HSM track records?

Question

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?

Answer 1

I don't know, but there are many scientific papers on the subject. I'll list below some on API attacks (there are also tons of papers on tampering, side-channel attacks, etc., but I won't try to list them):

• Ross Anderson, et al. Cryptographic processors -- a survey. 2005.

  Summary: A survey of attacks on cryptographic processors, including HSMs. Include tampering, side-channel attacks, and API-level attacks.

• Mike Bond. Attacks on Cryptoprocessor Transaction Sets. CHES 2001.

  Summary: Describes API attacks against the Visa Security Module and the IBM 4758.

• Mike Bond, Ross Anderson. API-level attacks on embedded systems. IEEE Computer Magazine, 2001.

  Summary: Describes API attacks against the Visa Security Module and the IBM 4758.

• Paul Youn, et al. Robbing the bank with a theorem prover. 2005.

  Summary: Describes API attacks on the security APIs used by the IBM 4758.

• Ben Adida et al. On the security of the EMV secure messaging API. 2007.

  Summary: API-level attacks on IBM HSMs and Thales eSecurity's RG7000 HSM.

There are probably many more (especially more recent ones), but these ones jumped to mind at the moment.

Answer 2

There was an interesting paper at CCS 2010: Attacking and Fixing PKCS#11 Security Tokens

Basically, they modeled PKCS#11 API calls and checked if, by any combination of calls, you can extract data that should have been protected. They focus on smartcards, but I suppose it would be similarly relevant for server hardware:

http://secgroup.ext.dsi.unive.it/projects/security-apis/pkcs11-security/tookan/