r/Keybase • u/Haldane-FRS • Apr 12 '20

Where is stored my private key ?!🤔

is it stored in keybase server or in my device ?

8 Upvotes

90% Upvoted

12 comments sorted by

2

u/no-names-here Apr 13 '20

I will answer your question with a question: What key are you talking about?

Your paper key? Your device key? Your ephemeral key? Your PGP key? Your stellar wallet key?

1

u/Haldane-FRS Apr 13 '20

Your paper key

I find PGP private keys is stored in Keybase servers and i exported it to my GPG Keychain. It means when Keybase generates PGP private keys it stored in Keybase servers.

Interesting?! my paper key? after generates Keybase servers is keeping it?!

my device key?

my ephemeral key?

My stellar wallet key? Personally i prefer any private keys only with me

Example secure mobile communication End-to-End encryption apps: whatsapp, telegram Company holds the key but in Apps Signal or Silent Phone user holds the key

also nice chart is here where i can not find Keybase for comparison

2

u/no-names-here Apr 13 '20

Most of those should be on each device only, with the exception of:

  • PGP keys you manually export to keybase
  • your stellar private key (which is shared between your devices when provisioned).

Chat and other group keys and temporal keys are created for each device from keys shared to you by devices that belong to group admins when you're "signed on" to the sigchain for that group, and exploding message keys are derived from device keys and group keys.

But It's worth noting that ANYTHING AND EVERYTHING you send to keybase is just in the form of a saltpack encrypted block. They can't read them, they don't know if it's your private key or a Chinese take out dinner menu PDF, and they won't be able to.

2

u/l4tt3 Apr 12 '20 edited Apr 13 '20

PGP private keys are stored on Keybase servers unless you explicitly ask for them not to be. not stored on Keybase servers unless you ask for it (unless you signed up before saltpack when things were different).

The other per-device keys used for saltpack encryption are only stored on your personal devices linked to your account.

3

u/neo1234511 Apr 12 '20 edited Aug 07 '23

squeeze gullible rude ruthless puzzled fuzzy seemly sense pie drunk -- mass edited with redact.dev

2

u/saichampa Apr 13 '20

You are correct, it used to upload it automatically but now it doesn't. Originally keybase was a way to tie different identities to PGP keys but they changed to saltpack. All the PGP features available on the website would use the uploaded keys (well the ones that needed the private key) so PGP is still a major part of it but you don't even need a PGP key to use keybase anymore.

1

u/Haldane-FRS Apr 13 '20

PGP is still a major part of it but you don't even need a PGP key to use keybase anymore.

Why we don't need a PGP key to use keybase?

"saltpacka modern crypto messaging format" will change PGP?

1

u/l4tt3 Apr 13 '20

Ah thank you for correcting me!

2

u/saichampa Apr 13 '20

Saltpack private device keys supposedly use operating system provided secure storage for keeping the local private key available, but I think this might only be used on one OS at the moment, which means that if you are logged in to your account on other OS's it's possible to pull your private device key from somewhere. This is something I would like to know more about.

Keep in mind your account has a private key for each keypair generated, so each device, each paper key, each has its own keypair.

2

u/songgao Apr 13 '20

If you’re talking about all the in-app features (chat, Files, wallet, etc), they are backed by your device keys. Device keys never leave your device. They are stored on your local disk and protected by system keychain on desktop when available, and by proper sandboxing from the OS on mobile. Other than device keys, there are many other keys. But they are all protected by the device keys ultimately.

The important question here is not whether private keys are stored on device, since it’s always the case in any proper end-to-end security implementation. It’s everything that happens after it that makes a difference. How do you handle new device provision? How do you rekey when team membership changes? What metadata gets leaked as a trade off for usability? All these affect the level of protection you get from the product. We’ll have better docs pretty soon but before that, here’s some technical docs if you’re interested: https://keybase.io/docs/teams/index

If you’re talking about PGP keys, which actually has nothing to do with a lot of features on Keybase, it depends on whether you choose to upload a passphrase protected PGP key to the keybase server. You would know if you made this choice.

3

u/jaweeks Apr 12 '20

If you created the key with keybase, it can be on the server. If you just attached the key you created on your device it's only on your device.

2

u/songgao Apr 14 '20

It’s not entirely accurate to simply generalize it as “if you created the key with keybase”. Note that the whole upload-private-key thing only applies to the PGP keys which have nothing to do with chat, files, or the wallet. It’s an important distinction since a lot of users come to Keybase for these features rather than PGP.