I am encrypting my password before sending to my server with a public that i have stored as a cookie. Is there any security risks storing my public key in the cookie?

Are there any better alternatives way for me to retrieve this public key in the user environment?

  • $\begingroup$ A public key is public. What are the risks? Why don't you hash the password and send to the server, and the server performs the usual password hashing mechanism for the hash? $\endgroup$ – kelalaka Mar 11 at 8:40
  • $\begingroup$ Just wondering where does public key normally stored at in the user environment. Yes I could have use hashing instead, encryption will be overkill and expensive. $\endgroup$ – TypicalBeginner Mar 11 at 8:47
  • $\begingroup$ What happens if a user has set cookies to be automatically deleted? $\endgroup$ – SEJPM Mar 11 at 11:51
  • $\begingroup$ What damage could a client do by modifying the public key within the cookie? Browsers generally don't allow users to edit their cookies, however that's because they don't provide the tools, not because it'd be difficult; a hacker could modify any cookies he has... $\endgroup$ – poncho Mar 11 at 13:30
  • $\begingroup$ @poncho I thought similar at first, then I thought more about it, if an attacker has access to the machine, they will have more damage than just modifying the cookie. A key logger, a trojan, a backdoor, etc. $\endgroup$ – kelalaka Mar 11 at 17:22

The correct place to store public key on the web is the certificate you request from a CA (Certificate Authority. Many are paid, but there are ones that are free). You generate your key-pair and creates a "Certificate Signing Request" and the CA issues a certificate to you once they've done some verification.

Also, the public key for encryption is nowadays not stored on the certificate. Rather, servers generates and signs a public key used for ephemeral key exchange.

If it's not a web application (e.g. SSH), then there's usually a trusted channel through which you transfer server public key to your local storage for future use.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.