I'm trying to understand where the private keys are stored in the Persona system, and how they are protected.

Can anyone elaborate on where the crypto material is created, stored, and what is transferred?

2 Answers 2


Tom is right that once browsers have native support for Persona, they will be able to store keys in their keystore.

Currently, however, browsers using the JavaScript shim make use of localStorage to store the keys in a way that only the shim is able to read and write them: https://speakerdeck.com/fmarier/persona-in-your-browsers-killing-your-passwords?slide=87

The keys themselves are created client-side in the browser but making use of entropy coming from the login.persona.org server.


A look at the specification shows that in the BrowserID implementation, private key handling is delegated to a browser-supplied Javascript API called navigator.id. So it is up to the browser to generate key pairs, and store them "as best as it can". Documentation is scarce, but it seems plausible that browsers use the same facilities as what they use for X.509 certificates, i.e. libnss for Firefox, and the cryptographic providers of the operating system Internet Explorer and Chrome. Private keys never escape the clutches of the browser (only public keys will travel to other machines).

  • Are these cryptographic providers related to what the HTML element KeyGen uses? (Keygen seems to store a cert in DPAPI in Windows). I'm curious what would be the most secure solution. Commented Mar 13, 2013 at 14:39
  • It would make a lot of sense that navigator.id.genKeyPair() and the HTML KeyGen element are two entry points to the same facility. But I cannot vouch for what Microsoft developers chose to do in this specific case; they are known to occasionally make things slightly more tortuous and indirect than necessary.
    – Tom Leek
    Commented Mar 13, 2013 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .