Is it possible to generate RSA key and get its private exponent in clear and to be compliant with the following PCI requirement?:
Keys must be generated so that it is not feasible to determine that certain keys are more probable than other keys from the set of all possible keys. Cryptographic keys or key components must be generated by one of the following:
- An approved key-generation function of a PCI–approved HSM
- An approved key-generation function of a FIPS 140-2 Level 3 (or higher) HSM
- An approved random number generator that has been certified by an independent laboratory to comply with NIST SP800-22
For example by importing AES key onto FIPS 140-2 Level 3 compliant token, generating RSA key pair on it and wrap its private part to PKCS#8 with imported AES key? Then decrypt private key with AES key on trusted desktop computer.