Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hsm]

an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

1
vote
0answers
46 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
0
votes
2answers
43 views

TDE - Encrypting different rows with different keys

My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company ...
0
votes
1answer
124 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
0answers
60 views

Windows CA with HSM

Having some trouble finding documentation open on the web on this so I’m asking for help here. When using a HSM (Gemalto G5) for a windows CA is the private key ever exposed to the windows server at ...
1
vote
1answer
83 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
42 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
1answer
69 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
4
votes
0answers
234 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
1
vote
1answer
46 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
1
vote
1answer
136 views

How to configure more than one same Hardware Security Module (HSM)

---Updated--- I had a mis-understanding to HSMs, I thought that they were similar to huge USB tokens! (>﹏<)′ ~ Let's encrypt claim that their private keys are stored in HSMs, but how can they have ...
1
vote
1answer
252 views

HSM (Hardware Security Module) [closed]

I am implementing a security solution and I would like some recommendations on existing HSM software. If anyone has done a comparison on the existing HSM software and can recommend good and supported ...
2
votes
2answers
990 views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
3
votes
4answers
980 views

Securing hashes of short enumerated values

The system manages and stores sensitive data of short strings. Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
3
votes
1answer
114 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
4
votes
0answers
375 views

Where to put a code signing server with EV code signing certificate and plugged-in HSM

Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
0
votes
0answers
109 views

Mostly offline CA HSM

I am looking at deploying some PKIs for a couple different clients, some big and some small. For cost savings (and other reasons) we are contemplating hosting one or more of the issuing CAs in AWS ...
3
votes
1answer
167 views

Are there any limits to what a HSM will sign?

For a cryptocurrency application, I take it that pretty much the main function of an HSM is to generate/store keys; it mainly just signs data that is fed to it? But what controls that? Will it happily ...
4
votes
1answer
611 views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
3
votes
2answers
633 views

Storage of certificates and keys in hardware security modules (Use-case TLS)

I am interested in the general security goals for public key cryptography and the different elements of it. Outline of the use-case: My use case is an embedded device, which will use TLS to establish ...
1
vote
4answers
133 views

RAID on HSM network

I want to implement a network of HSMs to secure millions of private keys. To increase fault tolerance and speed, I would want this network to run RAID 50 (striping, parity and duplication). As I ...
1
vote
0answers
237 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
3
votes
2answers
590 views

What is the limit of the number of keys an HSM supports?

I am pretty new to HSMs, and I need an HSM that supports a large number of keys (around few hundred thousand at least). Is there a limit in a number of keys an HSM support? I can't seem to find this ...
4
votes
2answers
2k views

Yubico 4 or Nitrokey as an HSM

Would it be possible to use Yubico or Nitrokey as a HSM that is used infrequently? Both devices seem to prevent users from accessing the private key. Does this seem to be correct? How about if the ...
2
votes
1answer
296 views

Securing an HSM on the network [closed]

I've never had to place an HSM on a network before so I want to ask this question to get a consensus on best practice for this. The HSM will reside on an internal network which will look like this; ...
1
vote
2answers
172 views

HSM key management system on AWS/Azure

I need to store user database credentials securely for an application to access. I have considered: - using AWS RDS with an encrypted PostgreSQL instance - using the AWS key management system, backed ...
2
votes
1answer
446 views

Offloading hashing and symmetric encryption to HSM

When using a (PKCS#11) based HSM (for S/Mime or PGP) the public key operations for signing or decryption is done by the HSM so that the key has to never leave the protected environment. The bulk part ...
3
votes
2answers
255 views

What is sent between an HSM and an application?

