6

Let's say I have a RSA key pair: N, E, D, in which N, E are the public part, D is the private part.

I'd like to split the private part into two pieces, D1 and D2, and store them in two different places. Is it secure if I just choose D1 as a random string (same length as D) and D2 is calculated as D XOR D1?

| improve this question | |
7

I'd like to split the private part into two pieces, D1 and D2, and store them in two different places. Is it secure if I just choose D1 as a random string (same length as D) and D2 is calculated as D XOR D1?

Yes. This is known as the one-time pad, and it is the recommended approach. The only way to get the original secret will be to obtain both D1 and D2.

Make sure you use a Cryptographically Secure Random Number Generator such as /dev/urandom.

| improve this answer | |
  • You can use urandom as well. See 2uo.de/myths-about-urandom – allo Sep 5 '16 at 18:36
  • You're right! If we think of D1 as the encryption key and D2 as the cipher text, it should not be possible to retrieve the plaintext without either of them. – Thanh Bui Sep 5 '16 at 18:43
-3

The rule is :

Don't roll your own crypto

Also, you did not define what is "secure" to you? What are the threats etc. Normally a key is encrypted on your disk (embedded in a certificate, or put in a keystore), so that you cannot access it without a passphrase. Doing what you do does not add any layer of security, as XOR is not a reliable way to encrypt information to maintain confidentiality.

| improve this answer | |
  • What I meant by "secure" here is whether it is possible to figure out the private key if one of the pieces is compromised. Of course, different mechanisms can be applied to protect the keys on disk, but I am not discussing about them here. – Thanh Bui Sep 5 '16 at 12:13
  • 3
    The OP is suggesting a One-time pad against random data. This XOR OTP is more 'secure' than traditional encryption, assuming he uses a Cryptographically Secure Random Number Generator. – Bryan Field Sep 5 '16 at 12:13
  • 3
    Not really, that'd reduce half the security level of the key because now I only need to brute-force half of the key. – Thanh Bui Sep 5 '16 at 12:24
  • 3
    @M'vy The point with the proposed scheme is that you do not store D. You store D1 and D2 in different locations. For an attacker to gain access to my key, she needs to both break into my bank vault to get D1 and search through my grand mothers cookie jar to get D2. Brute forcing is not interesting here, because we assume that the key is strong enough not to be brute forced. (An assumption that does not imply that half the key is strong enough not to be brute forced.) – Anders Sep 5 '16 at 12:33
  • 1
    The point is not to make it harder to brute force. It is to make it harder to steal the key, because you need to pull off two heists instead of one. – Anders Sep 5 '16 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.