an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

learn more… | top users | synonyms

3
votes
1answer
140 views

HSM maintenance

I have a HSM that is an asset within a information security management system and the help desk team tells me that the device is displaying a critical failure alert. So my questions are: Must I ...
6
votes
2answers
244 views

What are the differences between TPM and HSM?

TPM (Trusted Platform Module) and HSM (Hardware Security Module) are considered as cryptoprocessor, but what are the differences exactly? Does one of them have more advantages than another?
2
votes
1answer
60 views

What does “PIN encrypted under LMK” mean?

What does PIN encrypted under LMK mean? From what I understand the Local Master Key is only there to encrypt other keys. I was reading some code and I saw function names like encryptClearToLmk or ...
1
vote
0answers
48 views

Through signing process with HSM Luna, What device perform the signing?

I'v succesfully configure and test character String signin usign Java and HSM Luna SA through PKCS11. My question is, In wich processor cryptographic operations are perform? In wich way HSM Luna ...
0
votes
1answer
44 views

Using a custom authentication mechanism with SSH

I have a hardware device that can compute ECDSA signatures and generate ECDSA keys without exporting the private key (only public key is exported). I'm looking for a way to tie this into SSH. Is ...
0
votes
1answer
55 views

PKCS11 PIN security

Hardware security modules are tamper-resistant and PKCS11 PIN is required to use keys. if a software application wants to perform some cryptographic functions, it should know the PIN. but the ...
1
vote
1answer
162 views

Server-based PDF Signing using HSM

I have some question about server side pdf signing using network-attached hardware security module. my first question is: what is PDF Signing Certificate? Certificates are public keys, how a ...
0
votes
1answer
92 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
1
vote
1answer
50 views

How do chips with write only functionality that store keys work?

I know there are HSMs that let you enter keys but you cannot read them out. Also the secure element in Android lets you do that too. You can enter keys in them and you can perform operations using ...
0
votes
1answer
237 views

NSS / OpenSSL tradeoff on an embedded linux application which uses a TPM via pkcs11?

I am on a trade-off between the use of OpenSSL or NSS in an embedded Linux application that makes use of a TPM (HSM). EDIT: I need a SSH server and Apache using TLS, both using the keys protected by ...
2
votes
3answers
198 views

Best practices for HSM's used by test and production systems

Should a test/demo/non-prod system be prohibited from using the same HSM as production? Since the same master key would be used for both test and prod it seems like it could raise eyebrows but I can't ...
0
votes
1answer
99 views

Luna HSM key cache

I'm working with a Luna SA HSM through PKCS11 and i have the following scenario: I have created a master key pair for key wrapping and i want to bring a key wrapped with the master public key into the ...
1
vote
3answers
230 views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
0
votes
2answers
1k views

How to secure communication between server application and client mobile application through HSM

We are planning to deploy HSM with our application. The solution we are thinking is : Mobile applications talks to server application, Server application talks to HSM for authentications, ...
1
vote
0answers
330 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
8
votes
1answer
624 views

What is the difference between HSM and Key server?

As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key). If I'm storing encrypted DEK (Data Encryption Key) in an App ...
0
votes
1answer
343 views

What is the diffference between HSM and PTS-approved point-of-interaction device?

According to PCI-DSS requirement 3.5.2: We should store secret keys in a cryptographic device. Cryptographic devices: 1.HSM 2.PTS-approved point of interaction device My questions: I have some ...
1
vote
1answer
382 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
1
vote
1answer
106 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
2
votes
1answer
972 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
1
vote
0answers
659 views

Decrypt “key” that is encrypted with LMK or TMK

New to HSM (Thales payshield 9000), I'm working on DUKPT algorithm. I manage to derive the IPEK(encrypted either under LMK or TMK), but I need to inject a plain text IPEK into an end point device. I ...
2
votes
0answers
123 views

What is the purpose of “Variant” LMKs?

What is the purpose of "Variant" LMKs? The JPOS project (http://jpos.org/wiki/HSM_basics) gives this description: To make things more secure HSM's use variants. A variant is a hex value for ...
2
votes
0answers
273 views

Thales HSM LMK keypairs: 00-01, 02-03, 08-09, 10-11, 12-13

In the Thales HSM documentation, 40 LMK keypairs are listed but the following keypairs are not shown in the keytype table: 00-01 02-03 08-09 10-11 12-13 Am I correct in thinking that the ...
30
votes
2answers
5k views

Criteria for Selecting an HSM

A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course. As an alternative to developing a ...
11
votes
1answer
468 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...
1
vote
1answer
774 views

How does paypal store credit card numbers?

How does Paypal store credit card numbers? Have they published any information this? As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a ...
3
votes
1answer
604 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
3
votes
1answer
488 views

FIPS 140-1 and FIPS 140-2

I tried googling for this info but it's not easily available because FIPS 140-1 is now really old. Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
5
votes
5answers
1k views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
5
votes
2answers
436 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
3
votes
2answers
468 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
1
vote
0answers
317 views

Any suggestion for a good readerless smart card (security token) solution? [closed]

I'm developing a small CRM application that will have to store some sensitive data and I would like to (optionally) supply my users with the possibility to use a readerless smart card (aka "security ...
3
votes
2answers
849 views

Efficient and simple way of securing home pc with hardware token

I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
2
votes
2answers
3k views

Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?

I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes. At ...
12
votes
5answers
4k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
12
votes
2answers
690 views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?