Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a couple of private keys that I use to administer Amazon EC2 instances.

I recently lost these keys when I did a re-install of my computer and I found out that the CD-RW I'd backed them up to was unreadable. So, I'm looking for a slightly more robust backup solution and I'm thinking about using something like Dropbox, because it uses SSL for confidentiality of transport and then my data is stored securely.

Is the risk I take backing up my keys on a service like this purely that the provider could screw up or be corrupt, or have I missed something else?


Update: The private keys have a pass phrase.

share|improve this question
6  
I'd encrypt the keys prior to shipping them to any third party, but that's just me. I'm not very trusting of infrastructure I don't support. –  Evan Anderson Mar 13 '12 at 21:15
1  
@EvanAnderson Of course, then you have to store the encryption keys somewhere. –  ceejayoz Mar 13 '12 at 21:41
    
Brabster, these private keys are ordinarily stored encrypted to a passphrase known only to you, yes? Or are you asking us about the wisdom of storing unencrypted private keys on a cloud service? –  MadHatter Mar 13 '12 at 21:42
    
@ceejayoz: I'm talking about encrypting them with a passphrase known only to me and storing that key in my head. –  Evan Anderson Mar 13 '12 at 21:59
    
Yes, using a pass phrase on my keys. –  Brabster Mar 14 '12 at 21:46
add comment

1 Answer

up vote 10 down vote accepted

There's also the whole "Dropbox can read your stuff" problem.

What you should do is encrypt everything before putting it into Dropbox. Use something like KeePass as a secrets vault. Put a good password on it. KeePass will encrypt locally, before putting your stuff into Dropbox. You will then use KeePass on other computers to access those secrets.

Take a look at:

http://superuser.com/questions/351525/is-keeping-a-keepass-file-in-dropbox-safe

So, in summary, encrypt locally. Use Dropbox to sync those encrypted files.

share|improve this answer
    
But that gets you into a chicken-and-egg problem; the private keys you encrypt have themselves to be encrypted to a private key. Where do you keep copies of that private key? –  MadHatter Mar 13 '12 at 21:30
1  
You keep the master password in your head. Maybe also on a slip of paper in a bank vault if you get hit by a bus, and your wife needs to open the files. –  cjc Mar 13 '12 at 21:30
    
Unless I'm gravely mistaken, very few things that offer decent encryption actually encrypt to a passphrase; few human beings can reliably remember passphrases with enough entropy. Instead, they create nonce keys, encrypt to those, and store the encrypted nonce key under the passphrase. That given, where do you keep that nonce key? –  MadHatter Mar 13 '12 at 21:32
    
Well, the discussion of the KeePass's key derivation is at keepass.info/help/base/security.html#seckeyhash and my passphrase is 30+ characters long. Yes, the passphrase has less entropy than a properly generated encryption key, but I believe it's more than sufficient for this purpose. –  cjc Mar 13 '12 at 21:36
    
And that's a fair enough belief. But if you hold it, then where's the harm in uploading encrypted private keys to the cloud as-is, as the original poster proposed to do? –  MadHatter Mar 13 '12 at 21:40
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.