We updated our RSA SSH host key

Re:We updated our RSA SSH host key by tialaramex on Friday March 24, 2023 @09:34AM (#35288839)

What I expect has happened here is that you've remembered that your HSM comes with instructions for how to use PKCS11 to make user authentication rely on the HSM and you've just assumed that's relevant here. While I'm sure the vendors make it seem like this is all very secret, it's just a pretty boring C library and it's probably half-arsed in real world implementations.

AIUI OpenSSH does not provide any way to use PKCS11 to protect host keys, which are the concern here.

You can use PKCS11 to sign OpenSSH certificates, so if GitHub had elected to use certificates here, it could have protected the CA keys for those certificates in an HSM, but it did not.

[ Parent | on HN ]

Re:We updated our RSA SSH host key by tialaramex on Friday March 24, 2023 @12:58PM (#35292000)

Correction: It was pointed out elsewhere that you can just tell sshd to use PKCS11 keys via the SSH agent mechanism, and so yes that would allow use of an HSM for host keys

[ Parent | on HN ]