The great thing about public key cryptography is that anyone can generate a keypair, keep the private key secret and publish the public key anywhere they want. This is used in CAs where an administrator presents a CSR containing a public key and gets a certificate back with the same public key signed. It's also used by Github to allow users to do Git operations via SSH.
Both asymmetric keys and passwords can thus used as a credential. There's a lot written about best practices for passwords, but I was wondering if there are also similar best practices for asymmetric keys? Length is a factor of course (the internet tells me that my RSA key should be at least 2048 bits and that my ed25519 key should be at least 256 bits). Still, even when a key has the correct length, it may be generated by a bad random generator (Debian key).
Do (should) services where the customer has to provide a public key, check this public key for weaknesses? What kind of weaknesses could a key be tested for? How would you test for these?
Some tests that I think might be useful:
- The bit length is appropriate for the algorithm the key is used for (best practices?)
- The key is not a known compromised key (public databases?)
- The key is not generated using a bad random generator (how would you test this?)