I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000.
Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second, without it ever being in the clear, or decryptable.
Is it possible to do this by:
- Create a new RSA pair on HSM B (destination)
- Export the public key and transfer, and load on HSM A (source)
- Encrypt the BDK at the source, using that public key, and export
- Transfer that encrypted version to HSM B, and load
- Decrypt using private key, and load as BDK
Or have I misunderstood the capabilities?
Is there a better, standard, way of doing this?