I've used mail encryption products like Mailvelope in the past, where you have to create a key pair to encrypt/decrypt data. I understand you have to hand out the public key to others that want to encrypt data back to you, but how should you protect your private key? And do these methods change depending on the software used?


The private key can be protected by several means:

  • Keep the (master) private key offline that means on a removable media that is not attached to the computer for daily use. E.g. in GPG/PGP you have different keys. One is master key and the others are sub keys. The master key is used to sign the sub keys (similar to a X.509 infrastructure where the root CA certificate is the master and the intermediate certificates are the sub keys).
  • Don't use the master key on a computer that is connected to the internet or could be compromised by any other means.
  • Use key lengths and hash algorithms that are considered secure.
  • Use a strong passphrase to encrypt your keys.
  • Revoke the certificates for the (sub) keys immediately if you suspect them to be compromised.

This approach is (nearly) independent of the software used. Only the first and second bullet can be unsupported depending on the software/key used (using S/MIME you only have one key under normal circumstances).

  • Thank you for your answer. So the sub keys are the one's performing the encryption at this point, whereas the master key is kept somewhere off line. – Contego Oct 25 '14 at 2:34

One other factor you may want to add to @uwe-plonu's answer: keep the keys in a device that will not let even you at them, such as an HSM, smart card or token. There is a small USB-attached HSM that is specifically for PGP, and offloads the crypto processing from the computer. This means that even if someone got physical ownership of the device, the keys would be very hard (barring a significant defect or amazing luck guessing the password, effectively impossible) to extract.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.