Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a certificate authority situation. I'm wondering if you just store it on paper, or if it would be better stored encrypted on like a USB flash drive that you can then plug into the machine, enter the encryption password (which I guess you also have to encrypt, recursively haha). At some point I guess you have to memorize something. But perhaps on the machine you are using the password, it knows the decryption key, so it can decrypt your password automatically without you having to give it another meta password, and then it uses the decrypted password however it does. This would seem better than storing it on paper because it would be encrypted, but I'm not sure.


I work with a product called SAP Single Sign-On that can be used to issue certificates as a Certification Authority or use a third-party Remote Certification Authority.

Our solution for this is called Hardware Security Module that is a physical computing device that safeguards and manages digital keys for strong authentication and provides cryptoprocessing. As described in the product documentation, hardware security module (HSM) boards or other PKCS#11-enabled devices can be used as external user Certification Authorities (CAs). In this case, the external CA acts as a key store entry of the type user CA.

Therefore instead of memorizing some password, using a HSM is a secure option to manage private keys.

  • Awesome, thank you. Wondering what HSM is a good one. – Lance Pollard Dec 6 '18 at 5:37
  • But you still need to have a password (PIN) to unlock HSM :) – Crypt32 Dec 6 '18 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.