Reputation
Top tag
Next privilege 150 Rep.
Create new tags
Badges
5
Impact
~500 people reached

  • 0 posts edited
  • 0 helpful flags
  • 12 votes cast
Sep
8
comment What is the harm if I publish an encrypted RSA private key publicly?
I edited the question a little bit to be more accurate with what it is I'm wishing to do. In this particular use case, it seems that if this described situation is insufficient, I would not be confident in storing the user keys.
Sep
8
comment What is the harm if I publish an encrypted RSA private key publicly?
The only difference is that I'm actually using the public keys, not just verifying a shared secret. Without access to the underlying filesystem or some sort of sniffing, you can't know the full URL without knowing the user ID and the user passphrase. One could brute force their way to find a key, but doing so would be no less difficult than if they were brute forcing a typical login form. I would like to hear more specifics about the bits-of-entropy topic with regard to this particular question.
Sep
7
comment What is the harm if I publish an encrypted RSA private key publicly?
None of that sounds like new info, but it certainly is valuable nonetheless and is appreciated. One of the important details is that the passphrase on the key would be hardened via some key stretching mechanism in order to make local brute force attempts extremely expensive. The keys would, hopefully, be rotated frequently enough such that it would be unlikely that a key could be brute-forced successfully while it's still a usable key. Thanks for your response on this; it's appreciated.
May
25
comment What is the harm if I publish an encrypted RSA private key publicly?
My present understanding is that the only way into the key is via brute forcing. Also, I suggest that this is more secure than a database of password hashes. Unless someone can break into S3 or get the S3 account privileges, no one can list the keys on the server but have to know the URL in order to download a single key, which I suggest is no more security-by-obscurity than a password.