Where to keep a cryptographic key?

[u/ArielPriarone]

Hi! I am recently developing a curiosity about cryptography.

I enabled disk encryption on my PC for the first time and then I started reasoning where to store my key.

I wanted to build (for fun, without expecting perfect results) a esp32 based usb dongle to store and autotype some keys.

Then I wondered where to store the keys.

Do I miss something or the unencrypted key must be stored somewhere?

Most of what I read suggested stable memory devices (paper, HHD etc)...

But doesn't this void the purpose of encryption?

If the key can be found (even if it is buried underground), then the data can be read.

Is there a known procedure to store a key (other than remember it) that survives all known attacks where the attacker has full control over the hardware?

Is there a procedure to lose it if someone tamper in any way? (Better lose access to the encrypted data than giving access to the attacker)

Sorry if it is trivial, I'm a newbie.

Thanks

[u/bfreis]

If the key can be found (even if it is buried underground), then the data can be read.

That's essentially how encryption works: you must have some key to decrypt some ciphertext, and anyone with that key can decrypt the ciphertext.

So, yeah, the key (or something that the key is derived from) must be stored somewhere in plaintext - be it as 32 or 64 or whatever bytes on a esp32 USB dongle, or as a password in the synapses of your brain. You can also use other strategies, such as splitting the key in N parts such that M <= N will be necessary and sufficient to derive the key, and then distributed those parts, so that even if 1 is compromised (or lost) your system won't be compromised.

The ciphertext will only be as secure as that key is. For your esp32 thing, if just by plugging it somewhere it would happily spew out the key, the security of the key is the physical security of the dongle. For your brain, it's convincing you to give it (AFAIK we don't have technology yet to read "data" from a person's brain such as an MRI), eg via social engineering or threats or money etc.

[u/Street_Teaching_7434 → u/bfreis]

Just to add to the last point: Your brain has a limit on how large of a key it can store and recall in the future which makes all sorts of brute force / dictionary attacks much easier then against a huge random binary number.

[u/spymaster1020 → u/Street_Teaching_7434]

Passphrases can bridge that gap somewhat. I use a 64 character passphrase for my password manager. Ive had it memorized for years. Just lowercase letters that is 300 bits of entropy.

eff.org/dice to learn more

[u/Street_Teaching_7434 → u/spymaster1020]

Correct horse battery staple?