1

It's clearly a good idea to store the revocation certificate in a way which is both secure and reliable.

Cloud-based storage services are great for reliability, but of course they lack of security.

Would it be a good idea to store a revoke certificate on a cloud-based storage, and securing it with a strong symmetric encryption (say using AES256, and with a quite long passphrase)?

8
  • I'm honestly not sure what you're asking. A revoked certificate should be in a Certificate Revocation List, that is checked by your application.
    – RoraΖ
    Dec 5, 2014 at 19:46
  • you are better of [securely] printing the revocation certificate and keeping it in your and your mother's filing cabinet for the day you may need to use it. Following the premise that you need to have a backup of the revocation certificate, where are you securely keeping a backup of the quite long AES passphrase? It seems you would need a secure backup of that as well. Dec 5, 2014 at 19:49
  • @raz, I'm talking about the revoke certificate for my own private key. If I lose my laptop with my private key, it's a good idea to be able to revoke it.
    – Dacav
    Dec 5, 2014 at 20:29
  • @RadmillaMustafa, no need of bakups for that. How about a very specific sentence from one's personal (handwritten) journal?
    – Dacav
    Dec 5, 2014 at 20:32
  • 2
    if I were the GCHQ and I tried and failed to get your private key, I would want you to generate a new one in the hopes that you make a human error and I am able to steal your new one instead. Ha, but all this is spy fantasy talk -- but I like to mention the NSA/GCHQ's capabilities wherever appropriate because there is a startling number of people who are oblivious and would never associate the government with acts of this kind. Dec 5, 2014 at 21:19

1 Answer 1

2

It would not be advised, especially not on any public online resources. If the revocation keys gets in the wrong hands, someone can revoke your keys without your consent or knowledge.

3
  • ...that's the point of using symmetric encryption before storing the blob online
    – Dacav
    Dec 5, 2014 at 20:30
  • understood, see my comment above. Generally, I am skeptic of the cloud and I would say it is better to use an offline storage solution for sensitive files if it is possible. Since we are talking about a single text file here, there are likely many safer ways to store it than online in any capacity. Dec 5, 2014 at 20:44
  • I accepted your answer. I suggest you to complete with the good point in your comment about triggering a new key generation, since I found it to be a good point.
    – Dacav
    Dec 9, 2014 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .