Can export of wrapped secret key to insecure storage be cryptographically secure?

1. I ask because some vendors of HSM try to avoid the export of wrapped secret key from HSM to insecure storage – storage that does not belong to these vendor’s HSM infrastructure.

   For example, Thales prefer to backup keys to another Thales HSM – most of their documentation is about cloning between their devices. But Thales has an option when they send traffic via public networks: Backup HSM Installed Using Remote Backup Service (RBS)

   “…It is useful in deployments where backups are stored in a separate location from the SafeNet Luna PCIe HSM, to mitigate the consequences of catastrophic loss (fire, flood, etc).”

2. gpg2 man pages say following:

   Note that exporting a secret key can be a security risk if the exported keys are sent over an insecure channel.

3. From the other side I see that some solutions like AWS CloudHSM allow export/wrapping of key to insecure storage

Let’s use similar approach for AES-256 key wrapping described in this article How do HSM Backups work? for making a backup of 256-bit key from some HSM:

1. The HSM generates a unique (per backup) AES 256-bit key (KDF is used) to encrypt each backup of the OTK (the one-time or ephemeral key).
2. AES Key Wrap Algorithm: RFC 3394 (AES Key Wrap with No Padding)

The backup will be stored in the storage publicly available for reading (no write/delete permission). Let’s consider only attacks based on cryptanalysis, brute-force or dictionary attack (not side-channel or other kind of attacks). A dictionary attack is possible because the wrapping of AES-256 key is derived from passphrase (according to standard KDF). Assume that passphrase is strong or may be made strong enough if necessary.

All keys in the system have the same policy/purpose.

Updated: Since dictionary attack is in scope of this question generation of passphrase should be specified: Nowadays the following usage is common: for operation that happens rarely (like generation of the private key for wallet initialization or unwrapping the key to HSM from backup) 24 words are used (chia is an example). A person can write down these words. Dictionary contains 2048 == 2^11 words.

2^256 < (2^11)^24 == true

The application generates passphrase for the user. Each word from the dictionary is randomly (uniformly) selected. User's manipulations with input devices are used as seeds for RNG. The properties of generated pseudo-random sequences will be tested with randomness tests.

Is such export of wrapped secret key to insecure storage cryptographically secure? cryptographically secure means here that attacker cannot obtain secret (wrapped) key in plain text.

If mentioned conditions are not sufficient what should be modified?

Can the export of a wrapped secret key to insecure storage be cryptographically secure?

With a passphrase having at least as much entropy as the wrapping key, such exporting "under wrap" is effectively as secure as the less secure of (the underlying encryption algorithm) and (the storage method of the passphrase). It is usually recommended that such backups be stored in another HSM of equal or greater security to the original, as always access to the HSM itself must be controlled for it to remain secure.