I like to generate a public-private key pair that is seeded from a string. So having the string and the generation algorithm is enough to recreate the keys. I want to do this because I can then combine a password (that I'll memorize), with a long, secret (randomly generated) text file (that I'll store securely), and generate a key pair. I'll then delete the key pair after each usage and regenerate them when needed. Thus, for the keys to be compromised, someone would need both the long text file, and the password in my head. (Or they need to intercept the key in the narrow intervals that it exists.) This seems safer to me than just storing the keys securely, where anyone with physical access to the keys can use them.

PS: I am obviously confident in not forgetting the password.

There is a similar question, but it's old and doesn't have a useful answer.


You can achieve the same effect by encrypting the keypair with a key derived from your memorized password. So rather than 'generating' a keypair you'll be encrypting a pre-generated one.

Take your long password, and pass it through a key derivation function (e.g. PBKDF2), use the output to encrypt the private key, and then store only the encrypted file.

Hence in order for someone to compromise the pair, they'd need both your password and the encrypted private key file.

| improve this answer | |
  • This is the standard approach for securing private keys, even! SSH, PGP/GPG, private keys to X.509 certs... all of these can (and do, by default) use a passphrase to generate a key that encrypts the private key. Note that sometimes the key derivation function and/or the encryption on the private key isn't the best - a lot of old algorithms used here - but it achieves the goal at least as well as any way of directly doing what OP is attempting (that I'm aware of). – CBHacking Jul 28 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.