When ephemeral Diffie-Hellman (DHE) is used with TLS, the key-exchange key can/will be discarded after a key-exchange. right?
Is there good reason to use HSM for generating and storing DHE key, when the block cipher key is still stored in RAM?
1
-
There is not much to be gained from storing the short-lived ephemeral ECDHE private keys used in a TLS session, in a HSM. However, there is much to be gained by storing the long-lived private key, which corresponds with the public key in the host's certificate, in a HSM.– mti2935Mar 28 at 14:51
Add a comment
|
2 Answers
Is there good reason to use HSM for generating and storing DHE key, when the block cipher key is still stored in RAM?
Not from the context of decryption of the active session.
Forward secrecy is dependent on the ephemeral private remaining a secret. It being in an HSM provides good controls over it's exposure. Without it, an attacker can read whatever messages are encrypted with the symmetric they got access to but none of the keys/messages before or after (assuming they lose access to symmetric keys).
So technically there is some value but it may balance the scales compared to the cost of the HSM.
TLS provides forward secrecy:
Forward secrecy typically uses an ephemeral Diffie-Hellman key exchange to prevent reading past traffic.
If you keep the keys after the TLS session completed, you will increase the chance that these keys will be retrieved by the attacker.
