up vote 0 down vote favorite
share [g+] share [fb]

I was rotating my AWS X.509 certificate and private key (not to be confused with ssh private / public key pair) today and decided I wanted to set a pass-phrase on my private key to better protect it. So I did a bit of research and ran :

openssl rsa -in awsprivatekey.pem -des3 -out awsprivatekey.pem.new

and entered a pass-phrase for the private key. After I attempted to use the ec2 api tools I got an error :

java.io.IOException: DER length more than 4 bytes

This became obvious when I researched the topic and found out this link ec2 api tools don't support a private key with a password

I'm troubled by the lack of information about this and the status-quo of having un-protected private keys with something as crucial as Amazon EC2.

Any suggestions on how to better protect my private key?

link|improve this question
70% accept rate
As far as I'm aware, there's no session tokens or other authentication state tracking with Amazon's API, so do you really want to be entering a passphrase for every single command you execute? – SmallClanger Jul 1 '11 at 12:34
Good point...I guess I'll just keep it on an encrypted volume as suggested and rotate the key every so often. I am only using it interactively so it won't make that much of a difference workflow wise. – Hilt86 Jul 2 '11 at 4:35
feedback

1 Answer

up vote 1 down vote

Keep them on TrueCrypt encrypted disk. They will be stored secure while you don't need them, and you would mount it only once you really need to use them. TrueCrypt creates a file, which then is mounted as virtual disk.

Edit: If you need to protect it in a code which is not interactive, you could obviously encrypt the private key and decrypt it you application code. There is a plenty of samples how to decrypt file with Java.

link|improve this answer
Or encfs or ecryptfs. – mgorven Apr 19 at 1:12
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.