I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without retrieving keys from another server.

The solution I came up with is using an IoT HSM - Zymkey for raspberry pi


If someone were to steal the Raspberry Pi I don't want them to able to able to have access to the encryption keys. So I thought maybe trimming off the last few characters from the key might help. I have a diagram below. enter image description here

Is this method safe? Is it even useful? Or is this dangerous?

  • Hello and welcome to StackExchange! This is a fantastic first question! – MechMK1 Apr 12 '19 at 12:54
  • Why not have the user input the entire encrypted KEK, rather than storing half of it on the device? – AndrolGenhald Apr 12 '19 at 13:50
  • I considered that. A 256-bit key would be 64 characters in hexadecimal, right? I could have the string in base64 and drop it down to 43 characters. Just seemed like a longer string would make it more painstaking for the user to input. I suppose that's a worthwhile trade for better security though. Thank you. – superkayrad Apr 12 '19 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.