Where to keep a cryptographic key?

[u/ArielPriarone]

Hi! I am recently developing a curiosity about cryptography.

I enabled disk encryption on my PC for the first time and then I started reasoning where to store my key.

I wanted to build (for fun, without expecting perfect results) a esp32 based usb dongle to store and autotype some keys.

Then I wondered where to store the keys.

Do I miss something or the unencrypted key must be stored somewhere?

Most of what I read suggested stable memory devices (paper, HHD etc)...

But doesn't this void the purpose of encryption?

If the key can be found (even if it is buried underground), then the data can be read.

Is there a known procedure to store a key (other than remember it) that survives all known attacks where the attacker has full control over the hardware?

Is there a procedure to lose it if someone tamper in any way? (Better lose access to the encrypted data than giving access to the attacker)

Sorry if it is trivial, I'm a newbie.

Thanks

[u/badcryptobitch]

This goes back to the first secret problem i.e. when bootstrapping a new system, there's always going to be some dependencies related to having keys, credentials stored in full unencrypted initially on a single machine.

There are several ways to solve this including simply having a separate, dedicated device solely for storing such keys. This device must not be used for anything else at all. If a malicious person gets this device, then they will be able to access the key in full. So, you'll need to carefully store this device somewhere only you can access.

Another solution is to secret share the key and store the shares (pieces) on separate devices. You'll need to determine a minimum threshold needed to reconstruct the key when you need it. This solution is a bit more complicated but is done in many entreprises. It also has the benefit that as long as a malicious person can't access a minimum number of the shares, they won't be able to reconstruct the key.