I need to store various private keys for my clients.
Given these options, what would be the least prone to brute force attacks:
- Encrypt the private keys using a separate RSA key (each user get its own key), with its password set to a SHA-512 hash of the users password.
- Store the private keys in a LUKS volume with its password set to a SHA-512 hash of the users password.
- Salt the hash with the RSA key or a unique property of the LUKS volume.