# Best place to generate a key pair

**URL:** <https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455>\
**Category:** Developing Nodes\
**Created:** [3 November 2019 07:37 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455 "2019-11-03T07:37:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 November 2019 07:37 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/1 "2019-11-03T07:37:30Z")

</div>

Hi folks,

For one of my new nodes, the user needs to generate a **key pair** (i.e. private key and corresponding public key). To make the whole thing a bit user-friendly, I would like the user to be able to generate a new key pair by a simple button in the node's config screen:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/7/7eb7fb7306002225e12a5c3762aab21951d0fb63.png)

1. User clicks the '_Generate new key pair_' button.
2. On the server side the **httpAdmin** endpoint generates a new key pair, and returns the key pair as json.
3. Both config screen fields will be filled (from the json).
4. Under the cover I would of course store both fields into the credentials of my node.

But not sure whether this is a secure way to generate a key pair. Would be nice if anybody can let me know if this is a decent solution, or should I do it somehow else?

Thanks!!!  
Bart

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [3 November 2019 09:06 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/2 "2019-11-03T09:06:34Z")

</div>

If you want it secure then don't return them to the browser, just keep them on the server side, and return dummy values for the ui. However you are still then keeping both keys together which is still not the best.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 November 2019 09:32 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/3 "2019-11-03T09:32:57Z")

</div>

> [@dceejay](#):
>
> you are still then keeping both keys together

Morning Dave,  
that is indeed true ...

> [@dceejay](#):
>
> just keep them on the server side

Now a stupid question...  
Can I store them in my flow when they don't arrive from the client part? Thought that if I did `node.privateKey="xxx"` on the server, that the value was lost after a deploy ...

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 November 2019 14:34 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/4 "2019-11-03T14:34:54Z")

</div>

> [@BartButenaers](#):
>
> lost after a deploy

Yes, you need to write to a file.

Also, how are you generating the keys? Generally, to be of use, they have to be cryptographically created which requires a specialist tool.

[https://www.startpage.com/do/dsearch?query=generate+key+pairs&cat=web&pl=opensearch&language=english](https://www.startpage.com/do/dsearch?query=generate+key+pairs&cat=web&pl=opensearch&language=english)

You can use a keystore if you want to use them but keep them safe. The private key needs, of course, to be kept private otherwise, you will need to regenerate the keys regularly.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 November 2019 16:34 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/5 "2019-11-03T16:34:52Z")

</div>

> [@TotallyInformation](#):
>
> Also, how are you generating the keys?

Julian (@TotallyInformation),  
I indeed use a third-party tool that generates the key pair.

I will rewrite my code - based on Dave's advise - to make sure the keys are never passed to the frontend web application.

But I had hoped the Node-RED credentials was safe enough to store both private and public key (together). But for user friendliness, it would be very handy if both keys were available in my custom node...

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 November 2019 16:38 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/6 "2019-11-03T16:38:41Z")

</div>

You could embed the keys in a configuration node. I believe that the data will be encrypted using Node-RED's key that you set in settings.js?

This should, at least, prevent it from being exported easily.

As always, a lot depends on the level of risk and the value of the system and its data.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [3 November 2019 16:56 UTC](https://discourse.nodered.org/t/best-place-to-generate-a-key-pair/17455/7 "2019-11-03T16:56:28Z")

</div>

> [@TotallyInformation](#):
>
> keys in a configuration node

Ok, was already redesigning to use config nodes, since I needed the keys in multiple nodes. Thanks!!!