RE: key storage

[Frank Knobbe <frank () knobbe us>]

On Fri, 2004-09-03 at 08:48, Mark Curphey wrote:
> The one exception is SSL / TLS where the aim should be to offload it where
> the transport terminates i.e. in the dmz.

And the really paranoid can offload it in such a fashion that the SSL
keys are not available to intruders (i.e. into the web server). If you
offload the storage of the SSL keys to a device inaccessible to an
attacker (i.e. load-balancer), you eliminated the key compromise
altogether.

Shops with SSL terminating load-balancers (for intrusion detection
reasons) already take advantage of that... although they are mostly
unaware of that :)

Cheers,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part