Re: Encrypted Private Key

Hello guys,



I already found out what was wrong with the key and built a code

that can encrypt the private key into PKCS #8 RFC 5208 EncryptedPrivateKeyInfo

and into PEM format that I successfully decrypted using OpenSSL.



The code does not use any third party library and is built using plain

JavaScript + WebCrypto API. It's very lightweight.



The problem described in last message was caused by wrong hash

algorithm used in PBKDF2. OpenSSL uses SHA-1 for decrypting

private keys as default but I used SHA-256.



And there is still a question though.



1) Would you rather used AES-CBC for key wrapping

or AES-GCM. (I want to use GCM but I am not sure if

it is a right choice for this use case)



2) What number of iterations should I use? 300 000+

or should I keep it on default 2048? (OpenSSL default)



3) Since OpenSSL uses SHA-1 as default for PBKDF2

in key encryption, is it still secure to use? Is there

a way to define hash algorithm in ASN.1 PKCS #8

structure?



Thank you very much guys for your advices about

secure web models and thanks Eric for your valuable

answer about ASN.1 and EncryptedPrivateKeyInfo.



P.S. Once library is ready I'll keep here a link for

its GitHub repository. Maybe someone will

find it useful ;-)... maybe not.



Best Regards,
Peter