Score:2

Wrap-unwrap of private key using EC master key

sv flag

I want to wrap a private key out of a HSM, using an external EC key pair (master key) and then verify that I can recover it.
The wrapping occurs as follows:

  1. Generate a secret AES key in the HSM, using the public part of the EC master key, the private part of the internal key pair and the derivation mechanism CKM_ECDH1_DERIVE. The derivation parameters for this mechanism are: derivation function CKD_SHA256_KDF, shared data and public data (public data are taken from the public EC master key).
  2. Wrap the private key, using the secret AES key and a mechanism such as CKM_AES_GCM, CKM_AES_KEY_WRAP_PAD or CKM_AES_CBC_PAD.
  3. The HSM returns a byte array.

Could someone tell me if I'm doing right and what I should use as shared and public data when the HSM generates the secret key?
Then, how could I recover this private key, with the help of the private part of the EC master key pair, in order to be sure that the process works well?

Score:1
in flag

Could someone tell me if I'm doing right

This is generally the way this is performed yes, as IES as explained in your other question.

The internal key pair needs to be ephemeral, i.e. you'd need to generate a new key pair for each key that is wrapped. This means that it should be a session key in the HSM.

Note that the IV is generally static. This is a huge issue as this means that private key information of the wrapped key may be leaked. For CBC mode you'd think that it would be relatively secure, but please remember that asymmetric, private keys are generally not fully randomized.

what I should use as shared and public data when the HSM generate the secret key

The shared data is the data used within the KDF as optional parameter. The shared data is inconsequential in this case, and might be NULL, or something like the ASCII representation of "WRAPPING_KEY" or something similar.

The public data is simply the public key of the EC "master" key pair.

Then, how could I recover this private key, with the help of the private part of the EC master key pair, in order to be sure that the process works well?

You perform the same operation using the public key of the internal key pair which you need to export and the EC master key. You'd have to use the same key derivation mechanism (KDF), with the same shared data. For EC key derivation you'd need to perform the KDF over the statically sized X-value of the ECDH (called "Z" in the standard, you'd need to get the ANSI or ISO standard to get why). Then you perform the decrypt / unwrap, giving you the encoded private key, which you'll probably have to decode.

Maarten Bodewes avatar
in flag
I'm always amazed that PKCS#11 is *terrible* when it comes to key management. Bad documentation, many pitfalls with dangerous or outright insecure algorithms, different (key derivation) mechanisms on different HSM's, no HSM agnostic backup/restore. KCV being defined as an encryption operation on symmetric keys (possibly leaking key stream for CTR mode). I'm sorry to say it is a complete and utter mess. OASIS, maybe you can use some advice?
3ric-T avatar
sv flag
Thanks for the explanation, @Maarten I have to admit that I am quite scared to develop software that talk to a HSM without having someone like you in the office to ask all the questions that come to mind...
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.