When an application calls an HSM using PKCS#11/KSP/etc. what is actually exchanged between the two? For example, if a CA needs to sign a CRL, is the entire CRL actually sent to the HSM for signing?
1
vote
0answers
288 views

Where do i get BDK for DUKPT decryption

I have generated a BDK Type3 key for DUKPT in Thales HSM. I have sent this BDK which is encrypted under the LMK of the HSM to the terminal manufacturer to generate the IPEK key and inject it into the ...
1
vote
2answers
115 views

mod_nss vs openssl behavior vis-a-vis key storage vs use

Maybe I'm just asking for the correct search terms. mod_nss and the NSS information/design idea is that if the key storage device (in this case, an HSM) is capable of performing a DH/SSL handshake, ...
1
vote
1answer
232 views

Cloud based private key storage for users

Say I want to create a cloud based private key storage for users, which they can use to sign documents. On the server side I would use a HSM to make the key storage more secure. One option is that ...
1
vote
0answers
623 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...
0
votes
1answer
214 views

Internal storage scheme for storing private keys inside an HSM

I am trying to understand the internal storage scheme used by HSMs to store the private keys. My question is: are keys stored in plaintext inside an HSM? Are there any variations?
3
votes
1answer
650 views

What does the private key look like for an HSM based certificate?

Can someone explain what makes up the anatomy of a certificate’s private key when the key itself is stored on an HSM? I’m using nShield in this example but I’m assuming the principals are the same for ...
4
votes
1answer
81 views

How is tivoization implemented in hardware?

I am trying to understand how Tivoization worked; but the Internet is filled with discussions about the legal aspect of the matter, rather than technical details of how it was implemented. My ...
1
vote
1answer
649 views

Using a HSM device for code signature generation

I currently generate code signatures for my open source package by using openssl. The way I do it is : Generate RSA private-public key pair (E.g. openssl genrsa) During packaging , I create a ...
3
votes
1answer
792 views

How to securely transfer DUKPT BDK between HSMs?

I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000. Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second,...
1
vote
0answers
720 views

Is it possible to use Bouncy Castle crypto library with PKCS#11 HSMs?

Is it possible to use Bouncy Castle crypto library with PKCS #11 HSMs?
0
votes
0answers
360 views

Affordable web security: sending private key to service over HTTPS vs storing in disk image vs HSM

I'm currently building an application whose only real complexity lies in private key security. I don't feel comfortable keeping the private key in the disk image, from which the server would read it, ...
7
votes
1answer
935 views

How is HSM access gated?

On the backend if I use a HSM (or even have the master key on a physical server), I need to do operations using that key. That means the app server is going to call into the HSM (or keyserver). What ...
1
vote
0answers
119 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
1
vote
0answers
4k views

How to safely store/process secret key for JWT

After reading this: https://stackoverflow.com/questions/30089604/jwt-whats-a-good-secret-key-and-how-to-store-it-in-an-node-js-express-app, on how to store "secret key" to assign JWT tokens. I had ...
3
votes
2answers
162 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
0
votes
1answer
1k views

Public Key Encryption vs HSM for storing encryption keys

Let's say I have sensitive data in the database server that needs to be encrypted (i.e emails, etc..) and I want to make sure that in the event that the server is compromised, the attacker shouldn't ...
3
votes
2answers
623 views

What's the difference between the same model with and without FIPS 140 certification?

We all know that there is a lot of FIPS 140-2 certified hardware available. However many hardware platforms come with either different grades of certification (e.g. level 2 vs level 3) or are branded ...
11
votes
2answers
3k views

Designing my own HSM using an Arduino

I am attempting to build from scratch something similar to Apple's Secure Enclave. What I've done is use an AES library for the Arduino to create a security appliance. A random crypto key and the ...
1
vote
0answers
58 views

AWS DMS to use CloudHSM

I have a source database that need to be migrated to another one. This target will be created and integrated with CloudHSM so that the data migrated is encrypted. For migration I am planning to use ...
7
votes
2answers
2k views

Securing HSM-stored symmetric data encryption keys (AES) in memory on server

My project requires me to encrypt sensitive user data using symmetric data encryption (AES). I will be storing the AES key (DEK) in a HSM-based key management service (ie. Azure Key Vault / AWS KMS) ...
0
votes
1answer
245 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
14
votes
1answer
3k views

What benefits do Hardware Security Modules provide when keys are not stored inside them?

I'm researching a project that makes use of cryptography. It is a .net application with keys stored in a sql server database. For cryptography, the project uses a Hardware Security Module similar to ...
4
votes
1answer
3k views

How can I use my HSM to turn a CSR into a certificate?

I create a CSR using OpenSSL, so I have public and private keys. Now I want to sign this CSR and convert it into an X.509 certificate. The only problem is, my signer is a custom HSM. I can send bytes ...