Cryptographic key storage system and method

A system comprising:

• at least one processor;
• a communication interface communicatively coupled to the at least one processor;
• and
• memory storing computer-readable instructions that, when executed by the at least one processor, cause the system to:
• split, a cryptographic signature key into a plurality of cryptographic key shares, wherein the cryptographic signature key may be derived using a quorum number of the plurality of cryptographic key shares;
• generate a plurality of encrypted cryptographic key shares and a plurality of share encryption keys (SEKs) by, for each respective cryptographic key share of the plurality of cryptographic key shares:
• generate a SEK for the respective cryptographic key share;
• and
• encrypt, using the corresponding SEK, the respective cryptographic key share to create a corresponding encrypted cryptographic key share;
• generate a plurality of encrypted SEKs and a plurality of operator keys by, for each respective SEK of the plurality of SEKs:
• generate a corresponding operator key for the respective SEK;
• and
• encrypt, using the corresponding operator key, the respective SEK to create a corresponding encrypted SEK;
• distribute the plurality of operator keys corresponding to the plurality of encrypted SEKs to a plurality of end user devices (EUDs) by, for each EUD of the plurality of EUDs:
• provide a corresponding operator key to a hardware security module (HSM) of the respective EUD, wherein the HSM is configured to prevent unauthorized copying of the corresponding operator key;
• store, by the computing platform, the plurality of encrypted cryptographic key shares, the plurality of encrypted SEKs, and indications identifying, for each respective encrypted SEK of the plurality of encrypted SEKS, the respective EUD storing the corresponding operator key;
• receive, from a first subset of EUDs, requests to download an encrypted SEK corresponding to each respective EUD of the first subset of EUDs, wherein the first subset of EUDs comprises at least the quorum number of EUDs;
• send, to each EUD of the first subset, a respective encrypted SEK of the plurality of encrypted SEKs;
• receive, from each EUD of a second subset of EUDs, a corresponding decrypted SEK decrypted by a respective EUD using the operator key stored in an HSM of the respective EUD;
• decrypt, using the decrypted SEKs received from the second subset of EUDs and based on determining that the second subset of EUDs comprises at least the quorum number of EUDs, corresponding encrypted cryptographic key shares;
• and
• reconstruct, using a reconstruction algorithm and the quorum number of the plurality of decrypted cryptographic key shares, the cryptographic signature key.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• split a cryptographic signature key into a plurality of cryptographic key shares, wherein the cryptographic signature key may be derived using a quorum number of the plurality of cryptographic key shares;
• generate a plurality of encrypted cryptographic key shares and a plurality of share encryption keys (SEKs) by, for each respective cryptographic key share of the plurality of cryptographic key shares:
• generate a corresponding SEK for the respective cryptographic key share;
• and
• encrypt, using the corresponding SEK, the respective cryptographic key share to create a corresponding encrypted cryptographic key share;
• generate a plurality of encrypted SEKs and a plurality of operator keys by, for each respective SEK of the plurality of SEKs:
• generate a corresponding operator key for the respective SEK;
• and
• encrypt, using the corresponding operator key, the respective SEK to create a corresponding encrypted SEK;
• distribute the plurality of operator keys corresponding to the plurality of encrypted SEKs to a plurality of end user devices (EUDs) by, for each EUD of the plurality of EUDs:
• provide a corresponding operator key to a hardware security module (HSM) of the respective EUD, wherein the HSM is configured to prevent unauthorized copying of the corresponding operator key;
• store, by the computing platform, the plurality of encrypted cryptographic key shares, the plurality of encrypted SEKs, and indications identifying, for each respective encrypted SEK of the plurality of encrypted SEKS, the respective EUD storing the corresponding operator key;
• receive, from a first subset of EUDs, requests to download an encrypted SEK corresponding to each respective EUD of the first subset of EUDs, wherein the first subset of EUDs comprises at least the quorum number of EUDs;
• send, to each EUD of the first subset, a respective encrypted SEK of the plurality of encrypted SEKs;
• receive, from each EUD of a second subset of EUDs, a corresponding decrypted SEK decrypted by a respective EUD using the operator key stored in an HSM of the respective EUD;
• decrypt, using the decrypted SEKs received from the second subset of EUDs and based on determining that the second subset of EUDs comprises at least the quorum number of EUDs, corresponding encrypted cryptographic key shares;
• and
• reconstruct, using a reconstruction algorithm and the quorum number of the plurality of decrypted cryptographic key shares, the cryptographic signature key.