Securely generate RSA keys for a user

Question

I have a user system that manages the users attributes, hashed salted password, an RSA Public Key and an RSA Private Key encrypted (by actual salt + password).

The RSA keys are generated during the users signup or if the password is reset (by user admin or forgot password) as the private key is essentially lost without the password.

Currently, the RSA Keys are generated on the clients machine, encrypted with their password (stored securyly in browser memory), and sent back to the server to store the data.

But now, I would like to create two other options for RSA Key generation. Both of these will work on a message queue system that will either be processed on the local system (via a cron) or the system sends a message to another server (via a symmetric encrypted channel) which creates the keys and sends it back to the system for storage.

Although these methods are valid secure methods of doing the hard bit of RSA generation, but my current conundrum is how to secure the calculated private key for that user. Having the private key secured by the password means the password is needed, and any other mechanism would require a key either to be made available to the code, or temporarily store an encryption key that is available to both parties (the user and the system).

I initially thought it would be good to store the users password with a system RSA key pair, and when the new keys are generated, the users password is fetched (and deleted from the store) and used to encrypt the new private key and store it with the user. But that requires that the system has access to its private key, which would give a hacker access to the users password.

The above method might work if its sending the commands to a separate secured server (even physically) because if that is the only one that stores the internal private key, then it can only be accessed if that server is hacked.

Does anyone have any suggestions about how I could process and secure the users private key that does could not be cracked even if the hacker has access to the full source and database?

Answer 1

I'm not going to comment on any security aspects of your system. However, on reading your private key storage thoughts I was reminded of a paper I read awhile ago on server-side private key storage by Charlie Kaufmann and Radia Perlman. The abstract notes "...We propose protocols that are secure even if Alice's password is guessable...".

Note that the paper was written in 1999 which means you should look around for more recents analyses and improvements on the concept.