(Probably not the right board to ask. But here goes)
I'm designing an IoT Solution with RPi as client and AWS as the server. On the client hardware, I have an Security Chip that can securely generate and store ECC, RSA, AES Keys/Pairs and can perform variety of cryptographic operations including ECDH, ECDSA, KeyGen, etc.,
My broader objectives on the cloud side are the following:
- On AWS Server side, I want to generate Unique ECC Keys per device, store them in HSM, perform ECDH to generate symmetric keys for encryption. I don't want anyone (including me) to have access to the private keys generated by KMS (Or any other AWS Service - Encrypted or otherwise).
- I would like for the encryption and decryption operations to be performed by AWS services (preferably in a dedicated hardware made for that job). This is to avoid abuse of implementation bugs in my code.
- While I can generate Data Encryption keys using KMS, I believe, I have to decrypt the private key in the code to use it. This means I have access to the private key.
- I didn't yet find way to do ECDH and then securely store the keys generated in that process.
Can you please help me the following:
- How to securely generate and store the ECC Keys for ECDH and ECDSA?
- Is there any service that can help me do the cryptographic operations (Encrypt, Decrypt, ECDH, ECDSA, etc.,) without me having to write the code for them?