Is D parameter of the RSA strong enough to be used as secret for HMAC calculation?

Question

Short question: Is the D parameter of the RSA alghorithm crypthographically strong enough to be used as a secret key for generating SHA-256 hash value?

Long question: I'm working on windows platform. I have to protect certain data with HMAC. I have 4 servers that need to be able to generate/validate hmac values for certain data.

I'm using this class to generate the HMAC value - https://msdn.microsoft.com/en-us/library/system.security.cryptography.hmacsha256(v=vs.110).aspx

It requires secret. Obviously the secret needs to be shared among all 4 servers. I have a requirement to protect this secret. It can't be stored as a plain text file.

It's fine for certain key custodian to access this secret but not for wider audience e.g. system maintainers/developers.

I thought I might use windows certificate store as a mechanism that protects the key. The idea is following

Key custodian generates a self signed certificate, installs it in the certificate store on each of the 4 servers. After cert is installed the key custodian grants access to the certificate and private key to a "system user" that hosts the application. This is done on each server.

The cert is retrieved as needed by application and private private key extracted and then D value of that private key is fed into hmac calculator as shared secret.

    private byte[] ExtractPrivateKeyFromCertificate(X509Certificate2 certificate)
    {
        var provider = certificate.PrivateKey as RSACryptoServiceProvider;
        var privateKey = provider?.ExportParameters(true);

        if (privateKey != null)
        {
            var value = privateKey.Value;
            return value.D;
        }
        else
        {
            throw new ArgumentException("Certificate does not contain a private key", nameof(certificate));
        }           
    }

then that is passed into the Hmac calculator

var hmac = new HMACSHA256(ExtractPrivateKeyFromCertificate(certificate));

and hash is calculated

hmac.ComputeHash(data)

Answer 1

Do not do this. No, it's not ok.

What you're looking for is to protect the integrity of some message. You would like to use HMAC, which is the correct algorithm. The question is: how to link up RSA and HMAC and all messages.

You should use standard Public Key Signing.

1. Generate a random HMAC Key (size is the same as the size of the hash used for HMAC).
2. Compute HMAC(Message,Key_HMAC).
3. Compute Sign(HMAC,Key_RSA).

Package Message||Key_HMAC||Signature and distribute as needed.

To check integrity, recompute HMAC and verify signature over it.

Every server sharing the same self signed Signing certificate is OK. Or, you could create a root certificate and provision four Signing certificates each signed by the root cert, one per server. If you properly sign the message and package it in a PKCS envelope, the server that signed it will package it's certificate with the signature and each server can separately verify the signature as it trusts the root of the attached certificate. This may take up a lot of space (PKI signature can be large) per signed message.