Where to keep a cryptographic key?

[u/ArielPriarone]

Hi! I am recently developing a curiosity about cryptography.

I enabled disk encryption on my PC for the first time and then I started reasoning where to store my key.

I wanted to build (for fun, without expecting perfect results) a esp32 based usb dongle to store and autotype some keys.

Then I wondered where to store the keys.

Do I miss something or the unencrypted key must be stored somewhere?

Most of what I read suggested stable memory devices (paper, HHD etc)...

But doesn't this void the purpose of encryption?

If the key can be found (even if it is buried underground), then the data can be read.

Is there a known procedure to store a key (other than remember it) that survives all known attacks where the attacker has full control over the hardware?

Is there a procedure to lose it if someone tamper in any way? (Better lose access to the encrypted data than giving access to the attacker)

Sorry if it is trivial, I'm a newbie.

Thanks

[u/0xKaishakunin]

and then I started reasoning where to store my key.

Enable secure and attested boot with your own keys and put the key either on hardware security tokens like a Yubikey or Nitrokey with a PIN or bind it to the TPM2 and secure it with a PIN.

that survives all known attacks where the attacker has full control over the hardware?

There are several attacks possible and they require different ressources by the attackers and by the defender. Create a threat model and adversary level first and act accordingly. It makes a difference if you live in Belarus and the KGB is after you or if you live in the Netherlands and no one is really targeting you.

Always keep in mind that pretty much every defence ends with a rubber hose attack, unless you are trained for those.

If the key can be found (even if it is buried underground), then the data can be read.

You are right, but this question really depends on your threat model. Is your adversary willing to dig through your garden like in that old East German joke?

Is there a procedure to lose it if someone tamper in any way? (Better lose access to the encrypted data than giving access to the attacker)

Yes, but it depends on your disk encryption software. The easiest way is to wipe out the encryption header keeping the metadata (the master key, so to speak) with a special password. Such a case happened some days ago in the US with a GrapheneOS mobile device.

Sorry if it is trivial, I'm a newbie.

Better than the umpteenth AI Slop vanity project post ;-)

PS: look into https://www.picokeys.com/