Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [hsm]

an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

LKM key copy to new component [closed]

How we may copy the already loaded LMK from the HSM, because the 3 components previously copied are lost?
Defaru Afework's user avatar
0 votes
0 answers
39 views

what are the locations to store symmetric keys on the embedded controller without HSM or certs involvement?

I am trying to find the locations on the embedded devices with micros that don't support HSM/SHE. What are the ideas/suggestions for storing the symmetric keys? I found solutions that suggest using ...
user3814614's user avatar
0 votes
0 answers
78 views

What are the effective open-source methods for storing and managing encryption keys in a language-agnostic manner when an HSM is unavailable?

When HSMs are not accessible, we often need alternative methods for securely storing and managing encryption keys What open-source options exist for effectively managing encryption keys in a language-...
SSpirate's user avatar
0 votes
0 answers
60 views

What are the best practices for a scheduled program to store credentials to access a secure resource?

If I have a program that runs on a regular basis, such as a cron job or systemd timer and it needs to access a secure resource like a hsm or encrypted database, what are the best practices to store/...
user962460's user avatar
1 vote
0 answers
120 views

Deriving EC keypairs pairs via PKCS11?

I'm a bit confused with PKCS11 (v3) standard... In particular, it's blurry to me if one can invoke C_DeriveKey, passing, say, CKM_SHA512_KEY_DERIVATION (or some HKDF) to it as the mechanism and also ...
Nikita Kalinichenko's user avatar
0 votes
0 answers
154 views

HSM Thales PayShield vulnerabilities

My management requested to investigate about security of HSM Thales Payshield. Have you ever heard of any security bugs on the HSM Thales Payshield? I mean, except for the known bugs reported in their ...
MaXbeMan's user avatar
0 votes
1 answer
239 views

How to secure hundreds of AES keys

I need to store a large amount of AES keys and provide an API to decrypt user-provided ciphertext. The application flow is as follows: The user authenticates The user makes a POST request with some ...
Riccardo Salve's user avatar
1 vote
1 answer
511 views

CVV2 calculation with TR-31 Key

I need to use the CVK Key (in key block format) to calculate the CVV2. In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
MaXbeMan's user avatar
0 votes
1 answer
248 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
0 votes
0 answers
197 views

Management of CVK key in Key Block format

I use a Thales PayShield 10K with a LMK KeyBlock 3DES. I have to send a CVK Key to a Scheme for the valorization of CVV2 value. Now, in my envorinment i generated a CVK Key with "Key Usage"= ...
MaXbeMan's user avatar
1 vote
2 answers
152 views

Does saving of ECDHE keypairs to HSM increase security of TLS?

When ephemeral Diffie-Hellman (DHE) is used with TLS, the key-exchange key can/will be discarded after a key-exchange. right? Is there good reason to use HSM for generating and storing DHE key, when ...
SKi's user avatar
  • 303
1 vote
0 answers
255 views

Windows CSP for remote signing

I have a system (lets call it signer) that has private keys for doing Authenticode code signing. I have bunch of build systems that want to sign generated build artifacts. Obviously I can't use ...
videoguy's user avatar
  • 111
1 vote
1 answer
158 views

Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?

Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
ELLIOTTCABLE's user avatar
0 votes
1 answer
187 views

How do RSA smartcards prevent key exfiltration?

Extracting private keys directly from the card is nearly impossible. With some acid package destruction and electron microscope work, a skilled team, and enough time, money, and luck you can in theory ...
JamesTheAwesomeDude's user avatar
3 votes
1 answer
279 views

Is it (under FIPS) possible to generate a CSR for an asymmetric key with usage=WRAP?

To clarify: The FIPS module Security Policy lists using RSA keys for wrap/unwrap. FIPS is a moving target, and the state of the requirements when the CMVP approved module went through the process ...
rip...'s user avatar
  • 281
3 votes
1 answer
249 views

What is the right way to transfer public-private keypairs over intranet?

First asked on StackOverflow and referred to this board, here: I have an embedded system (Netburner 5441x) that encodes public-private RSA keypairs into devices. I have ported OpenSSL into the system ...
Larry Martin's user avatar
0 votes
1 answer
269 views

How do centralized crypto exchanges store seed phrases and users' private keys?

Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security? From what I know, I can generate the users' keys from a ...
whitebat 199's user avatar
0 votes
0 answers
196 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
JavaForAndroid's user avatar
1 vote
1 answer
234 views

Examples of custom key restriction policies for HSMs

Based on my understanding, some types of HSMs allow custom software to be developed that can run within the HSM's secure enclave. This capability allowed Square to do something very clever to boost ...
bnsmith's user avatar
  • 87
2 votes
0 answers
158 views

What are the "Design Patterns" for working with HSMs?

