Subject: Re: [pkix] Is there a SW standard to validate private key protection?

From: Roberto Opazo <[email-masked]>
Date: Wed, 6 Apr 2011 10:47:33 -0300

Ok, but I didn´t say the system is untrusted.

Let’s say I trust in my PC OS. There are some users and programs that
can use my PC, buy they don’t have administrative permissions.

So, are the following scenarios equivalents?

1.- I save my private key in plane in a public text file.

2.- I save my private key encrypted with a password (using AES) in a text file.

3.- Same than 2, but the file can only be used for a system CryptoAPI
that serves cryptographic requirements to applications.

4.- Same than 3, but there are no interfaces to export the private key.

5.- Same than 4, but there are no interfaces to import the private
key, so the private key MUST be created by a Cryptographic Service
Provider that connect the file with CryptoAPI.
Maybe there are no standards to distinguish these scenarios, but, do
you really think they are equivalent in terms of security?

Best regards,

Roberto Opazo

2011/3/10 Miller, Timothy J. <[email-masked]>:
> On Mar 10, 2011, at 1:52 PM, Roberto Opazo wrote:
>
>> Is there a SW standard to validate private key protection?
>
> There's no *software-only* way to protect a private key on an *untrusted, untrustable, general purpose computer*.   Once the key's in memory it's fair game to anything with the access rights.
>
> -- Tim
>
>
>

-- 
Saludos,

Roberto Opazo