Recreating a DKEK share

Control of the DKEK M-of-n scheme is feasible with sc-hsm-tool. This is how to do it.

Beware though! This allows you only to export and import encrypted content between devices sharing the same DKEK. It has nothing to do with actual authentication tu use materials on a given device. Support for m-of-n authentication is not implemented in sc-hsm-tool.

If you’re okay with having only the DKEK protected with a m-of-n scheme, and having a simple PIN for authentication, then go ahead, you should be fine with sc-hsm-tool.

If you absolutely need m-of-n authentication with nitrokeys HSM, the only way would be to go with SmartCard Shell and PKIAAS. But I would advise against that. Learn more in my user experience review.

Hope this helps