I'm developing application in Java that has to store RSA keys in software for foreseeable future (that is, at least 10 years).

The two most common standards of storing private keys are PKCS12 and JKS (Java Key Store). While PKCS12 supports many different algorithms, even the most secure ones are based on 3DES with SHA1. JKS is even worse as the default is based on MD5 and 3DES.

The Bouncy Castle Java library version of JKS is a bit better as it uses PBEWithSHAAndTwofish-CBC for "UBER" version of its key store format.

Are there any standard formats of private key storage that support encrypting the key pair using AES and SHA-2?

  • $\begingroup$ related: "How to create Java Key Store (.jks) file with AES encryption?" $\endgroup$
    – David Cary
    Commented Aug 8, 2012 at 15:44
  • $\begingroup$ OpenSSL seems to support AES and SHA-2 for PKCS #12. openssl.org/docs/apps/pkcs12.html $\endgroup$
    – mikeazo
    Commented Aug 8, 2012 at 16:32
  • $\begingroup$ @mikeazo: Yes, but not in a straightforward way, the -aes256 options refer to PEM output used when extracting private keys. To actually create PKCS12 file with AES encryption one needs to use something like this: openssl pkcs12 -export -inkey server.key -keypbe AES-128-CBC -macalg SHA256 -in server.crt -out server.p12. But I have no way to verify if it actually does this... Still, I don't think it's possible to create such a file with JCE (Java Cryptographic Extensions), maybe with Bouncy Castle low level API... $\endgroup$ Commented Aug 8, 2012 at 22:07

3 Answers 3


RFC 5958 and RFC5959 seems to be the latest standard for storing encrypted private keys. It obsoletes RFC 5208, also known as PKCS#8. My understanding is that AES is one of the many encryption algorithms supported by RFC 5958.

The GNU Keyring File Format is a another standard for a file format that stores private keys using AES-128.

The Gnome Keyring implementation stores private keys using (among other things) AES-128 encryption. Alas, it doesn't seem to follow any published standard, but perhaps it can be seen as a de-facto standard. The Gnome Keyring FAQ briefly mentions that sometime in the future (after 2010) it will transition to "a standard way of encrypting the keyring" (PBKDF2) which apparently requires "A new file format" (perhaps one of the above formats?).

  • $\begingroup$ Any code showing how to create RFC 5958 key file in java? $\endgroup$ Commented Aug 8, 2012 at 23:10

I went with PKCS#8 and Bouncy Castle specific PBEWithSHA256And256BitAES-CBC-BC encryption. Unfortunately BC nor Java doesn't support regular PBE with SHA1 and AES.

Exact implementation is at stackoverflow.com question.


You may want to investigate ANSI X9.143 (formerly TR-31) key blocks. Format D utilizes AES encryption and authentication is provided by AES CMAC, so this is a very strong key store.

Downside is that this standard is not free, but they are widely used in the payments industry (mandated in fact).

There are free open source implementations though from which the standard can be understood and integrated into applications:


https://github.com/chhil/TR31Keyblock (disclosure I have contributed to this project)

  • $\begingroup$ Care to explain the downvote? Millions of devices have/are using TR-31 for secure key storage. Seems a valid answer to the question to me. $\endgroup$
    – satur9nine
    Commented Mar 11 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.