keybase / keybase/keybase-issues

Upload private key *without* giving its passphrase?

Open
#489 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I wanted to use the private key sync feature and thus started the private key upload process. I got to the point where I pasted my key into a textbox and was then informed that I needed to provide my current passphrase as well as the keybase passphrase. Could you please provide some information about what happens there?

I do assume that you want to change the passphrase to the keybase one? That would make a sense for the website-based encryption functionality. But at this time I am only interested in the private key synchronisation and I do not see why my current passphrase is necessary for that.

Could you please allow uploading of keys with a passphrase set and have those synced between a users' machines?

I do appreciate your service, but so far I do not trust you enough to hand over my private key in the clear to a software infrastructure solely in your hands!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the private key upload and synchronization flow described in the issue, including how the current passphrase and keybase passphrase are used. Determine whether passphrase-protected keys can be synchronized without exposing the private key, and document the security requirements and expected behavior before proposing a change.

Written by the indexing model from the issue text.

Assessment

Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.