Device-stored keys
Device-stored keys are private keys that are stored on a Confidencial user’s device. This is in contrast to cloud-stored keys, which are split (sharded) and stored in multiple cloud locations. Users with individual accounts and organization accounts that permit it may store their private key on a device of their choosing, such as the disk of their laptop or desktop PC, a smartphone, or a hardware security module (HSM). For both device- and cloud-stored private keys, the corresponding public key is stored in Confidencial’s Public Key Registry.
Since device-stored keys are not stored in the cloud, users are prompted to load device-stored keys whenever they are required to decrypt a given message or file.
It is strongly recommended to NOT store device-stored keys on a device that also contains Confidencial-protected messages and files. If keys and the data protected with those keys are stored on the same device, an attacker who gains access to that device would theoretically be able to view your protected data. Instead, it is recommended that device-stored keys be stored on a device, such as an HSM, that is dedicated to storing cryptographic keys.