Balabit - XCA and GPG keys
Balabit SCB Solution · Config document · referenced from Certificates and keys, Audit trails: encryption and replay and Backup, archive and retention
note
<XCA_DATABASE_PASSWORD> and <KEY_PASSPHRASE> are placeholders: my notes kept the real database password and passphrases next to the key names, which is not something to copy. <COUNTRY> and <SHA256_FINGERPRINT> are placeholders too, and "Example Org" stands for the organisation. The last site 2 block is headed "Site 1" although the key is a site 2 one (a copy-and-paste slip).The keys of both sites that I kept outside the SCB: the X.509 key pairs for the audit trails in the XCA database BALABIT-x509.xdb (a shared encryption key, a signing key and one encryption key per auditor for each site), the GPG key pair SCB-BACKUP for the configuration backup, and the parameters with which the design asked for them to be made.
| Item | Value |
|---|---|
| Tool | XCA, a desktop program that keeps keys, requests and certificates in one database file and protects the private keys with a password (general knowledge) |
| Database | BALABIT-x509.xdb, one password for the file, one passphrase per key |
| Site 1 keys | SCB-AUDIT-ENCRYPT, SCB-AUDIT-SIGN, SCB-AUDIT-ENCRYPT-admin01, -admin05, -admin07, -admin08, -admin09 |
| Site 2 keys | the same set with -DC2 in the name |
| Key type | RSA 2048 for every key; the certificates in my folder are self-signed with SHA-256 and valid ten years |
| GPG key | SCB-BACKUP, RSA 2048, scb_mail@ad.example.net, no expiry |
| Sources | my XCA key notes of both sites; the GPG section of my working notes; design document v0.5 of 2017-12-01, chapters 4.10.2 and 4.10.3 |
The listing
output 204 lines
# XCA key notes of both sites ======================================================= XCA - CERTIFICATES + KEYS ======================================================= Database: BALABIT-x509.xdb Password: <XCA_DATABASE_PASSWORD> ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-SIGN ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-SIGN Keytype: RSA Keysize: 2048 Purpose: Sign Balabit SCB audit trails. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT-admin01 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-admin01 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin01. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT-admin05 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-admin05 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin05. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT-admin07 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-admin07 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin07. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT-admin08 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-admin08 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin08. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT-admin09 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-admin09 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin09. ------------------------------------------------------- ======================================================= XCA - CERTIFICATES + KEYS ======================================================= Database: BALABIT-x509.xdb Password: <XCA_DATABASE_PASSWORD> ------------------------------------------------------- ======================================================= Site 2 - SCB-AUDIT-ENCRYPT-DC2 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-DC2 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails. ------------------------------------------------------- ======================================================= Site 2 - SCB-AUDIT-SIGN-DC2 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-SIGN-DC2 Keytype: RSA Keysize: 2048 Purpose: Sign Balabit SCB audit trails. ------------------------------------------------------- ======================================================= Site 2 - SCB-AUDIT-ENCRYPT-DC2-admin01 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-DC2-admin01 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin01. ------------------------------------------------------- ======================================================= Site 2 - SCB-AUDIT-ENCRYPT-DC2-admin05 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-DC2-admin05 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin05. ------------------------------------------------------- ======================================================= Site 2 - SCB-AUDIT-ENCRYPT-DC2-admin07 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-DC2-admin07 