keybase / keybase/keybase-issues
Upload private key *without* giving its passphrase?
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
I wanted to use the private key sync feature and thus started the private key upload process. I got to the point where I pasted my key into a textbox and was then informed that I needed to provide my current passphrase as well as the keybase passphrase. Could you please provide some information about what happens there?
I do assume that you want to change the passphrase to the keybase one? That would make a sense for the website-based encryption functionality. But at this time I am only interested in the private key synchronisation and I do not see why my current passphrase is necessary for that.
Could you please allow uploading of keys with a passphrase set and have those synced between a users' machines?
I do appreciate your service, but so far I do not trust you enough to hand over my private key in the clear to a software infrastructure solely in your hands!
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the private key upload and synchronization flow described in the issue, including how the current passphrase and keybase passphrase are used. Determine whether passphrase-protected keys can be synchronized without exposing the private key, and document the security requirements and expected behavior before proposing a change.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100