2

i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?

here is how i encrypt the key :

i generate a random 256 bit number and turn it to hex (this is the salt)

then i get the user password and derive a key from it using pbkdf2

i store the encrypted rsa key in the database

and i store the password using Argon2 in the database

is this safe or risky ?

2
  • What are your attack scenarios? What if an attacker access some password/s before you apply PBKDF2 on the application server?
    – kelalaka
    Jul 29, 2019 at 14:10
  • @kelalaka key generation and pbkdf2 and encryption is on client side, only Argon2 is on the server side
    – user212160
    Jul 29, 2019 at 14:12

1 Answer 1

0

It really depends on your threat model. However, properly-implemented AES encryption will ensure confidentiality for any arbitrary data, including an RSA private key. There is nothing special about RSA which would make it unsafe to encrypt using a symmetric algorithm.

You must log in to answer this question.