Booting a Self-signed Linux Kernel

Re:Booting a Self-signed Linux Kernel by aray on Monday September 02, 2013 @08:00PM (#6317907)

Nice! It'd be good to pair this with some instructions on how to do safe key management by yourself, because you'll only ever be as safe as you keep your keys.

I would link to some here, but I don't even know of any best practices for keeping personal keys safe. (Use smartcard/physical-backed keys?)

[ Parent | on HN ]

Re:Booting a Self-signed Linux Kernel by jlgaddis on Tuesday September 03, 2013 @04:35AM (#6319766)

> Use smartcard/physical-backed keys?

Basically, yes.

I'd be happy to share details of how I generated/store/backup my keys but be forewarned that I went the "extremely paranoid" route.

[ Parent | on HN ]

Re:Booting a Self-signed Linux Kernel by philips on Tuesday September 03, 2013 @08:58AM (#6320618)

Please do. I haven't been able to find a vendor for smart cards in the US nor do I know exactly what to buy.

[ Parent | on HN ]

Re:Booting a Self-signed Linux Kernel by girvo on Monday September 02, 2013 @11:13PM (#6318530)

The conventional wisdom I've been given has indeed be using smart cards for key management. Id love to know if this idea is still the best way.

[ Parent | on HN ]