an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

learn more… | top users | synonyms

27
votes
2answers
3k views

Criteria for Selecting an HSM

A very sensitive application has to protect several different forms of data, such as passwords, credit cards, and secret documents - and encryption keys, of course. As an alternative to developing a ...
12
votes
5answers
3k views

Use RSA keypair for PGP encryption and decryption

Is there a way that I can use a RSA keypair with PGP? What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
12
votes
2answers
580 views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
11
votes
1answer
411 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...
8
votes
1answer
320 views

What is the difference between HSM and Key server?

As per PCI-DSS requirements, we have to use either HSM (Hardware Security Module), or Key Server to store the KEK (Key Encryption Key). If I'm storing encrypted DEK (Data Encryption Key) in an App ...
5
votes
5answers
853 views

Are there any hardware HSMs that can host/run custom applications using the HSM processor(s) within the hardened security boundary?

It seems that the majority of commercially available hardware HSMs are only designed to allow authenticated users to generate, store, and use cryptographic keys with various cryptographic algorithms ...
5
votes
2answers
362 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
3
votes
2answers
403 views

A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?

We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
3
votes
1answer
356 views

FIPS 140-1 and FIPS 140-2

I tried googling for this info but it's not easily available because FIPS 140-1 is now really old. Does FIPS 140-2 automatically cover FIPS 140-1 - i.e. if a device (in my case an HSM - Hardware ...
3
votes
1answer
504 views

Standards for secure key backup of master keys with secret sharing

In many cases, there is a single master key that is installed in a HSM or similar device, but which should be backed up. The recommended method for this backup in many cases is to encrypt the master ...
3
votes
2answers
769 views

Efficient and simple way of securing home pc with hardware token

I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
2
votes
2answers
2k views

Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?

I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes. At ...
2
votes
3answers
94 views

Best practices for HSM's used by test and production systems

Should a test/demo/non-prod system be prohibited from using the same HSM as production? Since the same master key would be used for both test and prod it seems like it could raise eyebrows but I can't ...
2
votes
0answers
109 views

What is the purpose of “Variant” LMKs?

What is the purpose of "Variant" LMKs? The JPOS project (http://jpos.org/wiki/HSM_basics) gives this description: To make things more secure HSM's use variants. A variant is a hex value for ...
2
votes
0answers
212 views

Thales HSM LMK keypairs: 00-01, 02-03, 08-09, 10-11, 12-13

In the Thales HSM documentation, 40 LMK keypairs are listed but the following keypairs are not shown in the keytype table: 00-01 02-03 08-09 10-11 12-13 Am I correct in thinking that the ...
1
vote
1answer
40 views

How do chips with write only functionality that store keys work?

I know there are HSMs that let you enter keys but you cannot read them out. Also the secure element in Android lets you do that too. You can enter keys in them and you can perform operations using ...
1
vote
3answers
126 views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
1
vote
1answer
545 views

How to process or manage Key-Encryption-Key using HSM?

Let's consider two Encryption keys: 1.Data-Encryption-Key(DEK) 2.Key-Encryption-Key(KEK) KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be ...
1
vote
1answer
641 views

How does paypal store credit card numbers?

How does Paypal store credit card numbers? Have they published any information this? As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a ...
1
vote
1answer
927 views

How to secure communication between server application and client mobile application through HSM

We are planning to deploy HSM with our application. The solution we are thinking is : Mobile applications talks to server application, Server application talks to HSM for authentications, ...
1
vote
0answers
250 views

Import securely RSA private key through PKCS#11

I have a cryptographic device that supports the following mechanisms: How I could securely import RSA private key into it? Because there is no support for wrap/unwrap using symmetric key is there ...
1
vote
1answer
257 views

valid PDF signature without using hardware HSM or usb Token

I have a DMS system(alfresco) that needs to sign approx 50.000 valid signatures a year. The signing certificate needs to be acquired from one of the affiliated sub-CA's. So according to the Adobe CDS ...
1
vote
1answer
89 views

Root certifcate from an CA company which can be encrpyted by SoftHSM

Does anybody know a CA company which allows me to put the bought CA certficate inside SoftHSM (the same as an HSM but without any hardware, it is pure software)? Is it hard to work with the PKCS11 ...
1
vote
0answers
513 views

Decrypt “key” that is encrypted with LMK or TMK

New to HSM (Thales payshield 9000), I'm working on DUKPT algorithm. I manage to derive the IPEK(encrypted either under LMK or TMK), but I need to inject a plain text IPEK into an end point device. I ...
1
vote
0answers
281 views

Any suggestion for a good readerless smart card (security token) solution? [closed]

I'm developing a small CRM application that will have to store some sensitive data and I would like to (optionally) supply my users with the possibility to use a readerless smart card (aka "security ...
0
votes
1answer
167 views

What is the diffference between HSM and PTS-approved point-of-interaction device?

According to PCI-DSS requirement 3.5.2: We should store secret keys in a cryptographic device. Cryptographic devices: 1.HSM 2.PTS-approved point of interaction device My questions: I have some ...
0
votes
1answer
42 views

How are Cloud based HSMs used for Encryption by an application that is on premise (behind the enterprise firewall)?

Amazon CloudHSM (It is Safenet in the backend), Safenet Luna HSM SaaS version and other cloud HSM providers provide Key Management and encryption services on device in the cloud. From my research, I ...
0
votes
1answer
80 views

NSS / OpenSSL tradeoff on an embedded linux application which uses a TPM via pkcs11?

I am on a trade-off between the use of OpenSSL or NSS in an embedded Linux application that makes use of a TPM (HSM). EDIT: I need a SSH server and Apache using TLS, both using the keys protected by ...
0
votes
1answer
41 views

Luna HSM key cache

I'm working with a Luna SA HSM through PKCS11 and i have the following scenario: I have created a master key pair for key wrapping and i want to bring a key wrapped with the master public key into the ...
-1
votes
0answers
61 views

Do modern military crypto devices use thermite self destructs, and why would they need them? [duplicate]

I have came across several references to military cryptographic devices activating thermite charges to destroy themselves in response to a tamper attempt [1,2,3,4]. However, the only specific example ...
-1
votes
0answers
11 views

KSN in DUPKT algorithm

I am testing DUKPT pin translation block and i have the BDK in place.. i need to know how can i generate my first KSN and then further increments.. Simply i need to know how to make up the KSN to ...