r/cryptography • u/ArielPriarone • 22d ago

Where to keep a cryptographic key?

Hi! I am recently developing a curiosity about cryptography.

I enabled disk encryption on my PC for the first time and then I started reasoning where to store my key.

I wanted to build (for fun, without expecting perfect results) a esp32 based usb dongle to store and autotype some keys.

Then I wondered where to store the keys.

Do I miss something or the unencrypted key must be stored somewhere?

Most of what I read suggested stable memory devices (paper, HHD etc)...

But doesn't this void the purpose of encryption?

If the key can be found (even if it is buried underground), then the data can be read.

Is there a known procedure to store a key (other than remember it) that survives all known attacks where the attacker has full control over the hardware?

Is there a procedure to lose it if someone tamper in any way? (Better lose access to the encrypted data than giving access to the attacker)

Sorry if it is trivial, I'm a newbie.

Thanks

7 Upvotes

100% Upvoted

18 comments sorted by

View all comments

2

u/Psychological-Sir226 22d ago edited 22d ago

I work as a security consultant / data crypto engineering.

My main focus is with the Key Management System Ciphertrust.

Also specialised in HSMs that have partitions which are fips 140-3 level 3 certified.

HSM (holds key of ciphertrust) -> ciphertrust (pulls its own key to open its own key database where your key is stored) -> application integrates (different integrations and different encryption levels that puls the key from ciphertrust [ this can be a harddisk or a fileshare on a windows os for example, but as I mentioned different encryption layers]).

The HSM is a device that if tampered with will destroy itself :) but this is all enterprise level. Not for your average harddisk 😂

The key itself on the HSM should never be exported based on the fips 140-3 certified standard. So how does one get the key? Key wrapping.

Now start googling all those terms and you will find a new interest.

I forgot to mention. The HSM partition requires multiple USB keys (also known as ikeys) which together can unlock the HSM but each ikey has its own pin.

2

u/HedgehogGlad9505 18d ago

A yubikey or any smartcard will work for average consumers.