making it impossible to change a secure key passphraseHow do I change my private key passphrase?How to tell if a public SSH key has a passphraseHow do I change my private key passphrase?SSH passphrase remembered in MacOSX Snow Leopardssh key requires passphrase after viewing itHow to use openssh sftp command with a RSA/DSA key specified from the command line“Add correct host key in known_hosts” / multiple ssh host keys per hostname?autossh -> private key without passphraseSSH with DSA 2048 bits keyChanging the ssh passphrase on a private key has no effectMy passphrase does not work anymore?
Multi tool use
Convert camelCase and PascalCase to Title Case
Is the capacitor drawn or wired wrongly?
How to pass a regex when finding a directory path in bash?
Word for a small burst of laughter that can't be held back
Is it legal in the UK for politicians to lie to the public for political gain?
What's the correct term for a waitress in the Middle Ages?
Is the decompression of compressed and encrypted data without decryption also theoretically impossible?
You've spoiled/damaged the card
How to make a setting relevant?
What is the purpose of building foundations?
What are they doing to this poor rocket?
My coworkers think I had a long honeymoon. Actually I was diagnosed with cancer. How do I talk about it?
Diet Coke or water?
Could the Missouri River be running while Lake Michigan was frozen several meters deep?
Shrink exponential fraction argument
Building a road to escape Earth's gravity by making a pyramid on Antartica
The ring of global sections of a regular scheme
Traffic law UK, pedestrians
Company is asking me to work from overseas, but wants me to take a paycut
California: "For quality assurance, this phone call is being recorded"
What flavor of zksnark in tezos
Linux tr to convert vertical text to horizontal
What is the right way to float a home lab?
What happened to all the nuclear material being smuggled after the fall of the USSR?
making it impossible to change a secure key passphrase
How do I change my private key passphrase?How to tell if a public SSH key has a passphraseHow do I change my private key passphrase?SSH passphrase remembered in MacOSX Snow Leopardssh key requires passphrase after viewing itHow to use openssh sftp command with a RSA/DSA key specified from the command line“Add correct host key in known_hosts” / multiple ssh host keys per hostname?autossh -> private key without passphraseSSH with DSA 2048 bits keyChanging the ssh passphrase on a private key has no effectMy passphrase does not work anymore?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
According to this:
How do I change my private key passphrase?
it is possible to change your private RSA/DSA key passphrase any time. Is there a way to generate a key with a passphrase that is set once and can not be altered?
ssh encryption
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
add a comment |
According to this:
How do I change my private key passphrase?
it is possible to change your private RSA/DSA key passphrase any time. Is there a way to generate a key with a passphrase that is set once and can not be altered?
ssh encryption
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
If you wanted to have an unchangeable private key, then you would probably need to consider looking at hardware based keys. IE a private key exists on a physical token.
– Zoredache
May 19 at 5:56
add a comment |
According to this:
How do I change my private key passphrase?
it is possible to change your private RSA/DSA key passphrase any time. Is there a way to generate a key with a passphrase that is set once and can not be altered?
ssh encryption
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
According to this:
How do I change my private key passphrase?
it is possible to change your private RSA/DSA key passphrase any time. Is there a way to generate a key with a passphrase that is set once and can not be altered?
ssh encryption
ssh encryption
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
asked May 18 at 23:00
Boris EpsteinBoris Epstein
355
355
If you wanted to have an unchangeable private key, then you would probably need to consider looking at hardware based keys. IE a private key exists on a physical token.
– Zoredache
May 19 at 5:56
add a comment |
If you wanted to have an unchangeable private key, then you would probably need to consider looking at hardware based keys. IE a private key exists on a physical token.
– Zoredache
May 19 at 5:56
If you wanted to have an unchangeable private key, then you would probably need to consider looking at hardware based keys. IE a private key exists on a physical token.
– Zoredache
May 19 at 5:56
If you wanted to have an unchangeable private key, then you would probably need to consider looking at hardware based keys. IE a private key exists on a physical token.
– Zoredache
May 19 at 5:56
add a comment |
1 Answer
1
active
oldest
votes
No, and the question doesn't make sense either. There is no reason for this. A private key is just that.
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f967923%2fmaking-it-impossible-to-change-a-secure-key-passphrase%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
No, and the question doesn't make sense either. There is no reason for this. A private key is just that.
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
add a comment |
No, and the question doesn't make sense either. There is no reason for this. A private key is just that.
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
add a comment |
No, and the question doesn't make sense either. There is no reason for this. A private key is just that.
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
No, and the question doesn't make sense either. There is no reason for this. A private key is just that.
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
answered May 18 at 23:31
Michael Hampton♦Michael Hampton
179k27326659
179k27326659
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
add a comment |
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
It certainly does make sense in some contexts - for example, in the context of ensuring a certain security posture - such as a private key with a mandated passphrase. That makes the mere theft of that private key of little advantage to the bad guy as he is still one authentication factor short of success.
– Boris Epstein
May 19 at 18:00
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
No, you don't "mandate" a passphrase. That's something that stays in your head and is never shared with anyone. Your proposal is a frightening loss of security.
– Michael Hampton♦
May 19 at 18:01
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
@BorisEpstein I wouldn't consider the password on a private key a different factor from the private key itself. I understand that one issue with a user changing their own private key password is they may make it insecure (mom's birthday) or remove it entirely, but perhaps a better solution would be adding a password factor to the login system itself that /can/ be regulated, since this simply isn't possible or advisable for a private key.
– persona15
May 19 at 19:52
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f967923%2fmaking-it-impossible-to-change-a-secure-key-passphrase%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
V3MIkRE,R29K WfnbsRV1o04BWv55JKoQbcxK,M,lve7LWEjpiYhwUqDbFCSkVMpB6dY
If you wanted to have an unchangeable private key, then you would probably need to consider looking at hardware based keys. IE a private key exists on a physical token.
– Zoredache
May 19 at 5:56