I am working on a non-professional piece of software that is required to generate and store RSA keys (public and private). The generated keys will be used to encrypt communication across the Internet. Their value is not that high as the user will have the ability to generate new keys whenever they want.

I have two approaches to this:

  1. I consider that the user's device must be secured by the user itself and then don't secure the keys (I don't consider this to be a good solution)

  2. I secure the RSA keys in my software, but I have no idea what is/are the good practices

I, of course, intend to use solution 2. However, I don't know how to safely store private/public keys. Are there some good/common practices? If yes, what are they? Should I store them in a file?

  • It depends on the use case (i.e. what should be done with the keys, how valuable are they) and on the security requirements (who is the attacker and what capabilities he has). None of these information are provided in your question. But typical ways are (sorted by increasing security and decreasing usability): store private keys as plain file, as encrypted file (or inside some encrypted container) or keep keys only inside a smartcard or other hardware device. Pick the one which fits your unknown requirements. Commented Jun 17, 2018 at 8:07

1 Answer 1


Ways to store keys

On a scale from Least Secure/Easiest to Most Secure/Hardest:

Least secure / easiest

  • Store the keys in plaintext

    This is the easiest way, but anyone with access rights to the file can read the key out.

  • Store the keys in the system keychain

    This stops other users from accessing the file, but depending on how the keychain is setup there are usually not many defences against malware that runs as the current user.

  • Store the keys in an encrypted file

    This is more secure, but it requires the user to enter a password on each load, and the key will need to be in memory for at least long enough for it to be used, during this time it can be stolen

  • Store the keys in hardware

    This is the most secure option, but it requires additional hardware, and if a presence check is not included then malware can talk to the hardware to perform key operations, even if it cannot extract the key.

Most secure / hardest

  • 1
    This is an unfinished answer however it was accepted? Please, could you finish the answer? You've left us with a nice big "Most secure / hardest".
    – user173641
    Commented Jun 18, 2018 at 13:29
  • That was a scale, least -> most secure (Imagine a big arrow in the margin)
    – jrtapsell
    Commented Jun 18, 2018 at 13:59
  • 2
    Right, it's just not very clear...? Or perhaps it is and it's a me issue?
    – user173641
    Commented Jun 18, 2018 at 14:00
  • Was very clear for me Commented Jun 18, 2018 at 14:51
  • I also found it a bit confusing.
    – Gillian
    Commented Jun 18, 2018 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .