Best practices/HOWTO for key storage in small office/home office setting?

[Arnold G. Reinhold]

Here are a few suggestions:

o Use mini-CD-R's for key storage. There is even a rectangular, 
credit-card sized format available. (Note that mini-CDs are not 
compatible with slot loading CD drives.)

o Perform all encryption, signing, etc. on a lap top or palm top that 
is kept in a safe or on your person when not in use and is never 
connected to a network.  Transfer files via floppy or memory cards. 
Standard PC's that are physically accessible to strangers or 
connected to networks are not safe for storage of unencrypted keys, 
even for a moment.

o Use strong, randomly selected passphrases, see e.g. diceware.com

o Use Macs, particularly pre-OS-X. The OS has fewer hooks for viruses 
and worms and there are fewer virus templates out there. That doesn't 
mean these machines can't be broken into, only that it takes more 
work.

o Safes should be backed up by a good alarm company. Even the best 
safes afford protection against attack for a matter of hours.

I have some links to information on safes at 
http://world.std.com/~reinhold/truenoise.html#safes


Arnold Reinhold



At 11:26 PM -0700 9/30/2001, Greg Broiles wrote:
>Are list members aware of any helpful resources describing best 
>practices or HOWTOs for protecting cryptographic keys in a small 
>office/home office setting?
>
>I'm aware of the following approaches, given the assumption that 
>good physical security is unavailable -
>
>1.      Store keys & etc on hard disk inside a laptop which is kept 
>in a safe or similar when not in use
>2.      Store keys & etc on -
>        a.      hard disk in removable carrier
>        b.      3.5" floppy/CD/CD-R[W]/Zip disk
>        c.      PCMCIA hard disk
>        d.      PCMCIA memory
>        e.      Compact Flash hard disk
>        f.      Compact Flash memory
>        g.      Storage-only smartcard
>        .. each of which are stored in safe when not in use
>3.      Generate & use keys on crypto smartcard (like Schlumberger's 
>Cryptoflex) which is stored in safe when not in use
>4.      Generate & use keys in dedicated crypto processor board
>5.      Generate & store or generate & use keys stored across 
>network in encrypted form
>
>Obviously, much of the above just rewrites a hard problem (protect 
>this room) into an easier but not entirely solved problem (protect 
>the interior of this safe); and it ignores security for the keys 
>while in active use versus hostile or sloppy software which may be 
>running on the host. It also ignores the use of keystroke recorders 
>or visual/audio surveillance systems to gather content which is 
>available outside of the crypto envelope/tunnel. I'm trying to come 
>up with a list of things people can do to improve (not perfect) 
>their security, with modest expenditures and a little bit of extra 
>effort during operations.
>
>Also, is anyone aware of a currently shipping crypto smartcard 
>reader/card/driver bundle which integrates well with any flavor of 
>PGP or S/MIME mail software? The only example I'm aware of is 
>Litronic's NetSign bundle (Cryptoflex + serial card reader + 
>MSIE/Netscape drivers for $99) which apparently doesn't support USB 
>nor PGP.
>
>
>--
>Greg Broiles
>gbroiles at well.com
>"We have found and closed the thing you watch us with." -- New Delhi 
>street kids
>
>
>
>
>---------------------------------------------------------------------
>The Cryptography Mailing List
>Unsubscribe by sending "unsubscribe cryptography" to 
>majordomo at wasabisystems.com




---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com