Tool for public key cryptography where password is the private key?

Question

Is there any free & open source tool for public key cryptography, where the private key is just a chosen password?

Here is what I need:

• I want to make backups every hour using a script
• I want to only use open source tools.
• The backups must be encrypted,
• I need to be able to decrypt them without any files.

I cannot use symmetric encryption for backups, because the password cannot be given in the script in plaintext, and I cannot be asked each time a backup is made for the password (e.g. because when I'm on 1-month holidays, the backups need to be still made).

So I thought about public key cryptography, but all tools that I read about store the private key in a file. I'm afraid of losing it, just like all other data (that's why I'm doing backups in the first place). Imagine my disk suffers hardware failure, someone steals it, it burns in a fire, etc. Sure, I have backups, but I can't decrypt them without the private key file, which is now lost! Of course I could have backups of my private key file, but I simply don't want to rely on a file to decrypt my data.

I found a solution (at least from mathematical point of view, because I can't find any tool implementing this). Let's say I have my password. Let us generate a pair of prime numbers (p1,p2) using the following function p2rsapk:

(p1,p2) = p2rsapk(password) = {
  bits = password as vector of bits
  (n1,n2) = split bits into two parts in deterministic way, e.g. just take halves
  p1 = find prime based on n1, e.g. lowest prime p1 s.t. p1 > 2^n1-2
  p2 = find prime based on n2
}

Voila! We have just taken a password and turned it into our private/public key pair. Now I could encrypt my backup with the public key (used by the script), and decrypt it when I have to without the need for any private key file (because my password IS my private key with the help of the p2rsapk function).

I could also send my public key to friends, so they can send me encrypted messages, and I can decrypt them from anywhere without the access to my no-longer-needed private key file.

However, while the idea is quite simple, I haven't found any tool that implements it. Is this approach known? And are there tools for this?

EDIT: I cannot stress enough how important it is for me not to rely on a file as the private key. I am well aware of the approach where one stores private key in a (possibly password-protected) file and its advantages and disadvantages, and I acknowledge that it is the most secure way to go for many scenarios. There are many books, tutorials, and man pages describing how to proceed if one wants the private key in a file. I know about that, but when answering please keep in mind that it is a strict requirement that there is no file for storing the private key.

EDIT2: I am perfectly aware of the problems with weak passwords. I know the password is the weakest link, so please assume I will use a safe password (minimum 50 characters including lower and uppercase letters, digits, symbols and no dictionary words).

Answer 1

Generating the private key deterministically from a password is known and works; however, it has the following drawback: anybody can then try to brute-force your password, since the public key is public. It suffices to re-run the key generation algorithm from any potential password and see if the result matches the public key.

We rarely want passwords to be on the front line, because we are humans with limited brains, and the passwords we are ready to remember are rather weak. The more common methods of using the password to encrypt the private key file allows to add some level of extra security by managing the locations where a copies of the private key file are kept (you want several copies, because the key must not be lost, but having a copy in safe somewhere is not the same as making it public).

Also, a private key file encrypted with a password can become two private key files , each encrypted with a specific password: this way, two people can potentially open the backups. After all, you worry about losing your data, but if this is in an enterprise setup, your colleagues might worry about losing the data as well -- and, from their point of view, data loss can take the form of you being run over by a bus. In the password-is-private-key configuration, protection against the loss of the password must be sharing the password, which is not very flexible.

If you do want to follow the password-is-private-key road, you will probably have to write your own tool. You would then find it much easier to use an ElGamal key, which is just an integer modulo a given value q (the group order, which is public). The OpenPGP format supports ElGamal keys, so this should be relatively simple to develop with an OpenPGP library, such as GnuPG.

Answer 2

Any software for generating asymmetric key pairs uses random input. If the key generator receives the same random input twice it will generate the same key pair. So you can generate a key pair based on your password by replacing the random input with your password. For example, this can be done in OpenSSL by seeding the PRNG with your password (or a hash of your password) before calling RSA_generate_key.

If you don't code in C, Cryptico is a JavaScript tool with a method to generate RSA key pairs based on a password.

Having said that, the simplest solution for your needs would be to generate a random asymmetric key pair, encrypt the private key with a password-based symmetric key and publish the encrypted private key so that it can never be lost.

Answer 3

In asymmetric cryptography the key must satisfy several mathematical relationships between the public and private keys. The works by taking several variables (might have to be random or large primes or similar depending on the algorithm) and putting them through 2 different sets of equations, one returns a public key the other set of equations return the private key.

This is not true for symmetric key cryptography where the key is just a string of the necessary length.

As a such while you can use a password/phrase and push it into a password based key derivation function to map it to a key of the needed length for symmetric key cryptography, there is no way of using it to map a password to either those variables or the final key in asymmetric cryptography.

Answer 4

I cannot use symmetric encryption for backups, because the password cannot be given in the script in plaintext, and I cannot be asked each time a backup is made for the password (e.g. because when I'm on 1-month holidays, the backups need to be still made).

Could you generate a symmetric key using PBKDF2? The script would not have the password in plaintext (although the key would obviously be accessible), so if the issue is simply that the password can't be stored that way, this is an option.