Actions
Forum Thread Details
  • Replies 9 replies
  • Subscribers 511 subscribers
  • Views 1865 views
  • Users 0 members are here
Related

How do you secure you private keys for signed updates

imagiko

I'm reading up on signed updates. Based on my understanding I could embed the public key on all my devices and then any new firmware needs to have a signed hash that I could check against. This is great for secure updates, but I'm wondering how one would securely store the private key. Say I built 1M units. All have this public key programmed. If this private key is lost, I basically lose the ability to update any of these devices. So while it's great for security, it also sounds like the jugular vein. Am I missing something?

Parents

  • What is being alluded to is key management. This includes, creation, distribution and revocation of keys. This is no small task and needs some careful development to avoid pitfalls.  described losing the key as one scenario but think about the consequences of the private key being compromised and it was not known.

     

    An interested exercise is to research what is required to have point of sale by accepting credit cards numbers. The overhead is considerable but card companies understand the risk and what the card collect to invest heavily to minimize it.

Reply

  • What is being alluded to is key management. This includes, creation, distribution and revocation of keys. This is no small task and needs some careful development to avoid pitfalls.  described losing the key as one scenario but think about the consequences of the private key being compromised and it was not known.

     

    An interested exercise is to research what is required to have point of sale by accepting credit cards numbers. The overhead is considerable but card companies understand the risk and what the card collect to invest heavily to minimize it.

Children
  • in reply to colporteur

    It is a hard topic. Where in the past you had a breach when someone could get at your data, now you often have a breach when you or your staff are sloppy with private keys.

     

    And the importance of not being sloppy with keys isn't a habit yet. I've seen them mailed around by accident instead of the public key. In a backup dir of a commercial app after installation. Checked into version control. Placed on a sharepoint in a folder called Private Keys ...

     

    A second hard exercise is how to get keys into the secure storage of a microcontroller during production. I asked that here long time ago but no solutions for this common task:

    Where do you store/hide your AES keys used for embedded encypt and decrypt?

  • in reply to Jan Cumps

    I worked for a ISP who's entire digital television system PKI infrastructure was taken offline when a Windows update of the certificate authority (CA) server went bad. Without the CA all lower certificate servers had a certificate time to live of 24hours. 65K subscribers would lose television if the CA was not back online in less than 24hours. The server was restored before TV service was lost but, all the recording customers had made on their PVR were rendered useless. A new CA could not validate the certificate from the old server. Try explaining to a customer why their whole series of Breaking Bad shows is available in their content but can't be displayed:)

     

    I established a PKI infrastructure for a telecommunication company. Months of planning and process development was required. How keys were requested, how keys were created, how keys were distributed, how keys were installed and how keys were revoked all had to be in place before the first key was issued.  This process is multiplied and modified depending on the type of certificate. Our certificate chain had to integrate with the parent company. It was a milestone project in my career. When completed keys could be available in less than 5 minutes. It took a minimum of one week to get a key before the system was established. 

     

    Speaking of keys, I just discovered ssh information from the key exchange on a session has changed in the known_hosts file. The IP address is no longer traceable. That is something new.