Automated Search for Leaked Private Keys on the Internet: Has Your Private Key Been Pwned?

Hosseini, Henry; Rengstorf, Julian; Hupperich, Thomas


Zusammenfassung

Public key authentication is widely used alternatively to password-based credentials, enabling remote login with a generated key pair consisting of a private key and a public key. Like passwords, private keys are required to remain confidential to prevent unauthorized access to resources. These secrets might become subject to theft or publicly exposed unintentionally by the key’s owner. In such cases, the keys are deemed compromised and need to be revoked and abandoned instantaneously. Unfortunately, it is rarely possible for users to know whether their secret keys have been publicly exposed. 

Closing this gap, we introduce a private key leakage checker titled KeyPwned crawling the Internet for exposed authentication keys. We present a continuously updated database of leaked keys’ fingerprints discovered on websites or in source code repositories. For community-driven enhancement, we allow suggestions of URLs to scan for additional leaked keys, following our standardized process. We furthermore offer users a registration with their public keys to be notified if we detect leakage of their corresponding private key. KeyPwned is designed to run as a service following common software design standards, empowering users to verify their keys’ confidentiality and take action if a private key has been exposed.

Schlüsselwörter
Public Key Authentication; Leakage Detection; Security Services



Publikationstyp
Forschungsartikel in Sammelband (Konferenz)

Begutachtet
Ja

Publikationsstatus
Veröffentlicht

Jahr
2022

Konferenz
International Conference of Software Technologies (ICSOFT)

Konferenzort
Lisbon

Buchtitel
Proceedings of the 17th International Conference on Software Technologies

Herausgeber
SciTePress

Erste Seite
649

Letzte Seite
656

Verlag
SciTePress

Ort
Lisbon, Portugal

Sprache
Englisch

ISSN
2184-2833

ISBN
978-989-758-588-3

DOI