Storing keys - Should I store private keys in PEM or JWK JSON format?

Question

Which is more conventional?

For cross-platform; it is ok to store and use JWK in the JSON format?

Do I need to encrypt them before storing it in a database?

Answer 1

Not sure about the format, but I'd strongly recommend against storing private keys as much as you can. These are considered secret.

However, it seems like JWK is about the public keys (as opposed to the private keys) - and these are okay to store. I'd just make sure they can't be replaced by anyone without proper permissions

Answer 2

Should I store private keys in PEM or JWK JSON format?

The main reason for choosing one format or the other mainly depends on the application/library needs. In general, you want to avoid unnecessary conversion on runtime and serve directly on the required format.

For cross-platform; it is ok to store and use JWK in the JSON format?

Can you elaborate more on this use case?

Do I need to encrypt them before storing it in a database?

Not necessarily. As you tagged this question with [jwe], I understand that the private key is used to decrypt the token you receive. If this is is stored on a backend server, the risk of key leak is low and if you encrypt it you will undoubtedly need to store the decryption key somewhere that you should also store securely. This has no benefit and you will be required to decrypt it each time you want to use it and thus use CPU time for nothing. Note that storing private keys in a database is not recommended. It should be stored as a file on the server or set as an env var.

If the private key is stored on a roaming device (smartphone, PC...), it is highly recommended to encrypt it has those devices are considered less secured because of physical attacks. They usually provide convenient ways to encrypt such keys (Android keystore, IOS Keychain, Windows keystore and certificate...).