This is from the FIPS 140-2 standard:
Cryptographic keys stored within a cryptographic module shall be stored either in plaintext form or encrypted form. Plaintext secret and private keys shall not be accessible from outside the cryptographic module to unauthorized operators A cryptographic module shall associate a cryptographic key (secret, private, or public) stored within the module with the correct entity (e.g., person, group, or process) to which the key is assigned. Documentation shall specify the key storage methods employed by a cryptographic module.
I am not sure I can interpret it correctly.
If the keys can be stored in plaintext form does it mean that there is no security expectations for key-storage (as a structure) from FIPS?
Or to reverse the question:if the keys are stored in encrypted form, does the algorithm used to encrypt the keys need to be FIPS certified?If yes why, since they could be stored in plaintext and still be acceptable by the standard.
My interpretation of this is that you can store the keys how you want, just make sure that no unauthorized users can access them.E.g. store them in plain text and "shield" the PC that has the plaintext. So no kind of e.g. FIPS encryption algorithms are needed.
Any input on this is highly appreciated.