Questions tagged [hsm]

an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

Filter by
Sorted by
Tagged with
0 votes
1 answer
100 views

How do RSA smartcards prevent key exfiltration?

Extracting private keys directly from the card is nearly impossible. With some acid package destruction and electron microscope work, a skilled team, and enough time, money, and luck you can in theory ...
1 vote
1 answer
36 views

Risk scenarios when hosting KEK in Google Cloud KMS HSM backended [closed]

For some time now, we have been assessing the risks from a GDPR perspective when data (data-at-rest) in the Google Cloud is fully encrypted using native means. This means that we create both the KEK ...
  • 9
3 votes
1 answer
46 views

Is it (under FIPS) possible to generate a CSR for an asymmetric key with usage=WRAP?

To clarify: The FIPS module Security Policy lists using RSA keys for wrap/unwrap. FIPS is a moving target, and the state of the requirements when the CMVP approved module went through the process ...
  • 251
0 votes
0 answers
50 views

How to viably use HSM on public cloud providers (AWS or GCP)

I don't have any experience with HSMs. My goal is to secure critical seed phrases used to generate crypto wallets I found a good approach is to use HSMs to store encryption keys and encrypt the seed ...
3 votes
1 answer
128 views

What is the right way to transfer public-private keypairs over intranet?

First asked on StackOverflow and referred to this board, here: I have an embedded system (Netburner 5441x) that encodes public-private RSA keypairs into devices. I have ported OpenSSL into the system ...
0 votes
1 answer
103 views

How do centralized crypto exchanges store seed phrases and users' private keys?

Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security? From what I know, I can generate the users' keys from a ...
0 votes
0 answers
31 views

Import BDK encrypted under the Transport Key KEK on HSM

I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK. Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
0 votes
0 answers
63 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
0 votes
0 answers
321 views

How to calculate Millenage OPc value while OP stored in HSM?

ETSI TS 135 206 defines the specification of MILENAGE algorithm which is an authentication algorithm for mobile networks. It defines 'OPc' as below: a 128-bit value derived from OP and K and used ...
  • 185
0 votes
1 answer
89 views

Examples of custom key restriction policies for HSMs

Based on my understanding, some types of HSMs allow custom software to be developed that can run within the HSM's secure enclave. This capability allowed Square to do something very clever to boost ...
  • 77
2 votes
0 answers
67 views

What are the "Design Patterns" for working with HSMs?

I've been attempting to learn about the different features and uses of HSMs, and I keep thinking that someone must have put together a set of design patterns for different ways that HSMs can be used ...
  • 77
1 vote
2 answers
120 views

HSM High Volume Keys

Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
  • 111
1 vote
1 answer
165 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
0 votes
0 answers
140 views

Handling MTLS with HSM

Scenario: I need to implement MTLS between three of my services communicating with each other. Based on my understanding of MTLS, I need to import the certificate of target services in the trust store ...
1 vote
1 answer
134 views

Is "time locking" a good strategy for protecting data with HSMs?

I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
  • 77
1 vote
2 answers
137 views

Can some HSMs send requests to other servers before performing an encryption/decryption operation?

In various discussions of Security Architecture, I have read that HSMs can be configured with rate limiting on the number of encryptions/decryptions that can be performed in a given amount of time. If ...
  • 77
0 votes
1 answer
189 views

Using an HSM to protect encrypted data even when a server is compromised

Imagine a system architecture where an API server is able to send a request to an HSM, and the HSM is able to decrypt some data for a particular user/customer, in order to serve some hypothetical ...
  • 77
1 vote
0 answers
252 views

AWS KMS CMK compromise

Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
2 votes
3 answers
370 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
0 votes
1 answer
236 views

How does a cloud based application use a TPM to authenticate hardware devices?

I have heard about this, but not sure how it would work. I would imagine that when you register the device, the public RSA key burnt into the chip would be shared. That way, if the application sends a ...
2 votes
2 answers
300 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
1 vote
1 answer
525 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
1 vote
0 answers
135 views

Are there any options for Root CA eIDAS compliant HSMs? [closed]

Building the eIDAS compliant certification authority in hierarchy, meaning that the Root CA will issue Subordinate CAs. Root CA will be offline almost whole year and Subordinate CA is online providing ...
  • 1,099
3 votes
3 answers
1k views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
1 vote
1 answer
163 views

Use of SoftHSM2 in commercial products

I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
0 votes
0 answers
201 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
0 votes
1 answer
240 views

key escrow vs secure storage(software/TPM/HSM)

From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-...
2 votes
2 answers
763 views

pkcs11 with remote HSM

Seeking assistance on using PKCS11 with a remote HSM. I have a small linux host with an HSM card installed. The HSM has libraries and utility scripts provided to interact with it, on that host. ...
  • 21
3 votes
1 answer
418 views

Why does it take so much time to create a secret key on a HSM?

I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM. I've used pkcs11-tool to generate the key and it took ...
  • 93
0 votes
0 answers
83 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
0 votes
2 answers
110 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
1 vote
1 answer
379 views

Is this a good way to manage encryption keys?

I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything from a leave of absence form to potentially confidential agreements. Being ...
-1 votes
1 answer
395 views

List all keys in Utimaco HSM created by PKCS11 and CNG?

Is there a way to list all keys inside the Utimaco HSM, created by PKCS11 interface and cngtool? currently, I only can view each of them separately: PKCS11: using "PKCS#11 CryptoServer ...
  • 147
2 votes
0 answers
543 views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
0 votes
1 answer
445 views

Why is YubiHSM an HSM?

What makes the YubiHSM an HSM? Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
1 vote
1 answer
311 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
  • 1,604
1 vote
1 answer
1k views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
0 votes
0 answers
189 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
1 vote
1 answer
327 views

Is it possible to sync up LMKs in two Thales PayShield 9000 instances>

Basically, when we execute a generate key command such as A0 then we receive a key-under-lmk for future use. What if we have multiple HSMs in a high availability configuration? How would we make sure ...
  • 503
2 votes
1 answer
208 views

Does AWS KMS use HSM underneath by default?

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
1 vote
0 answers
126 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
2 votes
1 answer
268 views

Reason for lack of asymmetric cryptography in AWS KMS for regions in China

In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence: Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
  • 1,243
1 vote
2 answers
217 views

Purpose of Secure Element

What is the purpose of embedding a Secure Element to enhance the security - especially the storage of keys- if a key is required to connect with it in order to get its secrets? For example: Let's ...
1 vote
2 answers
1k views

RSA insensitive and extractable private key export from SoftHSM 2

I've created an RSA private key in SoftHSM 2 via EJBCA with the following config: attributes(*, CKO_PUBLIC_KEY, *) = { CKA_TOKEN = false CKA_ENCRYPT = true CKA_VERIFY = true CKA_WRAP = false }...
  • 93
1 vote
1 answer
4k views

Thales HSM: relationship between the various key types?

I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another: ...
  • 111
1 vote
0 answers
196 views

Is Yubikey HSM2 FIPS Compliant?

I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series. (https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search) ...
1 vote
2 answers
394 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
  • 139
1 vote
0 answers
107 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
  • 157
1 vote
0 answers
142 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
  • 1,099
1 vote
1 answer
626 views

Managing DUKPT keys in AWS cloud

I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
  • 11