Chapter 9
Keeping encryption keys and hardware USB drives offline
9.1 Learning objectives
- Understand the encryption paradox: the safer it is, the easier it is to lose everything if you lose the key.
- Build a key register: which key, where it is kept, who can open it, when it is replaced.
- Correctly use a hardware-encrypted USB drive with a PIN keypad as an offline "safe".
9.2 Concepts
The encryption paradox
Encrypting the NAS volume, backups and USB drives protects against thieves. But if you lose both the password and the recovery key file, you cannot open it either. With strong encryption there is no "forgot password" and no support desk that can save you.
Common keys in a personal system
| Key | What it opens | If lost |
|---|---|---|
| NAS key vault password | Manually unlocks the volume, moves drives to a new device | The recovery key file is needed instead |
| Volume recovery key file | Opens the volume when the key vault is unusable | If both are lost: the volume's data is lost |
| Backup encryption password/key | Opens the backups | The backups become garbage |
| Encrypted USB PIN | Opens the USB | Too many wrong attempts: the USB wipes itself |
| SSH private key | Logs in to servers, NAS | Log in another way, create a new key |
Key-keeping principles
- Two places, two kinds: one copy in the password manager (CORE), one offline (hardware-encrypted USB or paper).
- Never keep a key on the thing it opens. The volume recovery key file is not stored on that volume.
- Separate entries: keep encryption keys and login credentials (admin account, vendor account) in two separate entries.
- Clean up traces: key files downloaded by the browser sit in the Downloads folder; once stored in both places and hashes compared, delete them from Downloads and the trash.
- Drill: try a manual unlock at least once while you have a backup.
- Replace a key, replace every copy: creating a new key means updating both the password manager and the USB; mark old copies as "superseded".
Hardware-encrypted USB with keypad
- Encryption is done by a chip inside the USB and unlocked with a PIN typed on the USB itself, so keyloggers on the computer cannot capture it.
- It has brute-force protection: after too many consecutive wrong attempts (often configurable) the USB erases its key, and the data is lost permanently.
- It has an internal battery: charge it periodically per the manufacturer's instructions (usually every few months).
- Because it can wipe itself, the USB is never the only copy of anything.
Suggested folder structure for the "safe" USB
| Folder | Contents |
|---|---|
| 00. READ FIRST.txt | What this USB is, the recovery order ROOT → CORE → BRANCH; contains no secrets |
| 01. Infrastructure – NAS & Servers | Volume recovery key files, notes on manual unlocking |
| 02. Password manager | Emergency kit, recovery instructions |
| 03. Email & Identity | Email recovery codes, recovery map |
| 04. Development & Domains | Domain inventory, backup SSH keys |
| 05. Security handbook | Personal handbook, an electronic copy of this course |
| 99. Old archive – pending cleanup | Superseded copies; delete only after checking the new copy |
9.3 Worked example
Mr. A encrypts his NAS volume. The system downloads a recovery key file to the laptop's Downloads folder. Mr. A:
- Creates an entry in the password manager named "NAS – Encryption key vault (Volume 1)", saves the key vault password and attaches the recovery key file.
- Copies the key file to the encrypted USB, folder "01. Infrastructure – NAS & Servers".
- Computes SHA-256 of the file on the USB and of the attachment; they match.
- Deletes the file from Downloads and the trash.
- Creates a separate entry for the NAS admin account, not merged with the key entry.
- Records in the key register: key name, what it opens, where (2 places), creation date, last drill.
Mr. A's sample key register (no secret values):
| Key | What it opens | Place 1 | Place 2 | Created | Last drill |
|---|---|---|---|---|---|
| NAS key vault password | Volume 1 | Password manager | USB folder 01 | ***/2026 | Not yet |
| Volume 1 recovery key file | Volume 1 | Password manager | USB folder 01 | ***/2026 | Not yet |
| Backup encryption key | SSD and offsite backups | Password manager | USB folder 01 | When the job was created | At test restore |
| USB PIN | USB | In my head | Sealed envelope *** | ***/2026 | At every charge |
9.4 Common mistakes
- Leaving the recovery key file on the NAS itself, or only in the Downloads folder.
- Merging encryption keys with login passwords in one entry.
- Enabling backup encryption but forgetting to save the backup key.
- Sticking the PIN onto the USB, or storing the PIN in the same place as the USB.
- Repeatedly guessing a forgotten PIN, triggering the self-wipe.
- Leaving the USB uncharged for many months.
9.5 Checklist
9.6 Exercises
- Build a key register for your system (locations only, no values).
- Search your Downloads folder for leftover key files, recovery codes and emergency kits.
- Write the contents of the 00. READ FIRST.txt file for your USB, enough for a family member to understand the recovery order.
9.7 Summary
- Strong encryption is unforgiving: lose the key, lose the data.
- Two places, two kinds, never on the thing it opens.
- A hardware USB is a good safe but can wipe itself: never the only copy.