Distributed SSH key management with proactive RSA threshold signatures

Yotam Harchol, Ittai Abraham, Benny Pinkas

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

6 Scopus citations


SSH is a security network protocol that uses public key cryptography for client authentication. SSH connections are designed to be run between a client and a server and therefore in enterprise networks there is no centralized monitoring of all SSH connections. An attractive method for enforcing such centralized control, audit or even revocation is to require all clients to access a centralized service in order to obtain their SSH keys. The benefits of centralized control come with new challenges in security and availability. In this paper we present ESKM - a distributed enterprise SSH key manager. ESKM is a secure and fault-tolerant logically-centralized SSH key manager. ESKM leverages k-out-of-n threshold security to provide a high level of security. SSH private keys are never stored at any single node, not even when they are used for signing. On a technical level, the system uses k-out-of-n threshold RSA signatures, which are enforced with new methods that refresh the shares in order to achieve proactive security and prevent many side-channel attacks. In addition, we support password-based user authentication with security against offline dictionary attacks, that is achieved using threshold oblivious pseudo-random evaluation. ESKM does not require modification in the server side or of the SSH protocol. We implemented the ESKM system, and a patch for OpenSSL libcrypto for client side services. We show that the system is scalable and that the overhead in the client connection setup time is marginal.

Original languageEnglish
Title of host publicationApplied Cryptography and Network Security - 16th International Conference, ACNS 2018, Proceedings
EditorsBart Preneel, Frederik Vercauteren
PublisherSpringer Verlag
Number of pages22
ISBN (Print)9783319933863
StatePublished - 2018
Event16th International Conference on Applied Cryptography and Network Security, ACNS 2018 - Leuven, Belgium
Duration: 2 Jul 20184 Jul 2018

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume10892 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Conference16th International Conference on Applied Cryptography and Network Security, ACNS 2018

Bibliographical note

Publisher Copyright:
© Springer International Publishing AG, part of Springer Nature 2018.


Dive into the research topics of 'Distributed SSH key management with proactive RSA threshold signatures'. Together they form a unique fingerprint.

Cite this