The hsm tag has no wiki summary.
18
votes
2answers
326 views
Criteria for Selecting an HSM
A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course.
As an alternative to developing a ...
4
votes
4answers
224 views
Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?
It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
11
votes
1answer
226 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
1
vote
1answer
175 views
How does paypal store credit card numbers?
This is just a question for my curiosity, but I was wondering how Paypal stores the credit card numbers?
Did they release any informations about it?
As for now I would say that they encrypt the card ...
3
votes
1answer
116 views
Standards for secure key backup of master keys with secret sharing
In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
3
votes
2answers
193 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
1answer
90 views
FIPS 140-1 and FIPS 140-2
I tried googling for this info but it's not easily available because FIPS 140-1 is now really old.
Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
5
votes
2answers
156 views
Can a HSM be used to make password hashing stronger?
Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
1
vote
0answers
123 views
Any suggestion for a good readerless smart card (security token) solution? [closed]
I'm developing a small CRM application that will have to store some sensitive data and I would like to (optionally) supply my users with the possibility to use a readerless smart card (aka "security ...
2
votes
2answers
1k views
Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?
I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes.
At ...
3
votes
2answers
444 views
Efficient and simple way of securing home pc with hardware token
I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
9
votes
5answers
1k views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
11
votes
2answers
322 views
HSM track records?
What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
