New answers tagged key-generation
As others have noted, storing a key securely cannot be accomplished by software alone. You need a hardware security device in play to provide persistent secure storage of data at rest. If your target device has a TPM, this is what it's for. There are APIs you can use to wrap secrets using the TPM's platform configuration registers. (Storage in RAM is a ...
You want the key recoverable upon reboot and without a user present, so proposing to encrypt it with a user password and store it in RAM goes against your requirement for a recoverable key. So, encrypting it with user password is a non-starter. Let's reject that proposal. Instead, we will need to store it in a recoverable form (i.e. in plaintext or ...
None. Storing the key in a way you can access it after a reboot is the same as storing the user password. And that is a very bad idea.
The important part of this seems to be the next line in the RFC: In this scenario, the composite shared secret K is constructed during the provisioning process from a random seed value combined with one or more additional authentication factors. The key data should never be just the data known at that point, but should be derived from it using a ...
For those looking on how to make use of the OBKG function on some Gemalto smart cards with SSH, I wrote up my experience here I'm sure someone with more knowledge could automate the process (or knows a better way) but mine did work out in the end.
Top 50 recent answers are included