I asked a question earlier where it was recommended that I describe my issue using standard cryptography notation.
How do I learn this notation and how to convey my approach?
How can I annotate this notation to indicate implementation specific issues?
Although the wording of the second bullet may seem strange, I do need to describe these real world factors that affect my design:
I'm deploying on Windows Azure and the only secure location for cryptographic material is located within the Certificate Store (uploaded by the management portal). Only solutions that use x509 certificates are supported.
I need to store private keys of my customers securely on Azure Blob storage. Since these certificates are browsable by many tech support folk @MSFT, I want to encrypt the data at rest, indirectly using an x509 certificate.
The reason I'm saying indirectly by an x509 certificate is because I may store payloads that are larger than the modulus of the cert, or may want faster performance using a symmetric key.