integration 2016-2017. We were held to far more unrealistic standards at the time.

[ Parent | on HN ]

Re:We updated our RSA SSH host key by patch_cable on Friday March 24, 2023 @11:11AM (#35290078)

You may be confusing PCI-DSS versus PCI-PIN, which are a little different. You’re right about the requirements around acquiring pins though.

[ Parent | on HN ]