Using nitrokey HSM for symetric keys

Nitrokeys
1

Hi all,

new to HSM , I wonder about a use case :

=> HSM to generate keys for use with local AES (e.g. in hybrid encryption systems), using Attribute.EXTRACTABLE

(from http://python-pkcs11.readthedocs.io/en/latest/applied.html#symmetric-keys)
=> surely with another kind of HSM (thales, gemalto,…)

I read from nitrokey HSM feature and I understand that only asymetric crypto is available.

Any idea about how I could use the nitrokey HSM to handle this specific use case ?

Cheers

gilles

2

Nitrokey HSM only supports asymmetric algorithms (RSA and ECC). Nitrokey Pro supports RSA and AES, so you might be interested in this one.

BTW, the term “hybrid encryption” usually refers to scenarios where the asymmetric key can be stored in a device like Nitrokey and a symmetric algorithm (e.g. AES) is used to encrypt the payload data separately from the device. You can apply such scenario also with Nitrokey HSM.

If “generate keys for use with local AES” refers to the usage of Nitrokey’s TRNG, that could be applied too.

3

Ok thanks !
so, regarding Nitrokey_Pro_factsheet.pdf indicates 1 AES 256 bit :
Is it still possible (even if not advised) to extract this AES key in clear text OUT OF the HSM ?

4

Hi!

We use python-pkcs11 with hybrid encryption in one of our projects - encryption-tool. Perhaps reading its source would give you some ideas.

1 Like
5

No. If you want that, you can store the AES key as DO on any of our models. You can think of DO as a kind of “file on smart card”.

6

do you mean by that
Storing arbitraty data in Elementary Files (EF) ?

7

Elementary Files (EF), yes.

1 Like
8

I am new and playing with Nitrokey HSM and reading forum, thnaks in advance for your help

when you say “any of our models” you mean also the HSM one?
if you store the AES key as EF, does it mean that the smartcard inside the HSM can’t actually use the key for doing AES operation? is it just plain storage?

9

It is like a storage for the AES key, but not plain as in plaintext of course :wink: it is stored securely in the smartcard either way (no matter if Pro, Storage oder HSM). The AES key can not be used for decryption directly.

1 Like
10

Related to this, I have found this page very useful
https://raymii.org/s/articles/Storing_arbitraty_data_in_the_Nitrokey_HSM.html

1 Like