nsec
nsec copied to clipboard
Secure private key with passphrase when exporting
Once private key is exported is not secure.
Proposal to add ability to encrypt the private key using a symmetric encryption key derived from a passphrase and then decrypted again.
Yes, that would be a good enhancement. What specification should NSec implement to provide that? I was thinking of RFC 5958, Section 3 (EncryptedPrivateKeyInfo), but that covers only asymmetric keys.
@ektrah it could be an option to Export call?
An experimental implementation has been added in PasswordBasedKeyExporter.cs. I'm not sure how useful it is (and it's probably coming way too late too; sorry for that). Feedback is welcome.