1
$\begingroup$

I'm working on a web service application which uses a self signed certificate. I apologize up front if this turns to be a dumb question. When using openssl for generating private key, it reveals (as per my understanding) the encryption algorithm and initial vector. A bit of googling showed it follows PKCS5. These information of algorithm and key was not present in another private key which followed PKCS8.

  1. Does this mean that PKCS8 has better security ? At present which is most popular and secure, while there is a requirement to store private key in filesystem?
  2. Private key is encrypted with a passphrase and I use the hardcoded passphrase in the code to decrypt it. Is this the right way of using it?
Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ Hard coding secrets in code is generally a bad idea, because such secrets are accessible to anyone with access to the code. $\endgroup$
    – user2768
    Commented Apr 6, 2017 at 14:35

2 Answers 2

Reset to default
0
$\begingroup$
  1. PKCS#5 (RFC2898) is a standard for key derivation, not for key storage. Openssl can store an RSA private key either in its own format (default) or in PKCS#8 format. You can convert a key using the openssl pkcs8 command. Securitywise, there is no difference between the two.
  2. You should rather store the password in a configuration file or make the user type it when starting the server software. Otherwise, you would have to recompile and reinstall your whole software, everytime you change the key's password or the key itself. Also, the password can be more easily protected in a single file on the server than in a source code repository.
Improve this answer
$\endgroup$
-1
$\begingroup$

In general you should assume that everything about your system is known except for the explicit secrets, in your case the private key. That includes PKCS and all other kinds of details about the algorithms.

This is called Kerckhoff's Principle and it allows a more structured analysis of the security of a system.

If an attacker had to guess which PKCS you use it would not be very good protection anyway because there are very few guesses that he has to try.

The field that deals with the systematic violation of Kerckhoff's Principle is called Obfuscation. ;) It is used e.g. for computer software, where it is often impossible to systematically protect any secrets because they are on the user's computer.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.