Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to understand where the private keys are stored in the Persona system, and how they are protected.

Can anyone elaborate on where the crypto material is created, stored, and what is transferred?

share|improve this question
add comment

2 Answers

A look at the specification shows that in the BrowserID implementation, private key handling is delegated to a browser-supplied Javascript API called navigator.id. So it is up to the browser to generate key pairs, and store them "as best as it can". Documentation is scarce, but it seems plausible that browsers use the same facilities as what they use for X.509 certificates, i.e. libnss for Firefox, and the cryptographic providers of the operating system Internet Explorer and Chrome. Private keys never escape the clutches of the browser (only public keys will travel to other machines).

share|improve this answer
    
Are these cryptographic providers related to what the HTML element KeyGen uses? (Keygen seems to store a cert in DPAPI in Windows). I'm curious what would be the most secure solution. –  makerofthings7 Mar 13 '13 at 14:39
    
It would make a lot of sense that navigator.id.genKeyPair() and the HTML KeyGen element are two entry points to the same facility. But I cannot vouch for what Microsoft developers chose to do in this specific case; they are known to occasionally make things slightly more tortuous and indirect than necessary. –  Tom Leek Mar 13 '13 at 14:44
add comment

Tom is right that once browsers have native support for Persona, they will be able to store keys in their keystore.

Currently, however, browsers using the JavaScript shim make use of localStorage to store the keys in a way that only the shim is able to read and write them: https://speakerdeck.com/fmarier/persona-in-your-browsers-killing-your-passwords?slide=87

The keys themselves are created client-side in the browser but making use of entropy coming from the login.persona.org server.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.