2

i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?

here is how i encrypt the key :

i generate a random 256 bit number and turn it to hex (this is the salt)

then i get the user password and derive a key from it using pbkdf2

i store the encrypted rsa key in the database

and i store the password using Argon2 in the database

is this safe or risky ?

migrated from crypto.stackexchange.com Jul 29 at 15:40

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • What are your attack scenarios? What if an attacker access some password/s before you apply PBKDF2 on the application server? – kelalaka Jul 29 at 14:10
  • @kelalaka key generation and pbkdf2 and encryption is on client side, only Argon2 is on the server side – 3bodyZZ Jul 29 at 14:12
1

It really depends on your threat model. However, properly-implemented AES encryption will ensure confidentiality for any arbitrary data, including an RSA private key. There is nothing special about RSA which would make it unsafe to encrypt using a symmetric algorithm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.