10

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode.

I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline Root CA if possible.

Given that I've never used a HSM before, and am lacking in concepts on how it's typically used, my efforts to find a "cheaper shortcut" to the same end may result in more pain than it's worth.

Can someone enlighten me on this HSM mode and what general steps are required to make this compatible with a CA, be it Microsoft CA, or any other one that can be acquired.

| improve this question | |
  • AFAIK YubiKey does not have "HSM mode". YubiHSM is a separate product altogether. – Jonathon Reinhart Jan 24 '17 at 19:55
  • true that buit yubi can act as a smartcard which is pretty much a very simple HSM, becuase it has pretty similar properties, especially concerning secure key storage – My1 Oct 28 '17 at 13:36
9

Technically no, although it depends on what you mean by "secure".

Usually, when using a HSM for a CA, we mean: the CA private key (usually RSA) is generated, stored and used within the HSM, and the HSM will commit honourable suicide rather than letting that key ever exit its entrails. Up to the tamper-resistance of the HSM and how bug-free its firmware is, this ensures that even if the host machine is fully hijacked by an attacker and/or the attacker has physical access to the CA machine, then the attacker will not obtain a copy of the private key. At best he will be able to use the HSM to generate arbitrary signatures, but if the HSM is physically recovered then the attacker can know longer use the private key.

YubiHSM does not do RSA or DSA or any other algorithm relevant to asymmetric cryptography. YubiHSM is symmetric only (AES...). Thus, if you used it for a CA private key, then it would have to be along these lines: the RSA private key would be stored encrypted, and the symmetric key stored in the YubiHSM. However, when the private key would have to be used, it would first be loaded and decrypted in the RAM of the host machine, and that machine would then use its CPU to generate the signature.

I am not aware of any existing driver (Windows CSP, PKCS#11 driver...) which would make the necessary glue, but, in any case, it would void much of the interest of using a "HSM" since it, by nature, allows the private key to live outside of the tamper-resistant hardware.

YubiHSM is meant to support things like one-time passwords, not X.509 certificate authorities. A cheap alternative to a full HSM would rather be a smart card: that kind of hardware includes cryptographic accelerators which allow for efficient generation, storage and usage of asymmetric key pairs.

| improve this answer | |
  • 3
    Maybe I'm missing something, but in the question it says "YubiKey", not YubiHSM (which is a different hardware module from the same company). The Yubikey supports RSA keys and Yubico has a guide for setting up a CA with an RSA private key and matching X509 certificate stored on the Yubikey: developers.yubico.com/PIV/Guides/Certificate_authority.html – sdfqwerqaz1 Dec 2 '16 at 14:50
  • This answer is a little out of date, since according to the advertising, YubiHSM now supports RSA, ECC, ECDSA (ed25519), SHA-2, and AES and has a stated purpose of securing Active Directory certificate services. – Spencer Oct 31 '18 at 18:42
2

as some comments say, the yubikey can work as a smartcard and depending on how secure its tamper-proofness is, you sure might be able to use it as an albeit small CA.

small for the simple reason that the yubi is "just" a smartcard and not a "full-fledged" HSM meaning it probably has a pretty slow (key word: in comparison).

when you check other HSM systems they are normally either like PCI cards or essentially look like a bladeserver or something on that lines, in other words, they are huge compared to a yubikey and if yubico's words are true, other HSMs pull like 300 Watts or so, while the Yubi runs on USB and it CANNOT (by the USB Spec) pull more than 2,5W (0,5A*5V) although it's probably pulling even less than that.

one thing you should note though is that if you have a Yubikey 4 you should check your Firmware version before generating any RSA keys on it. https://www.yubico.com/keycheck/

also remember that you cannot read the key from the yubi meaning that if it breaks or you lock it by entering pin or puk 2often, your private key ist LOST FOREVER.

depending on the scenario, I would make use a completely offline computer to generate the key, back it up somewhere safe (offline, of course, for example on paper, but encrypt it first) then put it on the yubi to actually use it. dont forget to wipe the PC, or even better make it so that there is nothing that needs to be wiped (remove any harddisks and other storage media and work only on RAM with a live CD.)

| improve this answer | |
1

I'm not sure exactly what you want to protect if the root CA delegated signing and if it's offline. And I don't think this YubiHSM can protect x.509 out of e box, however, you might want to talk to your architect about your concerns with your CA infrastructure and read some limitations and features in the manual.

manual on Yubikey HSM http://static.yubico.com/var/uploads/pdfs/YubiHSM%20Manual_1_0_4.pdf

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.