How to manage secret keys generate from the tezos-client?

Question

The tezos-client allows users to generate a pair of public and secret keys in the command line:

  gen keys <new> [-f --force] [-s --sig <ed25519|secp256k1|p256>]                                                                                                                                                  
    Generate a pair of keys.                                                                                                                                                                                       
    <new>: new secret_key alias                                                                                                                                                                                    
    -f --force: overwrite existing secret_key                                                                                                                                                                      
    -s --sig <ed25519|secp256k1|p256>: use custom signature algorithm 

It also requests a password

Enter password to encrypt your key:

It looks like it the public key and encrypted private key get stored in a file ~/.tezos-client/secret-keys.

If I need to move these keys from one computer to another (physically on a USB hard drive device or through the network), are their any best practices to consider? What are the risks if the encrypted secret key is exposed?

Answer 1

If you want to move the keys, copy all the files inside ~/.tezos-client/ to the new machine. As you noticed, your secret key is encrypted, so even exposed by someone stealing your USB stick, they'd have to brute-force the encryption passphrase on your secret key in order to do any operations with it.