I've been building a product using AWS CloudHSM and things are working well in the POC.

Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to have it sign messages with private keys it holds.

The problem this manifests is there seems to always be a need to keep a private key in software.

For e.g. my signing manager I have to keep the private key in a software based keystore!

Does this not erode the value of using a HSM in the first place? What is best practice?

  • 2
    Best practice is to distribute short-lived and narrow-scoped credentials for aws identities. It should be obvious that this is better than handing out long-lived encryption and/or signing keys. You can also generate separate credentials for encryption and decryption, for instance, which isn't possible with directly usable keys. You're not getting around having some kind of credentials somewhere, but you can control how powerful (and thus risky) the credentials are. – Peter May 13 '19 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.