4

I have a password protected .pfx file and I would like to know if it safe to share it on GitHub.

The intention is to ensure that companies can trust a dll file of the Tweetinvi open source library. The DLL is signed by a certificate and the .p12 file contains both private and public key.

This has been requested by big companies and I do not know how secure a password protected .p12 file is.

  • Thank you for the information, I have updated the content of the question. – Linvi Jun 27 '16 at 10:38
  • 4
    Are you sure yo need to share the private key too? Who is actually signing the DLL? If this is you, then all you need to share is the public key, it is sufficient to check the signature validity and does not expose any private information. – WhiteWinterWolf Jun 27 '16 at 10:43
  • 1
    I am actually signing it, but for commodity I was wondering if it was possible to share both private and public if they were protected by the password. To let other developers working with me having the .p12 directly from github (without having to send it by email). – Linvi Jun 27 '16 at 10:45
  • 2
    @Linvi a password can eventually be bruteforced so I wouldn't share it publicly. – André Borie Jun 27 '16 at 10:50
  • 1
    This makes no sense. If you distribute the private key, no one can know for sure that your the only one that can sign things with it. It defeats the whole purpose. These 'big companies' don't need the private key to trust and they should know better. If they don't you should inform them. – JimmyJames Jun 27 '16 at 16:48
8

By having the file, it would be possible to try to brute force the password, so you would need to choose a really strong password to protect it and make brute forcing infeasible. Eg I can find on google tools that claim to brute force PKCS#12 at 500k passwords per second. If you choose 8 random printable characters it would take more than 400years. That on a comercial tool with GPU acceleration. Looks safe enough for your scenario.

However, sharing the key with other developers should be avoided anyway. Since you will need to share securelly the password anyway by another channel, and you should chose a password that is really strong, maybe you can use the same channel to securelly share the PKCS#12, and, if not, sending both using two separate distinct and private channels still is a better option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.