I ask this question because, I think, we now can reasonably assume the following

Question

I ask this question because, I think, we now can reasonably assume the following:

1. NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and boasted) about this capability in the wild.
2. NSA has a database of stolen keys: They can somehow get SSH keys. The slides imply they have a database of stolen keys (I think it says something like, 'check to see if key in DB').
3. It is easier to steal the private/public keys than it is to steal the TOTP from my air-gap'd phone/ipod touch.

If it is true that agencies can easily acquire keys, then would it not make more sense to use password + google TOTP second factor authentication for each SSH login?

It seems google's TOTP second factor authentication does not work out-of-the-box if publickeyauth is used. So, there is a temptation to disable public keys and use only password + second factor.

Taking the latest leaks into account, if I have to choose between public key auth and password + TOTP second auth, which is better in terms of security? (I explicitly cannot use both).

(I don't care about convenience, they are both the same for me).

Thank you.

Explanation / Answer

If the second factor is something that you have, and that cannot be copied, then it can be very secure.

RSA tokens (as was shown by the Lokheed Martin breach) may be physically secure, but if the backend is hacked, then they can be completely compromised. Which is why the mass recall/replace of RSA tokens was carried out.

The answer will depend entirely on your risk/threat model. If you are an NSA target I would imagine it won't matter either way. (In reality it doesn't look like there is any proof they can break SSH - just that they are very good at getting around it)

How well does your infrastructure/processes protect an SSH key? How good are your users at protecting a 2nd factor? Is that 2nd factor an SMS? Or a physical device? Or a phone call?

You can see why this is not an easy question to give a definitive answer to.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.