Short question: Is the D parameter of the RSA alghorithm crypthographically strong enough to be used as a secret key for generating SHA-256 hash value?
Long question: I'm working on windows platform. I have to protect certain data with HMAC. I have 4 servers that need to be able to generate/validate hmac values for certain data.
I'm using this class to generate the HMAC value - https://msdn.microsoft.com/en-us/library/system.security.cryptography.hmacsha256(v=vs.110).aspx
It requires secret. Obviously the secret needs to be shared among all 4 servers. I have a requirement to protect this secret. It can't be stored as a plain text file.
It's fine for certain key custodian to access this secret but not for wider audience e.g. system maintainers/developers.
I thought I might use windows certificate store as a mechanism that protects the key. The idea is following
Key custodian generates a self signed certificate, installs it in the certificate store on each of the 4 servers. After cert is installed the key custodian grants access to the certificate and private key to a "system user" that hosts the application. This is done on each server.
The cert is retrieved as needed by application and private private key extracted and then D value of that private key is fed into hmac calculator as shared secret.
private byte ExtractPrivateKeyFromCertificate(X509Certificate2 certificate)
var provider = certificate.PrivateKey as RSACryptoServiceProvider;
var privateKey = provider?.ExportParameters(true);
if (privateKey != null)
var value = privateKey.Value;
throw new ArgumentException("Certificate does not contain a private key", nameof(certificate));
then that is passed into the Hmac calculator
var hmac = new HMACSHA256(ExtractPrivateKeyFromCertificate(certificate));
and hash is calculated