AWS IoT - Unique Keys per each device - Data encryption

Question

(Probably not the right board to ask. But here goes)

I'm designing an IoT Solution with RPi as client and AWS as the server. On the client hardware, I have an Security Chip that can securely generate and store ECC, RSA, AES Keys/Pairs and can perform variety of cryptographic operations including ECDH, ECDSA, KeyGen, etc.,

My broader objectives on the cloud side are the following:

1. On AWS Server side, I want to generate Unique ECC Keys per device, store them in HSM, perform ECDH to generate symmetric keys for encryption. I don't want anyone (including me) to have access to the private keys generated by KMS (Or any other AWS Service - Encrypted or otherwise).
2. I would like for the encryption and decryption operations to be performed by AWS services (preferably in a dedicated hardware made for that job). This is to avoid abuse of implementation bugs in my code.

• While I can generate Data Encryption keys using KMS, I believe, I have to decrypt the private key in the code to use it. This means I have access to the private key.
• I didn't yet find way to do ECDH and then securely store the keys generated in that process.

Can you please help me the following:

1. How to securely generate and store the ECC Keys for ECDH and ECDSA?
2. Is there any service that can help me do the cryptographic operations (Encrypt, Decrypt, ECDH, ECDSA, etc.,) without me having to write the code for them?

Thanks!

tC

Answer 1

How to securely generate and store the ECC Keys for ECDH and ECDSA?

Keypair content for ECDH and ECDSA are identicial. They can be used in both algorithms, but the standard practice is to generate separate key for separate purposes.

As for storing, you have to consult the manual for your HSM.

• If your HSM can store them directly, then store them directly;

• If your HSM can store only an encryption key, then encrypt your ECC keys using that encryption key and store it in some kind of NVRAM, then store the encryption key in HSM.

If you need standard documents: here's a link.

Is there any service that can help me do the cryptographic operations (Encrypt, Decrypt, ECDH, ECDSA, etc.,) without me having to write the code for them?

You can use a library. There are many libraries out there, some notable ones include:

• OpenSSL - the best known, but had a serious "HeartBleed" vulnerability discovered in 2014.

• LibreSSL - a fork of OpenSSL maintained by OpenBSD developers.

• NSS - (Network Security Services) from Mozilla.