In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the key/password/certificate should be stored at client side.

How to secure this key?

Of course we can hash it but we still need the key and not the hashed value to login again.

  • This question is not clear - are you talking about a system you're developing, that needs to store a credential client side? Or are you talking about a home user / end user PoV? – AviD Nov 14 '10 at 1:46
  • 1
    I am developing a system that should accept new users. These users should get a certificate from my server to access resources provided remotely. Hence the certificate i will provide them needs to be stored on their pc so client side. How can i provide them a secure way to secure this certificate? – Phoenician-Eagle Nov 14 '10 at 8:57
  • Tie it to the hardware e.g. TPM? – atdre Nov 17 '10 at 22:27
  • I can't do such an assumption that all my clients have TPMs, therefore for me AviD's answer would be more practical. – Phoenician-Eagle Nov 18 '10 at 12:17

Considering your comment up top, I would say that while this is possible, it is quite complicated with numerous likely pitfalls.

Though it is not yet so common, I would strongly recommend you look into CardSpace (nee InfoCard). Basically this provides a very secure implementation of what you're looking for, and additional benefits (e.g. the user has more control of what information is sent to whom). Of course it is not without tradeoffs, e.g. users are less familiar with it, and it's a bit complex to implement...

  • 1
    Which OS's have easy-to-use client implementations, and which are experimental at best? – nealmcb Jan 31 '11 at 4:09
  • @nealmcb, as far as I know this is is stil Windows-only, and Vista/7 generation at that... Though there might be a backport to XP, and I believe its an open spec with the intention that it gets implemented on other platforms too, but I dont think it has been yet. – AviD Jan 31 '11 at 6:15

The "right" way to securely store sensitive information client-side is to use the features provided by the operating system -- e.g. KeyChain on MacOS X or DPAPI on Windows. Protecting client-side data is a hard problem, but in some cases there is some helpful hardware (e.g. a smartcard); the OS has direct access to the hardware, and it may even be already configured. Also, OS-implemented protection systems have a chance of being well integrated in the normal user authentication system.

From a theoretical point of view, there is not much that can be done in software only, save:

  • Obfuscation. The application mangles things in what it hopes to be an abscond way -- but the application is code which can unravel the obfuscated data, so this will resist attackers only as long as they do not reverse-engineer the code -- i.e., not for long.

  • Password-based encryption. You encrypt the data, using a symmetric key which is derived from the password. This can be made safe if the password has high entropy and is properly "strengthened" (use bcrypt). That's what OS-based solutions tend to do anyway. For a pure applicative implementation, consider using GnuPG, which can do that natively (with the command-line tool, that's gpg -c file).


Use a symmetric cipher to encrypt the certificate locally, and force the user to choose a strong passphrase as the key.

Thus, it becomes infeasible to use the certificiate without first supplying the passphrase.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.