Tool for public key cryptography where password is the private key?
I was wondering if you guys could clue me in to potential problems with using a hashed password as the seed for GPG's key generator. As far as why someone would ever want to do this, I can see two advantages:
- Using a human-memorable password would eliminate the need to store the key on disk, protecting you from identity theft in the event of data theft.
- Since the user's memory contains everything needed to regenerate the key, you don't need to worry about [electronic] data loss. Dementia still applies.
As Stephen pointed out, reason 1 is weak because password protected RSA keys also have that benefit. And RAM would still be vulnerable, but that's much harder to gain access too, right? But assuming people aren't great about backing up (they aren't) and reason 2 is valid, are there potential systemic problems with using a hash as a RNG seed?