Secure key component exchange

A key management system, comprising:

• a HSM comprising a processor configured to generate a custom certificate including non-sensitive information associated with the HSM;
• a key manager device communicatively coupled to the HSM and comprising a display and a processor configured to generate a machine-readable code of the custom certificate, wherein the key manager selectively displays the machine-readable code on the display in response to a key ceremony request;
• and
• a key loading device comprising an optical reader and a processor configured to scan the machine-readable code using the optical reader, extract the non-sensitive information from the machine-readable code, and establish a secure connection with the HSM using the non-sensitive information.

A method of establishing a secure connection for a key ceremony, the method comprising

• generating, at each hardware security module (HSM) of a plurality of HSMs, a custom certificate including non-sensitive information associated with the respective HSM;
• receiving, at a key manager, a request to generate a set of key components, wherein the request includes an indication of an HSM of the plurality of HSMs;
• generating, by the key manager, a machine-readable code encoding the custom certificate associated with the HSM;
• displaying, by the key manager, the machine-readable code;
• scanning the machine-readable code with a key loading device (KLD);
• decoding, at the KLD, the non-sensitive information associated with the HSM from the scanned machine-readable code;
• and
• initiating, from the KLD, a secure connection with the HSM based on the non-sensitive information, wherein the secure connection is configured to support the exchange of the set of key components.