1

It's clearly a good idea to store the revocation certificate in a way which is both secure and reliable.

Cloud-based storage services are great for reliability, but of course they lack of security.

Would it be a good idea to store a revoke certificate on a cloud-based storage, and securing it with a strong symmetric encryption (say using AES256, and with a quite long passphrase)?

Improve this question
  • I'm honestly not sure what you're asking. A revoked certificate should be in a Certificate Revocation List, that is checked by your application. – RoraΖ Dec 5 '14 at 19:46
  • you are better of [securely] printing the revocation certificate and keeping it in your and your mother's filing cabinet for the day you may need to use it. Following the premise that you need to have a backup of the revocation certificate, where are you securely keeping a backup of the quite long AES passphrase? It seems you would need a secure backup of that as well. – Radmilla Mustafa Dec 5 '14 at 19:49
  • @raz, I'm talking about the revoke certificate for my own private key. If I lose my laptop with my private key, it's a good idea to be able to revoke it. – Dacav Dec 5 '14 at 20:29
  • @RadmillaMustafa, no need of bakups for that. How about a very specific sentence from one's personal (handwritten) journal? – Dacav Dec 5 '14 at 20:32
  • 2
    if I were the GCHQ and I tried and failed to get your private key, I would want you to generate a new one in the hopes that you make a human error and I am able to steal your new one instead. Ha, but all this is spy fantasy talk -- but I like to mention the NSA/GCHQ's capabilities wherever appropriate because there is a startling number of people who are oblivious and would never associate the government with acts of this kind. – Radmilla Mustafa Dec 5 '14 at 21:19
2

It would not be advised, especially not on any public online resources. If the revocation keys gets in the wrong hands, someone can revoke your keys without your consent or knowledge.

Improve this answer
  • ...that's the point of using symmetric encryption before storing the blob online – Dacav Dec 5 '14 at 20:30
  • understood, see my comment above. Generally, I am skeptic of the cloud and I would say it is better to use an offline storage solution for sensitive files if it is possible. Since we are talking about a single text file here, there are likely many safer ways to store it than online in any capacity. – Radmilla Mustafa Dec 5 '14 at 20:44
  • I accepted your answer. I suggest you to complete with the good point in your comment about triggering a new key generation, since I found it to be a good point. – Dacav Dec 9 '14 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.