Re: Storing a private key

Storing secrets is a hard problem. There is an entire chapter about this
topic in "Writing Secure Code" which is well worth a read if you are serious
about understanding this in detail.

People typically use things like DPAPI for helping to store secrets, but
that doesn't provide a complete solution and also comes with its own issues.
Since you have a private key for a certificate, you can also store that in a
standard key container and apply extra security to it. However, there might
not be an easy way to use the password protection feature on the key and
still access it from a server application.

Storing encrypted passwords is generally regarded as a bad design that
introduces much more risk than storing a salted hash of the password
instead. When you encrypt, if your key is compromised, the user's plaintext
passwords can be recovereded directly. When you hash, you don't even know
the user's plaintext password. Only brute force techniques can be used to
try to get the plaintext, and a good design can typically make that effort
too expensive to contemplate.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"pigeonrandle" <pigeonrandle@xxxxxxxxxxx> wrote in message
news:1153908969.044048.33770@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi,
I have a server and client program. The client encrypts data being sent
to the server using the servers public key before it transmits it to
the server over a tcp connection.

The question i have though, is where do i store the private key on the
server so that it will be safe?! In my mind (at least for the moment
...) there is no place to put it that couldn't be compromised in one
way or another.

The server also uses the same public key to encrypt other files it has
stored containing database usernames and passwords - hence my concerns
about storing the private key somewhere safe.

I would have liked to just 'keep the key in memory', but we all know
what would happen when Windows got bored and decided it was time to
blue-screen-of-death :-0

Thanks in advance for your help,
James Randle.



.

Relevant Pages