Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any benefits for certificate based authentication over the other types of authenitication? When it is common to use it? If the certs are stolen everyone that have them cat authenticate to the system. Is this true?

Regards

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The problems with passwords are that they are typically reused and easy to guess, so they are easy to compromise and one compromise often leads to multiple compromises. In a simplistic sense, a private key is just like a very long, very difficult to guess password, which makes brute forcing harder.

If the key is stolen, it's the same as a password being stolen and the same considerations need to be in place (is it used elsewhere?). If the certificate is stolen, in theory other keys could have been generated so yes, you need to re-issue every key associated with it. Typically though, if this happens, you've got bigger issues (how did this happen in the first place?).

See here for more discussion of the pros/cons.

share|improve this answer
1  
This is a bit over-simplified. One of the most significant benefits of keys over passwords is that the private key is never sent between the servers (or ideally never exists in more than one place), making it much less likely to be exposed or stolen. (A malicious server or man in the middle can't steal the private key) –  Slartibartfast Nov 10 '10 at 3:15
    
Good point, although a man in the middle can still cause problems, and for SSH (which I believe he's talking about), the password would not be send in plaintext. –  James Lawrie Nov 10 '10 at 11:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.