# Tool for public key cryptography where password is the private key?

Is there any free & open source tool for public key cryptography, where the private key is just a chosen password?

Here is what I need:

• I want to make backups every hour using a script
• I want to only use open source tools.
• The backups must be encrypted,
• I need to be able to decrypt them without any files.

I cannot use symmetric encryption for backups, because the password cannot be given in the script in plaintext, and I cannot be asked each time a backup is made for the password (e.g. because when I'm on 1-month holidays, the backups need to be still made).

So I thought about public key cryptography, but all tools that I read about store the private key in a file. I'm afraid of losing it, just like all other data (that's why I'm doing backups in the first place). Imagine my disk suffers hardware failure, someone steals it, it burns in a fire, etc. Sure, I have backups, but I can't decrypt them without the private key file, which is now lost! Of course I could have backups of my private key file, but I simply don't want to rely on a file to decrypt my data.

I found a solution (at least from mathematical point of view, because I can't find any tool implementing this). Let's say I have my password. Let us generate a pair of prime numbers (p1,p2) using the following function p2rsapk:

``````(p1,p2) = p2rsapk(password) = {
bits = password as vector of bits
(n1,n2) = split bits into two parts in deterministic way, e.g. just take halves
p1 = find prime based on n1, e.g. lowest prime p1 s.t. p1 > 2^n1-2
p2 = find prime based on n2
}
``````

Voila! We have just taken a password and turned it into our private/public key pair. Now I could encrypt my backup with the public key (used by the script), and decrypt it when I have to without the need for any private key file (because my password IS my private key with the help of the p2rsapk function).

I could also send my public key to friends, so they can send me encrypted messages, and I can decrypt them from anywhere without the access to my no-longer-needed private key file.

However, while the idea is quite simple, I haven't found any tool that implements it. Is this approach known? And are there tools for this?

EDIT: I cannot stress enough how important it is for me not to rely on a file as the private key. I am well aware of the approach where one stores private key in a (possibly password-protected) file and its advantages and disadvantages, and I acknowledge that it is the most secure way to go for many scenarios. There are many books, tutorials, and man pages describing how to proceed if one wants the private key in a file. I know about that, but when answering please keep in mind that it is a strict requirement that there is no file for storing the private key.

EDIT2: I am perfectly aware of the problems with weak passwords. I know the password is the weakest link, so please assume I will use a safe password (minimum 50 characters including lower and uppercase letters, digits, symbols and no dictionary words).

-
I should add you are not going to be able to encrypt large amounts of data with as symmetric cryptography. – ewanm89 Sep 29 '12 at 12:37

Generating the private key deterministically from a password is known and works; however, it has the following drawback: anybody can then try to brute-force your password, since the public key is public. It suffices to re-run the key generation algorithm from any potential password and see if the result matches the public key.

We rarely want passwords to be on the front line, because we are humans with limited brains, and the passwords we are ready to remember are rather weak. The more common methods of using the password to encrypt the private key file allows to add some level of extra security by managing the locations where a copies of the private key file are kept (you want several copies, because the key must not be lost, but having a copy in safe somewhere is not the same as making it public).

Also, a private key file encrypted with a password can become two private key files , each encrypted with a specific password: this way, two people can potentially open the backups. After all, you worry about losing your data, but if this is in an enterprise setup, your colleagues might worry about losing the data as well -- and, from their point of view, data loss can take the form of you being run over by a bus. In the password-is-private-key configuration, protection against the loss of the password must be sharing the password, which is not very flexible.

If you do want to follow the password-is-private-key road, you will probably have to write your own tool. You would then find it much easier to use an ElGamal key, which is just an integer modulo a given value q (the group order, which is public). The OpenPGP format supports ElGamal keys, so this should be relatively simple to develop with an OpenPGP library, such as GnuPG.

