i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?

here is how i encrypt the key :

i generate a random 256 bit number and turn it to hex (this is the salt)

then i get the user password and derive a key from it using pbkdf2

i store the encrypted rsa key in the database

and i store the password using Argon2 in the database

is this safe or risky ?

  • What are your attack scenarios? What if an attacker access some password/s before you apply PBKDF2 on the application server?
    – kelalaka
    Jul 29 '19 at 14:10
  • @kelalaka key generation and pbkdf2 and encryption is on client side, only Argon2 is on the server side
    – user212160
    Jul 29 '19 at 14:12

It really depends on your threat model. However, properly-implemented AES encryption will ensure confidentiality for any arbitrary data, including an RSA private key. There is nothing special about RSA which would make it unsafe to encrypt using a symmetric algorithm.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy