I'm building a basic HSM out of an Arduino, and am using the following scheme to store data:
- Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction).
- Secondary symmetric keys $k_s$ stored as plaintext in web application database, one per user.
- HSM record key $k_r$ generated by
xor'ing the two keys togethercomputing $AES(k_s, k_m)$, using AES-128-ECB. This means that both the HSM and application server would have to be compromised in order to reveal the key.
- AES-128-CBC used to encrypt the data, using a unique pseudo-random IV and the record key.
- Each record on the HSM consists of a plaintext record ID, the IV, and a data block.
Is it worth applying a HMAC-SHA1 hash over this data to provide integrity and authenticity checking? If so, what should I use as key material?