We're deploying some IOT devices at work, and I think we're going to be assigning an ssh key to each device and then storing their public key so that we decrypt their traffic.

The private key never leaves the device, and I don't think public keys are secrets. However, I'm not 100% sure that's okay.

Can someone provide insight into the problems (security or otherwise) with this approach?

  • How exactly do you intend to get the plain text with only the public key? Public keys are not secrets. – John Mahowald Jan 3 at 15:39
  • @JohnMahowald I'm not sure I understand your question, but they will specify which public key to use in the header of their HTTP request and we'll get that public key to decrypt their payload. If it decrypts successfully, then they have that devices private key and are authorized to act as that device. Does that answer your question or is there something else? – CallMeNorm Jan 3 at 16:22
  • 1
    @CallMeNorm we'll get that public key to decrypt their payload -- The public key cannot be used to decrypt. The entire point of public/private keys is that it is one way only. Encrypt with public, decrypt with private. – Zoredache Jan 3 at 22:47
  • I was just reading about keys again today when I had this exact same realization. Thanks for pointing this out. Is there established ways to use public keys for authorization and authentication over HTTP that are accessible? – CallMeNorm Jan 6 at 22:50

What are the sizes of the keys? If your RSA keys are not at least 4096 bits they are at risk of being reversed, and your private keys revealed.

|improve this answer|||||
  • I was planning on using the ed25519 type of key, and it looks like the public key size doesn't change based on the number of bits. – CallMeNorm Jan 3 at 15:31
  • 1
    With ed25519 you are good to go, no worries – Yevhen Stasiv Jan 3 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.