> > When generating large keys I just keep running "ls -R /" until the
> > key generation completes. You can also use the keyboard. Install
> > a hardware random number generator and configure the kernel to use
> > it (might require a OS change as I don't know if this is supported
> > under Linux).
> >
> > Mark
>
> And based on my reading of the intro these keys need to be updated at least
> monthly?
>
> Michael
The frequency keys need to be changed is based on their
strength (size). The current recommendations are very
conservitive and also factor in that humans need to repeat
operations regularly to get them correct and not forget how
to do the rollover. From a crypto standpoint alone you,
generally, don't need to roll keys monthly.
As more and more automation takes place the frequency of
rolling keys will fall more and more into line with their
crypto strength rather than be driven by human requirements.
SSL certificates are valid for multiple years and they use
the same crypto. They are also simpler to use at this point
in time. Buy and copy into place.
Mark
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: [EMAIL PROTECTED]
