2
$\begingroup$

So, I've just started looking at the subject of Cryptography and am working through Stephen Haunt's Practical Cryptography course on PluralSight but have a question that doesn't appear to be covered.

In the course, the Window's Key Container is used for encrypting and decrypting a message.

Now if I'm sending messages to myself, that's fine, but generally, if I talk to myself, the voices and I don't bother encrypting our messages.

If I'm sending messages to someone else then I need to encrypt the message using their Public Key, yes? So, assuming that they have sent it to me, where do I store it? Can I put it in a key store? Do I store it as a String of some kind? and if I do, am I supposed to keep it in a DB? The file system?

I've looked on here for answers to this question, but maybe it is so trivial that no one has thought to write down the answer for those of us who are hard of Thinking.

Improve this question
$\endgroup$
4
  • $\begingroup$ You want to store public keys in an authenticity preserving manner $\endgroup$
    – SEJPM
    Dec 12, 2018 at 11:33
  • $\begingroup$ @SEJPM, thanks for that, I think. You seem to be assuming a level of knowledge I don't (yet) have. Can you point me to a reference that might allow me to discover what is involved in that? $\endgroup$
    – Stuart Hemming
    Dec 12, 2018 at 11:37
  • 2
    $\begingroup$ This is the kind of question cryptographers fear, because there is no simple and practical answer. One temptation is to dismiss it as off-topic in cryptography, and say security.SE is the appropriate place to ask. $\endgroup$
    – fgrieu ♦
    Dec 12, 2018 at 12:21
  • $\begingroup$ @fgrieu Honest. Not helpful, but honest $\endgroup$
    – Stuart Hemming
    Dec 13, 2018 at 19:26

1 Answer 1

Reset to default
1
$\begingroup$

From a security point of view, you can store the public key wherever you want, as by definition it is public. This doesn't hold for the private key, which has to be store securely, as the security depends on it. As pointed out by @fgrieu (in the comment below), the integrity of both public and private keys should be ensured. In other words, it should be ensured that no adversary can change the public keys. Therefore, you might consider also storing the public keys in a key store which should make it a lot harder for an adversary to tamper with it.

From an efficiency point of view, it really depends on what platform you are using. Of course you can store the public keys also in a key store (as a key store most likely offers some other useful functions). However, you can also just store the public keys in a database or the file system. Regarding the encoding (storing them as plaintext strings, hex strings or any other encoding) it again depends on your platform. You might have a look at this link.

Improve this answer
$\endgroup$
2
  • $\begingroup$ This fails to note that "wherever you want" to store public keys must protected them against adversarial alteration. Even storing public keys as certificates does not fully solve this problem. $\endgroup$
    – fgrieu ♦
    Dec 14, 2018 at 18:43
  • $\begingroup$ @fgrieu: of course you should also protect the integrity of both public and private keys. I just edited my answer. $\endgroup$
    – TheBananaMan
    Dec 17, 2018 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.