-
+1 for the bus factor – Luc Sep 29 '12 at 13:51
I don't agree with your brute-force-attack-drawback. The very same thing can be done with usual private-key. How is guessing my decryption password different than guessing my private key? – user Sep 29 '12 at 17:21
If private key is in the file, more copies in more locations increases probability that an attacker will get it. – user Sep 29 '12 at 17:25
@user: a password fits in a human brain; this makes it weak against dictionary attacks. A RSA key is a big mathematical objects which is wide enough to defeat such brute force (by a very large margin). – Thomas Pornin Sep 29 '12 at 19:03
@ThomasPornin Would deterministically generating the private key from a password be more secure if using a key derivation function, such as PBKDF2 using a fixed salt? Or perhaps using some other deterministic way of deriving a more secure key from the password? – Owen Orwell Apr 5 '13 at 19:14

Any software for generating asymmetric key pairs uses random input. If the key generator receives the same random input twice it will generate the same key pair. So you can generate a key pair based on your password by replacing the random input with your password. For example, this can be done in OpenSSL by seeding the PRNG with your password (or a hash of your password) before calling RSA_generate_key.

If you don't code in C, Cryptico is a JavaScript tool with a method to generate RSA key pairs based on a password.

Having said that, the simplest solution for your needs would be to generate a random asymmetric key pair, encrypt the private key with a password-based symmetric key and publish the encrypted private key so that it can never be lost.

-
I was thinking about feeding my password to OpenSSL as the PRNG seed, as you suggest, but I am afraid the results are not cross-platform, cross-version and cross-tool reproducible. They can change the way PRNG works between versions or it could work differently on various machines. I would like a solution that has it as its well documented and supported functionality, so I can decrypt my backup few years from now on a different computer. – user Sep 30 '12 at 21:22
Cryptico sounds like it has the functionality I need. However, is the way they generate the private key standard? Does any such standard exist? I would love to be able to reproduce it with at least one other tool. – user Sep 30 '12 at 21:25
Yes, I do code in C, did you have another solution using C? – user Sep 30 '12 at 21:25
For me publishing encrypted private key is bad, because it gives people easy target to try brute force attacks (otherwise they need to first steal my encrypted backup files), there is still some chance I will loose that published private key files or they are tampered with. Also, some attackers could monitor my access to such published private key and easily trace me, etc. Since it gives no extra security over just password-as-private-key, and has many drawbacks, I want to avoid the private key file altogether. – user Sep 30 '12 at 21:34

In asymmetric cryptography the key must satisfy several mathematical relationships between the public and private keys. The works by taking several variables (might have to be random or large primes or similar depending on the algorithm) and putting them through 2 different sets of equations, one returns a public key the other set of equations return the private key.

This is not true for symmetric key cryptography where the key is just a string of the necessary length.

As a such while you can use a password/phrase and push it into a password based key derivation function to map it to a key of the needed length for symmetric key cryptography, there is no way of using it to map a password to either those variables or the final key in asymmetric cryptography.

-
Yes, but as other people have pointed out the passphrase or a digested passphrase can be used to ceded the random number generator used to produce the RSA key. In other words, you can create a function which maps passphrases to public keys, which is all you need. – Calder Mar 25 '13 at 21:09

I cannot use symmetric encryption for backups, because the password cannot be given in the script in plaintext, and I cannot be asked each time a backup is made for the password (e.g. because when I'm on 1-month holidays, the backups need to be still made).

Could you generate a symmetric key using PBKDF2? The script would not have the password in plaintext (although the key would obviously be accessible), so if the issue is simply that the password can't be stored that way, this is an option.

-
Nothing that would enable decrypting the backup can be stored in the backup script. Symmetric encryption will not do. I also want to use this for other scenario where people send me encrypted messages. So in both cases I need public key cryptography. – user Sep 30 '12 at 21:14
Ok. This might have been a useful approach had the issue been with divulging the password to the script. – Stephen Touset Oct 2 '12 at 5:22