What are the general ideas for storing keys in order to make sure no one else has access to it?
It's not a good approach to hash the keys, since you are going to need them later.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityWhat are the general ideas for storing keys in order to make sure no one else has access to it?
It's not a good approach to hash the keys, since you are going to need them later.
The requirements for storing public keys and private keys are quite different. Public keys need to be in a trust store in order to be able to trust them. Care should be taken that an attacker cannot replace them or trick the system into using a different trust store. Public keys - as the name implies - do not have to be confidential.
The requirements for private keys obviously do require confidentiality. Furthermore, the access to use the private keys should be restricted. Note that it is possible to open up access to use the private key while keeping them confidential; an example of this is storage of the private key in a smart card, which then offers a signing / decryption service.
The handling of public keys / certificates and private keys is known as key management. Entire books have been written about that subject so we won't be able to discuss all of them.
For storage in software a common method is to store the private keys in key stores. Examples of key stores are PKCS#12 key stores and PGP key containers. These containers are files for which the contents of the entire store and / or the key entries themselves are in turn protected by a passphrase.
For generic solutions I'd take a good look at PKCS#12 which is for instance used by OpenSSL. Mind that the default password handling may still require work (e.g. increasing the work factor for the decryption key that unlocks the PKCS#12 contents). Just choosing PKCS#12 is not key management on its own.
Symmetric (data or session) keys are often derived - using a Key Derivation Function or Key Agreement protocol - rather than stored.
Regarding Public keys , there is no need to store them secretly as they are meant for public. As far as private keys are concerned there could be following ways to store them
1) Store them in a location inaccessible for others (not in a purview of OS so that no one can see other than specific privileged user) 2) No Direct access method , meaning keys are only accessible by program. 3) You can use HSM (Hardware Security modules) that are designed to store keys safely.
Of course hashing is one of the good methods as you suggested to store keys.