5

I'm a beginner to security, and trying to understand how best to secure a private key. I understand keys should never be stored in plaintext - however, surely encrypting them with another key provides the same problem (but for this new encryption key)...?

The same with key vaults - if you store your key seperately and ping somewhere else which does all your encrypt/decrypt functions, surely an attacker, having gained access to your encrypted data, could simply call the decrypt function and have access to all your decrypted data?

Edit: this is a symmetric key being used to encrypt some data being stored in a database (not passwords, these are being hashed)

Improve this question
5
  • What is the private key for? There are ways to protect e.g. a PGP private key that are not necessarily applicable to a SSL private key, for example.
    – user
    Commented Dec 23, 2016 at 18:34
  • 3
    What kind of private key are you talking about, and in what context (single-computer home use, multi-computer business, etc.)?
    – Xiong Chiamiov
    Commented Dec 23, 2016 at 18:36
  • You may also find danielsomerfield.github.io/turtles a relevant talk.
    – Xiong Chiamiov
    Commented Dec 23, 2016 at 18:36
  • Edited to add clarification as to what the key is being used for
    – Vanita
    Commented Dec 23, 2016 at 18:39
  • Use a hardware security module.
    – André Borie
    Commented Dec 24, 2016 at 17:46

2 Answers 2

Reset to default
3

Security can actually be splitted in Confidentiality, Integrity, Availability. For the C part, the most secure place is... you brain. If you only have few keys, and they are simple enough to remember (better a phrase with normal spelling than weird spelling on a short word) and you use all of them on a daily base, it is reasonably safe for the two other parts, and you should stay there.

If one of the above conditions is not met, that is is the key is hard to remember (a mere sequence of characters), or if you only seldom use it you should use a password vault like for example Keypass that has good reputation on this site. At the end, they all rely on a master key, but the difference is that you can choose it, and that you only have to remember it. You could think of a simple encrypted file, but password vaults have some goodies (ability to type the password for you, synchronization, etc.) that really worth it.

Improve this answer
2
  • 2
    And make sure the phrase you memorize is not the answer to: "My horse asked me if he guessed right about what I plugged onto my car's power supply unit."
    – Mindwin Remember Monica
    Commented Jan 23, 2017 at 11:47
  • Quite a long password, appears quite 'confidential'
    – Sam Ginrich
    Commented Aug 21, 2022 at 10:54
1

This is a very old question and the answer (IMHO) is that you have to protect the file that stores the private data with ACL in your OS and encrypt the directory with the File System encryption. This is surely only a baseline.

Otherwise you can add some sort of obfuscation of the data. Something like change the name of the file or put the key into another file in a precise offset. But all the obfuscation techniques require to manage the retrieve of the key so you have to develop specific code to access the data and with a good reverse engineering tool is not so secure.

But obfuscation is another layer of security to add on top of the ACL and FS encryption.

Last but not least is to manage people that have access to the key...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .