Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

How to securely store an encryption key in USB drive? Here is my idea. I would like to write a program (let's say PC) and it will store data to a database encrypted at the record level or field level, not in the file level. And also I want to keep the encryption key out of the computer. It is simply keeping the key in the USB device. So physically, the key will be secure. Is there any USB device in the market? What I found are mostly security tokens.

share|improve this question

1 Answer

up vote 2 down vote accepted

I'm having a little trouble following you, but here are my initial thoughts: Storing on Flash media has a slightly higher risk due to memory/erase issues. That said, it sounds like you want to secure a container on the usb device rather than use something like an IronKey or Data Traveler. I assume the objection would be with leaving the drive unlocked once mounted since this increases the ability for the key to be compromised?

At the software level, there are two option I would recommend.

  1. Truecrypt: Use Truecryt in traveler mode and store your private keys in a encrypted container you can mount and unmount as you please. You still run the risk of having the stored key exposed unsecured for a given period of time.

  2. Use KeePass or similar. KeePass is a password database, but if you are using the 2.0 branch or a community versions which support attachments, you can use it to store each of your private keys with one database which you take with you on your usb drive. You can then access and cut and paste your keys as necessary. The advantage here is that keepass will timeout and lock up if you configure it to do so. The disadvantage is that you are no longer dealing with a file that is just "sitting there" ready to use. You either need to extract it or cut and paste when its needed.

If you are asking something different let us know and I will adjust my response accordingly.

Update Based on your comments, I'm not sure if you could get a single devices - maybe you can combine a phone/sms based OTP solution with some sort of physical token / smart card.

Update 2 This post seems similar, I checked through the comments and they are talking about a lot of different options for secure token/card hardware, figured I would just link instead of re-posting so you can determine which options are most useful for you.

share|improve this answer
Thanks for your response. Actually I don't want to store keys on the encrypted USB Devices. But I want some kind of USB device similar to the security tokens like Yubikey (with less storage: storing only a few keys). But Yubikey or other RSA keys are just for OTP. The device I want would provide keys + OTP. Desktop programs, API or plugin would access the keys on it for encryption and decryption process. – zhtway Aug 29 '12 at 23:24
That device could only be accessed by special programs with security for key manipulations and setup. Most of the time it will be lock down. I think it would be like HSM (Hardware Security Module) but less expensive device. – zhtway Aug 29 '12 at 23:25
I'm not aware of any cheap or open source supporting devices which are both OTP and serve as a "smart card" type physical token. – Eric G Aug 29 '12 at 23:52
How about "Smart Card" type physical token? Do you know some of it? I don't mean cheap but affordable for general users. – zhtway Aug 30 '12 at 2:36
I'll take a look at the link on your update2. Thanks – zhtway Aug 30 '12 at 21:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.