Just found this neat CA based on Knoppix and a usb drive for storing certificates simple offline CA heirachy.
http://www.intrusion-lab.net/roca/
Ben
Printable View
Just found this neat CA based on Knoppix and a usb drive for storing certificates simple offline CA heirachy.
http://www.intrusion-lab.net/roca/
Ben
Neat. Have passed it on to our support chaps so we can recommend it to customers requiring extra tinfoil hat :)
I'm not sure what the real advantage is. A hacker could still change settings in KNOPPIX's RAM disk FS. He could also playaround with the certificate on the USB drive.
I suppose you'd save on the time taken to do a clean rebuild of the compromised box,
If you don't have the root CA you can't generate any certificates. Keep your USB disk in your safe. :)
I suppose the crampness of a RAM disk would make job harder for a cracker but what's to stop them from hacking UNIONFS to point to their own subsituted root CA.
Anyway why place a premium on the physical securiy of the root CA over that of servers. Once a cracker owns a domain controller or other central server it's game over.
CA machines aren't usually connected to the rest of your LAN or indeed online at all. You generate your cert then take the cert off with USB or whatever then lock everything away again.
There's no other way to access the machine.Quote:
Anyway why place a premium on the physical securiy
Why choose?Quote:
over that of servers
That's not fair Geoff! You twisted my words. My question was about emphasising the security of a root CA versus that of production servers.
I understand totally the need for physical security of servers and as much as possible, securing clients.
My concern more about the security of the ceritficiates presented to clients which they asked to trust. Sure the root might be safe but if a server is cracked can't it be made to preesent a subistitued certificate or would that require a complete rebuild of the server.
Anyway, I am not secuirty expert. I just wanted to explore the limits of PKI deployment.
You can deploy certifcates through active directory in relative safety.Quote:
My concern more about the security of the ceritficiates presented to clients which they asked to trust
You've misunderstood how PKI works. To effectively pull this off an attacker would have to replace:Quote:
Sure the root might be safe but if a server is cracked can't it be made to preesent a subistitued certificate or would that require a complete rebuild of the server.
1) The root CA on both the client and server.
2) the Private cert on the server.
3) the Public cert on the client.
If this isn't done the MD5/SHA1 fingerprints wont match and you'll get warned by your browser (or whatever application). However, if the attacker is in a position to do this then theres much more interesting games to be played.
The only reasonable attack surrounding PKI is if an attacker comprimises the machine that generates the public/private certifcates. Allowing him to generate his own that are trusted by your machines (due to being signed by your root CA cert). This is why I recommended to keep the machine/data safe.
Oh OK. That makes a lot more sense now. I'd still say server security is marginally more important. SSL only encrypts conmunication on the wire. Once you have the server you have one of the endpoints. Eve can pick up voicemail from Alice on Bob's home phone.
Anyway Geoff guess you'd never thought you'd ever read yourself saying
:)Quote:
You can deploy certifcates through active directory in relative safety.
Oh I agree. If you've cracked the server it's game over. All the clients are at your mercy.Quote:
Once you have the server you have one of the endpoints.
Active Directory is a fine solution up to a point. It does have it's limitations of course, just like any system. As long as you don't hit them, carry on merrily.Quote:
Anyway Geoff guess you'd never thought you'd ever read yourself saying
:)Quote:
You can deploy certifcates through active directory in relative safety.