Ask HN: One SSH key or many SSH keys?

3 points by htunnicliff 20 hours ago | 4 comments

Is there any benefit to using multiple, separate keys to authenticate to different resources versus only using a single SSH key?

On one hand, I've heard that an SSH key is supposed to represent an identity, so using your "identity" everywhere makes sense.

On the other hand, I've heard that keeping SSH keys separate is important in the same way using separate passwords for different resources is important.

What do you all think?

ecesena 5 hours ago |

One per device seems a good rule of thumb. If you have 2 laptops, each gets a diff ssh key, and then you config both in github/server(s).

It's slightly more painful to setup, but you get more flexibility later on in case you loose one key you have the other, and in case you need to cancel just one you can.

If you use hardware security keys, you get one per device naturally.

gmuslera 17 hours ago |

It is not exactly like using the same password in multiple sites because you just need one remote site that stores your password in plain text or simple enough to reverse to compromise all the accounts that use the same password. For asymmetric encryption is the private part the one that should be safe (assuming the right algorithms) and just you should have access to it. If someone/something else can access/use them directly or indirectly then they may get compromised. And that may be a guide on why having multiple certificates, because you can discriminate with passphrases against i.e. local agents.

bigfatkitten 17 hours ago |

I like using short-lived SSH certificates, and avoiding long-lived keypairs entirely.

Vendor post but it summarises the operational and security problems well.

https://smallstep.com/blog/use-ssh-certificates/

JasonYellow 18 hours ago |

I prefer three: one for particularly important projects, one for normal projects, and one where security isn't a major concern.