Upravljanje ključevima

Kompaktni primjeri za upravljanje ključevima. → Detalji: Scenariji ključeva

// ML-DSA (potpisi)
using var mlDsa65 = MlDsaSigner.Create(MlDsaParameterSet.MlDsa65);
using var mlDsa87 = MlDsaSigner.Create(MlDsaParameterSet.MlDsa87);
 
// ML-KEM (razmjena ključeva)
using var mlKem768 = MlKem.Create(MlKemParameterSet.MlKem768);
using var mlKem1024 = MlKem.Create(MlKemParameterSet.MlKem1024);
 
// Klasično (Hybrid)
using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP384);
using var rsa = RSA.Create(4096);

→ Detalji: Generiranje

// DPAPI (Windows)
byte[] privateKey = mlDsa.ExportPrivateKey();
byte[] encrypted = ProtectedData.Protect(privateKey,
    entropy: null, DataProtectionScope.CurrentUser);
 
// PEM s lozinkom
string pem = mlDsa.ExportEncryptedPkcs8PrivateKeyPem(
    "lozinka"u8, new PbeParameters(
        PbeEncryptionAlgorithm.Aes256Cbc,
        HashAlgorithmName.SHA256, 100000));

→ Detalji: Pohrana

var rotationService = new KeyRotationService(options =>
{
    options.RotationInterval = TimeSpan.FromDays(90);
    options.MaxKeyAge = TimeSpan.FromDays(365);
});
 
// Provjera je li rotacija potrebna
if (rotationService.ShouldRotate(currentKey))
{
    var newKey = MlDsaSigner.Create(MlDsaParameterSet.MlDsa65);
    rotationService.Rotate(currentKey, newKey);
}

→ Detalji: Rotacija

// Shamir Secret Sharing (3-of-5)
var shares = ShamirSecretSharing.Split(
    privateKey, totalShares: 5, threshold: 3);
 
// Distribucija povjerenicima
foreach (var (index, share) in shares)
    SaveToTrustee(index, share);
 
// Oporavak
var recoveredShares = new[] { shares[0], shares[2], shares[4] };
byte[] recovered = ShamirSecretSharing.Combine(recoveredShares);

→ Detalji: Backup

// Sigurno brisanje
CryptographicOperations.ZeroMemory(privateKeyBytes);
 
// Opoziv certifikata
var crlBuilder = new CertificateRevocationListBuilder();
crlBuilder.AddEntry(cert.SerialNumber,
    DateTimeOffset.UtcNow, X509RevocationReason.KeyCompromise);

→ Detalji: Uništavanje

« ← Kratka referenca | → Scenariji ključeva (Detalji) »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional