Document the choice between multiple master SSH keys/passphrases or not
Marco Ricci commited on 2026-04-05 22:33:26
Zeige 6 geänderte Dateien mit 28 Einfügungen und 5 Löschungen.
Like the previous three documents, this one too is very preliminary, but the main points are all present.
- docs/_future.md ed744b5..f3dd55e
- docs/explanation/index.md 25259bf..3352107
- docs/explanation/many-master-secrets.md 0000000..0148a12
- docs/how-tos/ssh-key.md b4d94c1..465250f
- mkdocs.yml 0a733b3..d406903
- mkdocs_devsetup.yml 1ffa480..f2193f2
| ... | ... |
@@ -55,8 +55,4 @@ |
| 55 | 55 |
### Explanation |
| 56 | 56 |
|
| 57 | 57 |
* Security aspects and other tradeoffs when using deterministic password generators |
| 58 |
-* Should I use one master SSH key/master passphrase, or many? (→ [TODO][HOW_TO_SSH_KEY]) |
|
| 59 | 58 |
* Why is `vault`'s `--repeat` option named this way if it counts occurrences, not repetitions? |
| 60 |
- |
|
| 61 |
-[BASIC_SETUP_PASSPHRASE]: tutorials/basic-setup-passphrase.md |
|
| 62 |
-[HOW_TO_SSH_KEY]: how-tos/ssh-key.md |
| ... | ... |
@@ -8,7 +8,9 @@ title: Explanation overview |
| 8 | 8 |
in practice?][FAQ_INTERCHANGABLE_PASSPHRASES] |
| 9 | 9 |
* [Tradeoffs between a master passphrase and a master SSH |
| 10 | 10 |
key][TRADEOFFS_PASSPHRASE_SSH_KEY] |
| 11 |
+* [Should I use one master SSH key/master passphrase, or many?][MANY_MASTER_SECRETS] |
|
| 11 | 12 |
|
| 12 | 13 |
[FAQ_ALTERED_VERSIONS]: faq-altered-versions.md |
| 13 | 14 |
[FAQ_INTERCHANGABLE_PASSPHRASES]: faq-vault-interchangable-passphrases.md |
| 14 | 15 |
[TRADEOFFS_PASSPHRASE_SSH_KEY]: tradeoffs-passphrase-ssh-key.md |
| 16 |
+[MANY_MASTER_SECRETS]: many-master-secrets.md |
| ... | ... |
@@ -0,0 +1,22 @@ |
| 1 |
+# Should I use one master SSH key/master passphrase, or many? |
|
| 2 |
+ |
|
| 3 |
+Generally, using multiple master SSH keys or master passphrases partitions the `derivepassphrase` configuration into sets such that the compromise of one master SSH key/master passphrase compromises all passphrases within that set of configurations. |
|
| 4 |
+ |
|
| 5 |
+However, using multiple master SSH keys or master passphrases also means that multiple SSH keys or passphrases must be managed. |
|
| 6 |
+ |
|
| 7 |
+## Multiple master SSH keys |
|
| 8 |
+ |
|
| 9 |
+Managing multiple master SSH keys is conceptually no different than managing a single key. |
|
| 10 |
+ |
|
| 11 |
+`derivepassphrase vault` can record which master SSH key to use for each configuration. |
|
| 12 |
+ |
|
| 13 |
+## Multiple master passphrases |
|
| 14 |
+ |
|
| 15 |
+Managing multiple master passphrases is somewhat more difficult. |
|
| 16 |
+The user must choose multiple high-quality master passphrases. |
|
| 17 |
+If passphrases are memorized (as is recommended), then this puts a much higher cognitive load on the user than keeping multiple master SSH keys. |
|
| 18 |
+ |
|
| 19 |
+Furthermore, `derivepassphrase vault` cannot record which master passphrase to use for each configuration, beyond storing the respective master passphrase itself (which is a **grave security risk**). |
|
| 20 |
+The user must thus find a different (usually out-of-band) way to associate each configuration with its matching master passphrase. |
|
| 21 |
+ |
|
| 22 |
+Due to these logistical difficulties, from a purely operational standpoint, using multiple master passphrases **is not recommended**. |
| ... | ... |
@@ -301,7 +301,7 @@ Next, configure `derivepassphrase vault` to use the loaded SSH key. |
| 301 | 301 |
|
| 302 | 302 |
!!! abstract "Further reading" |
| 303 | 303 |
|
| 304 |
- → Should I use one master SSH key/master passphrase, or many? (TODO) |
|
| 304 |
+ → [Should I use one master SSH key/master passphrase, or many?][MANY_MASTER_SECRETS] |
|
| 305 | 305 |
|
| 306 | 306 |
<aside markdown> |
| 307 | 307 |
|
| ... | ... |
@@ -320,3 +320,4 @@ Next, configure `derivepassphrase vault` to use the loaded SSH key. |
| 320 | 320 |
[PREREQ]: ../reference/prerequisites-ssh-key.md |
| 321 | 321 |
[PREREQ_AGENT_SPECIFIC_NOTES]: ../reference/prerequisites-ssh-key.md#agent-specific-notes |
| 322 | 322 |
[TRADEOFFS_PASSPHRASE_SSH_KEY]: ../explanation/tradeoffs-passphrase-ssh-key.md |
| 323 |
+[MANY_MASTER_SECRETS]: ../explanation/many-master-secrets.md |
| ... | ... |
@@ -123,6 +123,7 @@ nav: |
| 123 | 123 |
- '"altered versions" license requirement': explanation/faq-altered-versions.md |
| 124 | 124 |
- '"interchangable passphrases" in vault': explanation/faq-vault-interchangable-passphrases.md |
| 125 | 125 |
- tradeoffs between passphrase & SSH key: explanation/tradeoffs-passphrase-ssh-key.md |
| 126 |
+ - explanation/many-master-secrets.md |
|
| 126 | 127 |
- Changelog: |
| 127 | 128 |
- Changelog: changelog.md |
| 128 | 129 |
- Upgrade notes: upgrade-notes.md |
| ... | ... |
@@ -74,6 +74,7 @@ nav: |
| 74 | 74 |
- '"altered versions" license requirement': explanation/faq-altered-versions.md |
| 75 | 75 |
- '"interchangable passphrases" in vault': explanation/faq-vault-interchangable-passphrases.md |
| 76 | 76 |
- tradeoffs between passphrase & SSH key: explanation/tradeoffs-passphrase-ssh-key.md |
| 77 |
+ - explanation/many-master-secrets.md |
|
| 77 | 78 |
- Changelog: |
| 78 | 79 |
- Changelog: changelog.md |
| 79 | 80 |
- Upgrade notes: upgrade-notes.md |
| 80 | 81 |