I am interested in the general security goals for public key cryptography and the different elements of it.
Outline of the use-case:
My use case is an embedded device, which will use TLS to establish secure communication between a server and a client (the embedded device). Furthermore, TLS is used with a mutual-authentication handshake, which requires also a client certificate. The embedded device contains a hardware security module (HSM) for efficient crypto-operations and safe storage.
The following elements will be present in the embedded device to enable the TLS communication:
- TLS root certificate from CA (including its public key) to authenticate the server
- Client leaf certificate (including its public key)
- Private key of the client leaf certificate
We can assume that the storage space of the HSM is large enough to hold all elements 1, 2 and 3 at the same time.
My question now is, what elements should be stored inside the HSM?
- Root certificate:
No need for confidentiality, as this information is publicly available, as the root certificate will be installed in any device that wants to participate in the PKI.
But what about integrity? I guess there a security problem if such a root certificate is tampered with (or exchanged) to later allow to authenticate initially not trustworthy leaf certificates from a visited malicious website. Do I have a benefit to store the root certificate inside the HSM, or is it simply enough to not provide any Interface in software to change the certificate stored in the normal memory of the device?
- Client certificate:
Also here we do not have the need for confidentiality in my opinion, because the certificate is sent unencrypted to the server during the mutual-authentication TLS handshake. Should we put the whole certificate into the HSM together with its private key? Is there an attack scenario, which could be mitigated if the certificate itself was stored inside the HSM?
- Private key of Client certificate:
This one I am 100% sure about. The private key needs to go into the HSM to increase the security.
Rephrasing everything in one sentence:
Private keys should be stored inside an HSM, if available, but is there any benefit of storing also certificates (containing their public keys) inside an HSM?
In my understanding the HSM in this use-case only provides a security benefit for storing private keys. However, I have read in many instances about storing certificates inside an HSM. I am just not sure, if such statements are because of sloppy wording or if there is actually any benefit of storing a certificate inside an HSM. Examples: A, B, C