Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.futurex.com/llms.txt

Use this file to discover all available pages before exploring further.

When considering different key storage methods, keep the following factors in mind:
  • Storage location: Do you store keys on or off the HSM?
  • Format: In what format do you store encrypted keys?
The following sections explore these considerations.

​
Storing keys on or off the HSM

For general-purpose use cases, the primary method for storing keys is on the HSM. However, some HSM products divert from this norm by storing keys off the HSM (for example, nShields Security World). When keys are stored off the HSM, they are encrypted with a master key that is stored on the HSM.

​
Encrypted key format

Encrypted keys are generally in one of the following formats:
  • Cryptogram
  • TR-31 key block
Key block formats other than TR-31 exist, but they are more proprietary. The American National Standards Institute (ANSI) developed TR-31 key blocks, so this format has more widespread support.

​
What is a cryptogram?

A cryptogam is an encrypted blob of data. Aside from the encryption itself, no additional security mechanisms are built in. Instead of using a cryptogram, we recommend using TR-31 key blocks to manage keys. The advantages of using TR-31 key blocks are explained further in the following section.

​
What is a TR-31 key block?

The ANSI X9.24-1-2017 specification describes TR-31 key blocks. The key block structure consists of the following parts: Header, Encrypted key data, and MAC.
PartDescription
HeaderThe header is the least sensitive part of the key block. It defines the key block type, key usage, and key type.
Encrypted key dataThis part contains all the key sensitive data, including the actual key values and their size. It can optionally contain the ciphering mode used and data padding options.
MACThe Message Authentication Code (MAC) is an integrity check of the header and key data and ensures that the key block is unmodified.
Our HSMs use TR-31 key blocks for external key escrow and key transport. We recommend using TR-31 key blocks to manage keys instead of cryptograms because key blocks safeguard against unauthorized substitution, replacement, or misuse of cryptographic keys by embedding information about a key within the key and data itself. Cryptograms do not provide this extra level of security.