1
$\begingroup$

If I want to protect a private RSA key, do I just XOR the password into the key, or do I do something else? Is it secure?

Edit: I got a good answer from a comment - Hash the password/passphrase with PBKDF and use that as a key for AES to encrypt the RSA private key. Also the passphrase is never stored on the disk. The user is prompted to enter it when starting the programm and it is stored in RAM for a limited amount of time(It will be overwritten later and RAM is cleared anyway on shutdown.)

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ a) don't roll your own crypto. b) this would be a vigenere chipher which is inherently broken c) normally you'd encrypt the private key with some trustworthy encryption algorithm like AES-GCM and derive a key for the algorithm using a proper PBKDF like Argon2, scrypt, bcrypt or PBKDF2. $\endgroup$
    – SEJPM
    Commented May 15, 2016 at 10:14
  • 2
    $\begingroup$ Store it in a standard format, which supports the standard password-protection mechanisms. There are loads of libraries that can do that for you. $\endgroup$
    – Henno Brandsma
    Commented May 15, 2016 at 13:41
  • $\begingroup$ PGP would immediately come to mind. Note that I haven't checked upon the OpenPGP standard for some time; I'm not sure how secure it is. But in general using a strong password with key encryption should be fine for data-at-rest. $\endgroup$
    – Maarten Bodewes ♦
    Commented May 16, 2016 at 13:13

1 Answer 1

Reset to default
1
$\begingroup$

First things first: Don't roll your own crypto.

As for your current approach: This is basically a vigenere cipher which is inherently broken, provides not integrity protection and wouldn't even encrypt known / predictable bit positions (where the ASCII code is constant zero or one).

As for an improved version:
Use a well-known encryption algorithm (e.g. AES-GCM) to encrypt and authenticate the key. Don't forget that you have to use a nonce (a number used only once) with it. Do not feed the user password directly into the cipher, but rather feed it into a proper password based key derivation function (PBKDF) (e.g. Argon2, scrypt, bcrypt, PBKDF2). Make sure you use a salt and that it is random and that the derivation parameters are so large that key access takes about 100ms of full CPU load on your system.

Improve this answer
$\endgroup$
6
  • $\begingroup$ Another question: where is it ok to store the salt? $\endgroup$
    – Gordor Jonathan
    Commented May 15, 2016 at 21:26
  • $\begingroup$ The passphrase is never stored on the disk. The user is prompted to enter it when starting the programm and it is stored in RAM for a limited amount of time(It will be overwritten later and RAM is cleared anyway on shutdown.) $\endgroup$
    – Gordor Jonathan
    Commented May 15, 2016 at 21:30
  • $\begingroup$ @GordorJonathan, the salt doesn't need to be secret. You can store it in plain right next to your nonce / ciphertext (but please make sure to authenticate it as associated data with AES-GCM). But anyways please follow Henno's advice if possible and don't roll your own crypto, but use some established key storage and format standard. $\endgroup$
    – SEJPM
    Commented May 15, 2016 at 21:32
  • $\begingroup$ @GordorJonathan, that's sounds like a reasonable security practice regarding the passphrase although, may I suggest to use your favorite crypto libraries memory management functions to allocate the memory? (chances are it has some additional defenses built-in, f.ex. to tell the OS not to swap this portion of the memory out to disk) $\endgroup$
    – SEJPM
    Commented May 15, 2016 at 21:34
  • $\begingroup$ Windows aint swap :D $\endgroup$
    – Gordor Jonathan
    Commented May 15, 2016 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.