2
$\begingroup$

Consider a practical scenario as described in Microsoft's Expand Export a Certificate with the Private Key. We can see a certificate with private key can be exported as a PKCS #12 file, where the private key can be protected by a password (in Step 7).

Questions:

  1. If one day this PKCS #12 file is stolen by a hacker, then, can he perform an offline dictioary attack to this file?

  2. Step 5 in that article reads:

    In the Certificate Export Wizard, click Yes, export the private key. (This option will appear only if the private key is marked as exportable and you have access to the private key.)

    How does this mechanism works? Is the (un-)exportability guaranteed by a cryptography algorithm (so that no one can change the property), or only by a software method (so that hackers can change the property)?

$\endgroup$
  • $\begingroup$ 1. Yes. Decrypting the file with a wrong password would not give a valid key, so the attacker can try again until they find one that works. (I'm not posting this as an answer because I don't know about the second.) $\endgroup$ – otus Sep 18 '15 at 8:18
2
$\begingroup$

If one day this PKCS #12 file is stolen by a hacker, then, can he perform an offline dictioary attack to this file?

Yes, that's possible. The password is simply used to directly derive a symmetric key, which is used in turn to encrypt the private key.

Is the (un-)exportability guaranteed by a cryptography algorithm (so that no one can change the property), or only by a software method (so that hackers can change the property)?

Generally it is just a bit set to 0 or 1 somewhere. Where and how it is stored depends on the Cryptographic Service Provider (CSP) and the implementation of the key container that contains the private key. If it and the private key are stored in a HSM or Smart Card, it may be tricky to change it.

$\endgroup$
  • $\begingroup$ P12 is quite old, don't expect too much magic out of it. $\endgroup$ – Maarten Bodewes Sep 18 '15 at 12:50
  • $\begingroup$ So private certificate files generated by openssh or given by StartSSL also should be stored carefully. If they are stolen, the private keys are in danger, am I right? $\endgroup$ – phan Sep 18 '15 at 14:45
  • 1
    $\begingroup$ Adding (more) access control is always a good idea. Using long passphrases instead of simple passwords is as well. If possible, store the keys offline but do make backups, flash may also loose data in the long run. If you are really serious, use a secure token for the private key so you know that the value itself cannot be copied at least. Instead of backups you may also want to consider a scheme where loss of the private key is not catastrophic (i.e. for signature generation you could use a new key / certificate if the private key is gone / compromised). $\endgroup$ – Maarten Bodewes Sep 18 '15 at 14:52
  • 1
    $\begingroup$ @phan "Marking a key as exportable" is, in general, a Windows-only concept. Most other platforms (smart cards excepted) have no notion of a locally-stored key that can't be exported, because they know they couldn't enforce such a guarantee. $\endgroup$ – Reid Rankin Sep 18 '15 at 16:38
  • 1
    $\begingroup$ @phan OpenSSH normally generates only private keys, not certificates, and does not use PKCS#12 format. However, an OpenSSH-format password-encrypted private key and a PKCS#12-format password-encrypted private key are both private keys protected by the password, and at risk if the password is weak. $\endgroup$ – dave_thompson_085 Sep 20 '15 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.