1
$\begingroup$

I'm thinking about creating an encrypted messaging web application where users create RSA key pairs, they store the public key on the server for others to see and also store an AES encrypted private key on the server. Thus, to verify their identity, they can decrypt the private key and send a signature.

That said, I'm curious is this is a reasonable idea. I know some similar services that require you always use the same device (like an iPhone) and won't let you use the same account on a different machine. This leads me to believe that they are storing a private key locally on the device. It seems reasonable to me to store an AES encrypted RSA private key on the server, but I am no expert on the subject and since I don't see anyone else doing it, I'm a little skeptical.

Any thoughts or concerns about this?

Improve this question
$\endgroup$
6
  • $\begingroup$ what prevents a user from syncing their private key between their devices? $\endgroup$
    – Richie Frame
    Nov 11, 2014 at 6:26
  • $\begingroup$ Security, I'd imagine. They don't want the server to ever see the private key. $\endgroup$
    – Chet
    Nov 11, 2014 at 6:55
  • 2
    $\begingroup$ The strength of the security used to safeguard the key should be at least as high as the strength of the key, and in practice that is not generally the case. I would have no problem letting every intelligence agency have a copy of my encrypted private key, IF the encryption strength was high enough $\endgroup$
    – Richie Frame
    Nov 11, 2014 at 8:15
  • $\begingroup$ I see. Is there a good reference you can point me to? Most of what I read seems to be opinion... But people feel pretty good about AES128 $\endgroup$
    – Chet
    Nov 11, 2014 at 19:33
  • $\begingroup$ security is relative against different algorithms, using different attacks. the weakest link is the one that will be the easiest to attack, make that stronger than the required security and that is the backbone of cryptosystem design. AES128 or its key will be the weakest link if you are securing a 384-bit ECC private key. $\endgroup$
    – Richie Frame
    Nov 14, 2014 at 9:06

2 Answers 2

Reset to default
1
$\begingroup$

Given that you used a strong password to derive the AES encryption key: Yes you could securely store your RSA private key in encrypted form on a server. BUT, since there is no technical need to have your private key on the server, why would you risk it?

Look at it that way: Suppose you have very sensible data (like private photos or so). Now you could encrypt it with a strong algorithm and password and send it to all your friends, knowing that no one would be able to to decrypt it. Anyways, I personally would still not do that. Even if I trust the encryption, I would not unnecessarily give encrypted data to someone else for no good reason.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ The entire point of cryptography is to assume the channel is entirely insecure and that there are attackers listening in on whatever is being sent. But I do agree that letting someone else store/have your private key is dicey, even if it is encrypted. If it is encrypted, I'd ensure it was with a very strong password (10+ characters, mixed alphanumeric). $\endgroup$
    – flashbang
    Nov 11, 2014 at 15:03
  • $\begingroup$ The reason it needs to be on the server is for a good user experience. If the user wants to read the same messages on their iPhone and their desktop, for example. $\endgroup$
    – Chet
    Nov 11, 2014 at 19:27
  • $\begingroup$ To help with the security, I was thinking of hashing the given password some number of times as a proof of work in order to mitigate against brute force attacks $\endgroup$
    – Chet
    Nov 11, 2014 at 19:30
  • 1
    $\begingroup$ Use some dedicated key derivation algorithm like PBKDF2 or bcrypt to generate the AES key from the users password. They have build in support to increase runtime to make bruteforcing harder. $\endgroup$
    – Thekwasti
    Nov 11, 2014 at 19:33
1
$\begingroup$

You can have your cookie and eat it too ! - Keep a seperate private key on each device you want to use. Encrypt it locally using password-derived symmetric crypto such as AES like you suggested. - Push up all your publik keys to the server. - Whoever wants to send you a message encrypts the message using all your public keys (actually, enrypts the message with a single random AES key and then encrypts that key with all the public keys) - You decrypt with the key you happen to have access to when you want to read the message, - This is in fact how S/MIME encrypted email and most every other PKI-based scheme works on a high level.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.