Best Practices for RSA Key Storage
Learn secure storage practices for RSA private keys: file permissions, hardware security modules, secrets managers, and encryption at rest to protect your keys.
Detailed Explanation
Best Practices for RSA Key Storage
The security of an RSA system depends entirely on keeping the private key secret. A compromised private key allows an attacker to decrypt all messages, forge signatures, and impersonate the key owner.
File System Storage
For keys stored as files, apply strict access controls:
# Set restrictive permissions
chmod 600 private_key.pem # Owner read/write only
chmod 644 public_key.pem # Public key can be world-readable
chmod 700 ~/.ssh # SSH directory
# Verify permissions
ls -la private_key.pem
# -rw------- 1 user user 3.2K private_key.pem
Encryption at Rest
Always encrypt private keys with a passphrase when stored on disk:
# Generate encrypted private key (AES-256-CBC)
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 \
-aes256 -out encrypted_private.pem
# Convert unencrypted key to encrypted
openssl pkey -in private.pem -aes256 -out encrypted_private.pem
Secrets Management Services
For production environments, use dedicated secrets managers:
- AWS Secrets Manager / KMS — managed key storage with IAM-based access control
- HashiCorp Vault — open-source secrets management with dynamic key generation
- Azure Key Vault — cloud HSM-backed key storage
- Google Cloud KMS — envelope encryption with automatic key rotation
Hardware Security Modules (HSM)
For the highest security, store keys in tamper-resistant hardware:
- AWS CloudHSM — FIPS 140-2 Level 3 validated
- YubiHSM — affordable USB HSM for small deployments
- PKCS#11 tokens — SmartCards and USB tokens for individual keys
HSMs ensure private keys never exist in software form — all cryptographic operations happen inside the hardware module.
What NOT to Do
- Never commit keys to version control — add
*.pem,*.keyto.gitignore - Never embed keys in source code — use environment variables or secrets managers
- Never transmit keys unencrypted — use SCP, not HTTP; encrypt email attachments
- Never share private keys — each entity should generate its own key pair
- Never store keys in plaintext databases — encrypt before storage
Key Backup Strategy
- Store encrypted backups in a separate physical location
- Use Shamir's Secret Sharing for critical root keys
- Test key restoration procedures regularly
- Maintain an audit log of all key access
Use Case
Security engineers and DevOps teams need proper key storage practices when managing TLS certificates, SSH deploy keys, code signing keys, and API authentication credentials. Poor key storage is one of the most common causes of security breaches — leaked private keys on GitHub alone have compromised thousands of organizations.