Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I protect my private key with a passphrase, then it will be encrypted
Where is the symmetric key stored for it ? Is it somehow in the certificate itself? What if I have specified that it's not exportable and passphrase protected, if someone gains access to my OS and uses mimikatz to export it will she/he be able to decrypt it (assuming the passphrase was as easy as Test123) or will it fail because the symmetric key is tied to the OS and not the certificate itself?
Your question is answered here.
Specifically, the key is encrypted using AES-128 in CBC mode with the DS4228D85838E32589695E83A22595C7 (hex) initialization vector. The passphrase you provided is used for generating the AES key.
How is the key derived from the password? According to this, it is done this way:
1) Append the first 8 bytes of the IV to the passphrase, without a separator (serves as a salt).
2) Take the MD5 hash of the resulting string (once).
Not exactly state-of-the-art.