I've been attempting to learn about the different features and uses of HSMs, and I keep thinking that someone must have put together a set of design patterns for different ways that HSMs can be used ...
bnsmith's user avatar
  • 87
1 vote
2 answers
237 views

HSM High Volume Keys

Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
Norak's user avatar
  • 111
1 vote
1 answer
355 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
Jacob Bruinsma's user avatar
1 vote
1 answer
178 views

Is "time locking" a good strategy for protecting data with HSMs?

I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
bnsmith's user avatar
  • 87
1 vote
2 answers
235 views

Can some HSMs send requests to other servers before performing an encryption/decryption operation?

In various discussions of Security Architecture, I have read that HSMs can be configured with rate limiting on the number of encryptions/decryptions that can be performed in a given amount of time. If ...
bnsmith's user avatar
  • 87
0 votes
1 answer
374 views

Using an HSM to protect encrypted data even when a server is compromised

Imagine a system architecture where an API server is able to send a request to an HSM, and the HSM is able to decrypt some data for a particular user/customer, in order to serve some hypothetical ...
bnsmith's user avatar
  • 87
2 votes
3 answers
965 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
Engineer999's user avatar
0 votes
1 answer
417 views

How does a cloud based application use a TPM to authenticate hardware devices?

I have heard about this, but not sure how it would work. I would imagine that when you register the device, the public RSA key burnt into the chip would be shared. That way, if the application sends a ...
Beginner's user avatar
2 votes
2 answers
798 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
Akhilesh Gupta's user avatar
2 votes
1 answer
1k views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
Thurairaj Letchumanan's user avatar
1 vote
0 answers
232 views

Are there any options for Root CA eIDAS compliant HSMs? [closed]

Building the eIDAS compliant certification authority in hierarchy, meaning that the Root CA will issue Subordinate CAs. Root CA will be offline almost whole year and Subordinate CA is online providing ...
user1563721's user avatar
  • 1,119
7 votes
3 answers
5k views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
Michael Altfield's user avatar
1 vote
1 answer
294 views

Use of SoftHSM2 in commercial products

I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
Baranikumar Venkatesan's user avatar
1 vote
0 answers
398 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
Baranikumar Venkatesan's user avatar
0 votes
1 answer
433 views

key escrow vs secure storage(software/TPM/HSM)

From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-...
Baranikumar Venkatesan's user avatar
3 votes
2 answers
2k views

pkcs11 with remote HSM

Seeking assistance on using PKCS11 with a remote HSM. I have a small linux host with an HSM card installed. The HSM has libraries and utility scripts provided to interact with it, on that host. ...
r.l.'s user avatar
  • 41
3 votes
1 answer
653 views

Why does it take so much time to create a secret key on a HSM?

I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM. I've used pkcs11-tool to generate the key and it took ...
No name's user avatar
  • 223
0 votes
0 answers
150 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
matteof93's user avatar
0 votes
2 answers
148 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
moritz1895's user avatar
1 vote
1 answer
596 views

Is this a good way to manage encryption keys?

I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything from a leave of absence form to potentially confidential agreements. Being ...
Piotr Buda's user avatar
-1 votes
1 answer
789 views

List all keys in Utimaco HSM created by PKCS11 and CNG?

Is there a way to list all keys inside the Utimaco HSM, created by PKCS11 interface and cngtool? currently, I only can view each of them separately: PKCS11: using "PKCS#11 CryptoServer ...
mshwf's user avatar
  • 157
3 votes
0 answers
1k views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
user149408's user avatar
0 votes
1 answer
705 views

Why is YubiHSM an HSM?

What makes the YubiHSM an HSM? Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
David 天宇 Wong's user avatar
1 vote
1 answer
410 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
0xC0000022L's user avatar
  • 1,662
1 vote
1 answer
3k views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
user4205580's user avatar
0 votes
0 answers
330 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
Nezhull's user avatar
1 vote
1 answer
512 views

Is it possible to sync up LMKs in two Thales PayShield 9000 instances>

Basically, when we execute a generate key command such as A0 then we receive a key-under-lmk for future use. What if we have multiple HSMs in a high availability configuration? How would we make sure ...
bbozo's user avatar
  • 511
2 votes
1 answer
325 views

Does AWS KMS use HSM underneath by default?

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
Pedro Franco's user avatar
1 vote
0 answers
199 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
user3488903's user avatar
2 votes
1 answer
353 views

Reason for lack of asymmetric cryptography in AWS KMS for regions in China

In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence: Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
mat's user avatar
  • 1,272
1 vote
2 answers
334 views

Purpose of Secure Element

What is the purpose of embedding a Secure Element to enhance the security - especially the storage of keys- if a key is required to connect with it in order to get its secrets? For example: Let's ...
Elbattore's user avatar