An open discussion list for topics related to the eduGAIN interfederation service.

[Leif Johansson <leifj AT sunet.se>]

On 2019-03-28 11:19, Peter Schober wrote:
> * Leif Johansson <leifj AT sunet.se> [2019-03-28 11:11]:
>> It is still a *very* common model - generate on one HSM and use on
>> another. There are several reasons you want to do stuff like this
>> beyond simple "backup" patterns.
> 
> If that exists I'm certainly all for it. It's not like I *want* to own
> the processes of secure key creation when the HSM could do it (and
> hopefully with a better RNG, at least with Cryptech).

Yeah but you might want to have > 1 HSM - one you lock into a safe
where you do key generation and one where you deploy the key for
production because that may allow you to switch between multiple
generations of HSM hardware without re-generating a long-term key.

> 
> The "create-outside-HSM-then-import" method is simply my workaround
> because there is no portability of key material across HSMs (except
> the backup/restore between identical models or devices from the same
> vendor), AFAIK.
> If there's a way to do that even when changing platforms I'm in!
> 

Yeah pkcs11 allows you to import keys. This is exactly what I do
for my process. I generate outside my Luna cluster and import via
a p11 client and then I lock the key so it can't be re-exported.

Some of my keys are higher trust than others... they might stay
in the environment where they were generated. YMMV

> -peter
>