Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?

share|improve this question
1  
Anecdotal, and kinda historical so probably no longer relevant, but around 10 years ago the company I was working at was using a certain serial port / USB plug HSM, and had our software talk to it via a simple API. I hacked up a DLL that exports the same API, and thus "bypassed" the HSM - didnt crack it or steal keys, but I effectively diverted any calls, enabling my dll to prevent or control future encryption. Point is, often it wont be the HSM itself that breaks, but the API or the communications to it. –  AviD Jun 28 '11 at 10:06

2 Answers 2

up vote 8 down vote accepted

I don't know, but there are many scientific papers on the subject. I'll list below some on API attacks (there are also tons of papers on tampering, side-channel attacks, etc., but I won't try to list them):

There are probably many more (especially more recent ones), but these ones jumped to mind at the moment.

share|improve this answer

There was an interesting paper at CCS 2010: Attacking and Fixing PKCS#11 Security Tokens

Basically, they modeled PKCS#11 API calls and checked if, by any combination of calls, you can extract data that should have been protected. They focus on smartcards, but I suppose it would be similarly relevant for server hardware:

http://secgroup.ext.dsi.unive.it/projects/security-apis/pkcs11-security/tookan/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.