Best way to encrypt lots of private keys with the same passphrase I'm working on software which deals with lots (several millions) of RSA private keys. Keysize is 2048.

I have to store them in a database, and I want them to be encrypted to mitigate risks of compromise from hostile access to the database. Naturally, applying a passphrase with PKCS #8 comes to mind.

I can't have a separate passphrase for each key because I can't store them securely. I can only store several passphrases in a secure vault.

But now I suspect that it's not safe to apply the same passphrase to millions of private keys with PKCS #8.

Could you please:


Confirm or refute my assumption that using the same passphrase to encrypt millions of keys with PKCS #8 significantly weakens encryption strength. If Eve gets enough encrypted keys, can she decrypt them knowing that an identical passphrase was applied? A kind of "many times pad" attack?
Suggest a better encryption method which uses the same passphrase (or a limited number of them).
Confirm or refute my assumption that using same passphrase to encrypt
  millions of keys with PKCS #8 significantly weakens encryption
  strength. If Eve gets enough encrypted keys, she can decrypt them
  knowing that same passphrase was applied? Kind of "many times pad"
  attack?


It depends.
If you are using PKCS#8 encryption using the methods from PKCS#5 v1.5 (and not >v2.0), then you are using ciphers with very short key-lengths, like DES. This is obviously bad, as we can reasonably brute-force the keys (of interest).

However, PKCS#5 (which is the encryption specified by PKCS#8) should generate a new random salt for each container and use password based key derivation with this salt and some reasonable iteration paramter to arrive at a key / IV pair for the encryption. That is, all private keys would be encrypted using different keys derived from different salts and the same password.

So overall the encryption is not weak because you encrypt a lot of data, but because you use a weak encryption method (if you use the old v1 PKCS#5 standard).


  Suggest a better encryption methods which use same passphrase (or
  limited number of them).


Assuming the password is strong and not leaked, PKCS#5 v2.X should do the trick indeed. One might consider adding additional indirection though, that is use the password to derive a master secret (eg 256-bit) which is then fed to the PKCS#5 calls, so that you can easily change the password when it is eg leaked or people go, but they didn't take the derivation parameters / keys.