Key import with hybrid cryptography

1. A computer-implemented method comprising:

receiving, by a key management service (KMS) system, a request to import key material from a user system;

sending, by the KMS system and in response to the request, two public keys to the user system, the two public keys including a classical cryptography (CC) public key and a quantum-safe cryptography (QSC) public key, wherein at least one public key of the two public keys is retrieved from a hardware security module (HSM);

receiving, by the KMS system, hybrid-encrypted key material from the user system, wherein the hybrid-encrypted key material is key material that has been encrypted using the two public keys; and

sending, by the KMS system, the key material, at least partially encrypted by the at least one public key, to the HSM.

2. The method of claim 1 , further comprising:

generating a QSC key pair including the QSC public key and a QSC private key; and

retrieving the CC public key from the HSM.

3. The method of claim 2 , wherein the hybrid-encrypted key material includes a first part encrypted using the QSC public key and a second part encrypted using the CC public key, the method further comprising:

decrypting the first part using the QSC private key, wherein the key material sent to the HSM is the decrypted first part and the encrypted second part.

4. The method of claim 2 , further comprising:

decrypting all of the hybrid-encrypted key material using the QSC private key to produce key material encrypted by the CC public key, wherein the key material sent to the HSM is the key material encrypted by the CC public key.

5. The method of claim 1 , wherein the QSC public key is used to establish a symmetric key, and wherein the hybrid-encrypted key material is encrypted by the symmetric key and the CC public key.

6. The method of claim 1 , further comprising:

retrieving the QSC public key and the CC public key from the HSM, wherein the sending the key material to the HSM includes sending the hybrid-encrypted key material to the HSM for decryption.

7. The method of claim 1 , wherein the at least one public key is the CC public key and the QSC public key, the method further comprising:

generating, by the HSM, a CC key pair and a QSC key pair, the CC key pair including the CC public key and a corresponding CC private key, the QSC key pair including the QSC public key and a corresponding QSC private key; and

decrypting, by the HSM, the hybrid-encrypted key material using the CC private key and the QSC private key to produce the key material.

8. A system comprising:

a hardware security module (HSM); and

a key import module configured to:

receive a request to import key material from a user system;

send, in response to the request, two public keys to the user system, the two public keys including a classical cryptography (CC) public key and a quantum-safe cryptography (QSC) public key, wherein at least one public key of the two public keys is retrieved from the HSM;

receive hybrid-encrypted key material from the user system, wherein the hybrid-encrypted key material is key material that has been encrypted using the two public keys; and

send the key material, at least partially encrypted by the at least one public key, to the HSM.

9. The system of claim 8 , wherein:

the key import module is configured to:

generate a QSC key pair including the QSC public key and a QSC private key,

retrieve the CC public key from the HSM,

at least partially decrypt the hybrid-encrypted key material using the QSC private key to produce key material that is at least partially encrypted by the CC public key, and the HSM is configured to:

generate a CC key pair including the CC public key and a CC private key, and

decrypt the key material that is at least partially encrypted by the CC public key with the CC private key to produce the key material.

10. The system of claim 9 , wherein:

the key import module is configured to decrypt a first part of the hybrid-encrypted key material to produce a first part of the key material, and

the HSM is configured to:

decrypt a second part of the hybrid-encrypted key material to produce a second part of the key material, and

concatenate the first part of the key material and the second part of the key material to produce the key material.

11. The system of claim 9 , wherein:

the key import module is configured to decrypt all of the hybrid-encrypted key material to produce key material encrypted by the CC public key, and

the HSM is configured to decrypt the key material encrypted by the CC public key using the CC private key to produce the key material.

12. The system of claim 8 , wherein the QSC public key is used to establish a symmetric key, and wherein the hybrid-encrypted key material is encrypted by the symmetric key and the CC public key.

13. The system of claim 8 , wherein:

the key import module is configured to send the hybrid-encrypted key material to the HSM, and

the HSM is configured to:

generate a CC key pair and a QSC key pair, the CC key pair including the CC public key and a corresponding CC private key, the QSC key pair including the QSC public key and a corresponding QSC private key; and

decrypt the hybrid-encrypted key material using the CC private key and the QSC private key to produce the key material.

14. A computer program product comprising one or more computer readable storage media having program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

receiving, by a key management service (KMS) system, a request to import key material from a user system;

sending, by the KMS system and in response to the request, two public keys to the user system, the two public keys including a classical cryptography (CC) public key and a quantum-safe cryptography (QSC) public key, wherein at least one public key of the two public keys is retrieved from a hardware security module (HSM);

receiving, by the KMS system, hybrid-encrypted key material from the user system, wherein the hybrid-encrypted key material is key material that has been encrypted using the two public keys; and

sending, by the KMS system, the key material, at least partially encrypted by the at least one public key, to the HSM.

15. The computer program product of claim 14 , wherein the operations further comprise:

generating a QSC key pair including the QSC public key and a QSC private key; and

retrieving the CC public key from the HSM.

16. The computer program product of claim 15 , wherein the hybrid-encrypted key material includes a first part encrypted using the QSC public key and a second part encrypted using the CC public key, and wherein the operations further comprise:

decrypting the first part using the QSC private key, wherein the key material sent to the HSM is the decrypted first part and the encrypted second part.

17. The computer program product of claim 15 , wherein the operations further comprise:

decrypting all of the hybrid-encrypted key material using the QSC private key to produce key material encrypted by the CC public key, wherein the key material sent to the HSM is the key material encrypted by the CC public key.

18. The computer program product of claim 14 , wherein the QSC public key is used to establish a symmetric key, and wherein the hybrid-encrypted key material is encrypted by the symmetric key and the CC public key.

19. The computer program product of claim 14 , wherein the operations further comprise:

retrieving the QSC public key and the CC public key from the HSM, wherein the sending the key material to the HSM includes sending the hybrid-encrypted key material to the HSM for decryption.