0
$\begingroup$

Storing an RSA 2048-bit key directly in a keyring seems to work fine, and is advantageous because the application can be removed, broken, reinstalled and the key still works.

However, most apps seem to write out PCSS8 key files, and, instead, keep the random AES keys in the keyring for acccess.

Is there a good reason not to store the private keys directly in a properly encrypted user keyring?

$\endgroup$
  • 1
    $\begingroup$ Do you mean PKCS8? What kind of keyring are you talking about? What kind of application are you talking about? $\endgroup$ – Squeamish Ossifrage Dec 18 '17 at 20:06
  • $\begingroup$ "However, most apps seem to write out PCSS8 key files" that's certainly not my experience. I use PKCS#8 for testing all the time but you wouldn't find it anywhere near a user (then again, I prefer my keys in hardware) $\endgroup$ – Maarten Bodewes Dec 19 '17 at 9:02
1
$\begingroup$

Is there a good reason not to store the private keys directly in a properly encrypted user keyring?

maybe generic answers what are you looking are standardization and platform independence. When writing software, we (mostly) need to take care that it will eventually running on all platforms. PKCS#8 is widely accepted standard usable everywhere.

What can be important here is the context. Are the keys directly used by user (to decrypt/sign something) or by machine (service)?

When we consider the end-user context, I agree with Maarten's comment, IMHO the best option is to have the keys on hardware. (Any reasonable crypto-device is often exposed as PKCS#11). Otherwise there is no advantage of Keyring over other keystores (ok, it can be integrated with UI such as Gnome)

When using the keys from the services, PKCS#8 is well supported and widely accepted standard, so it works everywhere. And the private key may be encrypted, but the decryption key needs to be available somewere too for server side services.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.