3

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case is that I need to export my PEM private key as PKCS12 so that I can convert it into JKS to import it into a Java based system. I'm not interested in storing more than one private key in the PKCS12/JKS key store.

E.g.:

$ openssl pkcs12 -export -in mycert.crt -inkey privatekey.pem -out keystore.p12 
Enter pass phrase for privatekey.pem:
Enter Export Password:
Verifying - Enter Export Password:
Improve this question

1 Answer 1

Reset to default
3

If the involved software systems do not do anything stupid, then no, it should not cause any particular problem to reuse the password in that case. By "anything stupid" I mean something like reusing a salt value or failing to generate any IV in the proper way. Each of the involved encryption layers (in JKS, for the private key itself, and for the two passwords in PKCS#12) is defined as a stand-alone entity with its own password-to-key derivation (with its own salt), IV and encryption algorithm.

As a generic cautionary measure, you may want to do all this conversion/export/import in a temporary directory on a memory-based filesystem, so that the involved files are not actually written to a physical disk.

Improve this answer
1
  • 1
    Thank you Tom. I have no idea whether this is the "correct" answer but I'll mark it correct if no other commenters/answers say something else. :)
    – stoft
    Jan 10, 2014 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .