zlacker

[parent] [thread] 1 comments
1. london+(OP)[view] [source] 2022-02-08 18:17:37
I have used it. It works. Tooling is still pretty poor. Every use, we ended up bringing the necessary people into a room, booting up an offline laptop from a sha-summed live USB, QR code scanning each of our secrets, combining them, then using the key to sign whatever we needed to sign, photographing the signature as a QR code. We use software from 2008 because an OS stack contains code from tens of thousands of developers, and we felt old software was less likely to have an active 'steal these keys and exfiltrate them via open wifi' malware.

We would first go through the process with 'dummy' keys to check everyone was happy with the process and what we were going to do (ie. which commands, what software, what exactly will be signed). We would then do it again with the real thing. And then we'd power off the computer till next time it needed to be used.

"Clunky" would be a good way to describe it... But it's hard to make it better without relying on a bunch of software we don't have the resources to audit.

replies(1): >>duxup+h6
2. duxup+h6[view] [source] 2022-02-08 18:43:25
>>london+(OP)
Yeah it seems very much like an elegant solution whose usage would be a bit of its own kind of beast to deal with.
[go to top]