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin07. ------------------------------------------------------- ======================================================= Site 2 - SCB-AUDIT-ENCRYPT-DC2-admin08 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-DC2-admin08 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin08. ------------------------------------------------------- ======================================================= Site 1 - SCB-AUDIT-ENCRYPT-DC2-admin09 ======================================================= Pass: <KEY_PASSPHRASE> Name: SCB-AUDIT-ENCRYPT-DC2-admin09 Keytype: RSA Keysize: 2048 Purpose: Encrypt Balabit SCB audit trails - admin09. ------------------------------------------------------- # Working notes, GPG section ======================================================= CERTIFICATES + KEYS - GPG ======================================================= SCB-BACKUP <KEY_PASSPHRASE> ------------------------------------------------------- Algorithm: RSA Key Length (bits): 2048 Name: SCB-BACKUP E-mail: scb_mail@ad.example.net Comment: SCB backup encryption Expires: No ======================================================= # Design document v0.5, chapter 4.10.2: the GPG key pair for the configuration backup | Parameter | Value | | NAME | SCB-BACKUP | | ALGORITHM | RSA | | KEY LENGTH (BITS) | 2048 | | E-MAIL | scb_mail@ad.example.net | | COMMENT | SCB backup encryption | | EXPIRES | No | # Design document v0.5, chapter 4.10.3: the X.509 pair for audit trail encryption | Parameter | Value | | NAME | SCB-AUDIT-ENCRYPT | | ALGORITHM | RSA | | KEY LENGTH (BITS) | 2048 | | SIGNATURE ALGORITHM | SHA256 | | EXPIRES | 18. august 2027 12:48:00 | | SUBJECT – COUNTRY | <COUNTRY> | | SUBJECT – LOCALITY | Site 1 | | SUBJECT – ORGANIZATION NAME | Example Org | | SUBJECT – ORGANIZATION UNIT NAME | example.net | | SHA256 FINGERPRINT | <SHA256_FINGERPRINT> | # Design document v0.5, chapter 4.10.3: the X.509 pair for signing audit trails | Parameter | Value | | NAME | SCB-AUDIT-SIGN | | ALGORITHM | RSA | | KEY LENGTH (BITS) | 2048 | | SIGNATURE ALGORITHM | SHA256 | | EXPIRES | 18. august 2027 12:52:00 | | SUBJECT – COUNTRY | <COUNTRY> | | SUBJECT – LOCALITY | Site 1 | | SUBJECT – ORGANIZATION NAME | Example Org | | SUBJECT – ORGANIZATION UNIT NAME | example.net | | SHA256 FINGERPRINT | <SHA256_FINGERPRINT> |
| Entry | What it means |
|---|---|
Purpose: Encrypt Balabit SCB audit trails. | the shared encryption key of a site; its certificate is the one the design's audit policy names |
Purpose: Sign Balabit SCB audit trails. | the signing key. Its private key is uploaded to the SCB, which signs with it; the auditors need only its certificate |
SCB-AUDIT-ENCRYPT-adminNN | one encryption key per auditor (admin01, admin05, admin07, admin08, admin09). My working notes list the same keys for site 1 without admin09; the decryption how-to names admin01, admin05, admin07 and admin08 as the persons allowed to decrypt |
SCB-BACKUP, <KEY_PASSPHRASE> | the GPG key pair; only its public key went to the SCB (chapter 7 of the design shows PUBLIC GPG KEY = SCB-BACKUP), the passphrase is in my notes |
EXPIRES 2027 | the certificates of the shared site 1 pair end ten years after they were made on 18 August 2017; see the certificate inventory |
SHA256 FINGERPRINT | the design recorded the fingerprints of both certificates; they are placeholders here |
The listing does not say where the database file and the exported private keys were kept, nor who held the database password. The decryption how-to only advises keeping an auditor's private key on the auditor's own PC.
Checked against XCA 2.9.0 and Safeguard for Privileged Sessions 9.0
| As built | Today |
|---|---|
| XCA database made in 2017 (XCA 1.x; 2.0.0 came out in April 2018) | XCA 2.0.0 moved the database to SQLite and stores private keys PKCS#8-encrypted; XCA 2.5.0 dropped support for databases older than 2.0.0, so a 1.x database has to be converted by an XCA release between 2.0 and 2.4 first |
| Encryption certificates made outside the SCB | still necessary: SPS cannot create the certificates that encrypt audit trails; it needs X.509 certificates with RSA keys in PEM format |
| Signing certificate from XCA | SPS 9.0 requires its extended key usage to be "Sign (downloadable) executable code" |
GPG key SCB-BACKUP, RSA 2048, no expiry | SPS still encrypts the configuration backup with the public part of a GPG key and does not accept signing-only keys; GnuPG has defaulted to ed25519/cv25519 keys since 2.3.0 and to a three-year expiry since 2.4.3. Whether SPS accepts an ECC key is not documented |
A new pair made today with GnuPG's defaults would expire after three years, which is worth knowing for a key that protects backups.