I ask because some vendors of HSM try to avoid the export of wrapped secret key from HSM to insecure storage – storage that does not belong to these vendor’s HSM infrastructure.
For example, Thales prefer to backup keys to another Thales HSM – most of their documentation is about cloning between their devices. But Thales has an option when they send traffic via public networks: Backup HSM Installed Using Remote Backup Service (RBS)
“…It is useful in deployments where backups are stored in a separate location from the SafeNet Luna PCIe HSM, to mitigate the consequences of catastrophic loss (fire, flood, etc).”
gpg2 man pages say following:
Note that exporting a secret key can be a security risk if the exported keys are sent over an insecure channel.
From the other side I see that some solutions like AWS CloudHSM allow export/wrapping of key to insecure storage
Let’s use similar approach for AES-256 key wrapping described in this article How do HSM Backups work? for making a backup of 256-bit key from some HSM:
- The HSM generates a unique (per backup) AES 256-bit key (KDF is used) to encrypt each backup of the OTK (the one-time or ephemeral key).
- AES Key Wrap Algorithm: RFC 3394 (AES Key Wrap with No Padding)
The backup will be stored in the storage publicly available for reading (no write/delete permission). Let’s consider only attacks based on cryptanalysis, brute-force or dictionary attack (not side-channel or other kind of attacks). A dictionary attack is possible because the wrapping of AES-256 key is derived from passphrase (according to standard KDF). Assume that passphrase is strong or may be made strong enough if necessary.
All keys in the system have the same policy/purpose.
Updated: Since dictionary attack is in scope of this question generation of passphrase should be specified: Nowadays the following usage is common: for operation that happens rarely (like generation of the private key for wallet initialization or unwrapping the key to HSM from backup) 24 words are used (chia is an example). A person can write down these words. Dictionary contains 2048 == 2^11 words.
2^256 < (2^11)^24 == true
The application generates passphrase for the user. Each word from the dictionary is randomly (uniformly) selected. User's manipulations with input devices are used as seeds for RNG. The properties of generated pseudo-random sequences will be tested with randomness tests.
Is such export of wrapped secret key to insecure storage cryptographically secure? cryptographically secure means here that attacker cannot obtain secret (wrapped) key in plain text.
If mentioned conditions are not sufficient what should be modified?
Can the export of a wrapped secret key to insecure storage be cryptographically secure?