Questions tagged [hsm]

an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
0
votes
0answers
43 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
0
votes
1answer
43 views

Is it possible to sync up LMKs in two Thales PayShield 9000 instances>

Basically, when we execute a generate key command such as A0 then we receive a key-under-lmk for future use. What if we have multiple HSMs in a high availability configuration? How would we make sure ...
2
votes
1answer
51 views

Does AWS KMS use HSM underneath by default?

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
0
votes
0answers
43 views

PKCS11, softHSM, and vendor defined mechanism

I have implemented a solution where I can decrypt DUKPT taking 10 bytes of KSN, and derive a key using a vendor defined mechanism. This vendor defined mechanism uses the existing parameter of ...
1
vote
0answers
36 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
1
vote
1answer
87 views

Reason for lack of asymmetric cryptography in AWS KMS for regions in China

In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence: Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
1
vote
2answers
97 views

Purpose of Secure Element

What is the purpose of embedding a Secure Element to enhance the security - especially the storage of keys- if a key is required to connect with it in order to get its secrets? For example: Let's ...
1
vote
2answers
379 views

RSA insensitive and extractable private key export from SoftHSM 2

I've created an RSA private key in SoftHSM 2 via EJBCA with the following config: attributes(*, CKO_PUBLIC_KEY, *) = { CKA_TOKEN = false CKA_ENCRYPT = true CKA_VERIFY = true CKA_WRAP = false }...
1
vote
1answer
513 views

Thales HSM: relationship between the various key types?

I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another: ...
1
vote
2answers
142 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
1
vote
0answers
53 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
1
vote
0answers
47 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
1
vote
1answer
207 views

Managing DUKPT keys in AWS cloud

I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
0
votes
0answers
56 views

How Cloudera Key Trustee Servers are caching Master Keys from HSM

We are building Cloudera platform with Encryption at rest for HDFS. We plan to use HSMs for key management. To lower the load we can generate on HSMs we will be using KeyTrustee servers to cache ...
2
votes
2answers
192 views

Does the use of a Hardware Security Module improve the security of a password storage?

Basic Assumptions Let us assume I work for a company, which aims to authenticate users using traditional usernames and passwords. The company currently uses a slow key-derivation function to hash ...
0
votes
0answers
255 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
2
votes
1answer
172 views

Which KEK can wrap AES, RSA and ECDSA keys securely?

If I have AES256, RSA4K and ECDSA-512 keys as CEKs, which I need to securely store, what KEK can I use to securely wrap these without reducing the bit strength? I am aware that an AES256 key can wrap ...
1
vote
0answers
120 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
6
votes
2answers
1k views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TPM vs. HSM and TPM vs. SE)...
1
vote
0answers
236 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
0
votes
2answers
138 views

TDE - Encrypting different rows with different keys

My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company ...
0
votes
1answer
367 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
0answers
334 views

Windows CA with HSM

Having some trouble finding documentation open on the web on this so I’m asking for help here. When using a HSM (Gemalto G5) for a windows CA is the private key ever exposed to the windows server at ...
1
vote
1answer
245 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
60 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
1answer
139 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
5
votes
0answers
462 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
1
vote
1answer
85 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
1
vote
1answer
320 views

How to configure more than one same Hardware Security Module (HSM)

---Updated--- I had a mis-understanding to HSMs, I thought that they were similar to huge USB tokens! (>﹏<)′ ~ Let's encrypt claim that their private keys are stored in HSMs, but how can they have ...
1
vote
1answer
344 views

HSM (Hardware Security Module) [closed]

I am implementing a security solution and I would like some recommendations on existing HSM software. If anyone has done a comparison on the existing HSM software and can recommend good and supported ...
2
votes
2answers
4k views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
3
votes
4answers
1k views

Securing hashes of short enumerated values

The system manages and stores sensitive data of short strings. Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
3
votes
1answer
135 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
6
votes
0answers
783 views

Where to put a code signing server with EV code signing certificate and plugged-in HSM

Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
3
votes
1answer
237 views

Are there any limits to what a HSM will sign?

For a cryptocurrency application, I take it that pretty much the main function of an HSM is to generate/store keys; it mainly just signs data that is fed to it? But what controls that? Will it happily ...
8
votes
1answer
2k views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
3
votes
2answers
1k views

Storage of certificates and keys in hardware security modules (Use-case TLS)

I am interested in the general security goals for public key cryptography and the different elements of it. Outline of the use-case: My use case is an embedded device, which will use TLS to establish ...
1
vote
4answers
165 views

RAID on HSM network

I want to implement a network of HSMs to secure millions of private keys. To increase fault tolerance and speed, I would want this network to run RAID 50 (striping, parity and duplication). As I ...
1
vote
0answers
326 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
3
votes
2answers
1k views

What is the limit of the number of keys an HSM supports?

I am pretty new to HSMs, and I need an HSM that supports a large number of keys (around few hundred thousand at least). Is there a limit in a number of keys an HSM support? I can't seem to find this ...
4
votes
2answers
2k views

Yubico 4 or Nitrokey as an HSM

Would it be possible to use Yubico or Nitrokey as a HSM that is used infrequently? Both devices seem to prevent users from accessing the private key. Does this seem to be correct? How about if the ...
2
votes
1answer
407 views

Securing an HSM on the network [closed]

I've never had to place an HSM on a network before so I want to ask this question to get a consensus on best practice for this. The HSM will reside on an internal network which will look like this; ...
1
vote
2answers
188 views

HSM key management system on AWS/Azure

I need to store user database credentials securely for an application to access. I have considered: - using AWS RDS with an encrypted PostgreSQL instance - using the AWS key management system, backed ...
2
votes
1answer
630 views

Offloading hashing and symmetric encryption to HSM

When using a (PKCS#11) based HSM (for S/Mime or PGP) the public key operations for signing or decryption is done by the HSM so that the key has to never leave the protected environment. The bulk part ...
3
votes
2answers
365 views

What is sent between an HSM and an application?

When an application calls an HSM using PKCS#11/KSP/etc. what is actually exchanged between the two? For example, if a CA needs to sign a CRL, is the entire CRL actually sent to the HSM for signing?
1
vote
0answers
422 views

Where do i get BDK for DUKPT decryption

I have generated a BDK Type3 key for DUKPT in Thales HSM. I have sent this BDK which is encrypted under the LMK of the HSM to the terminal manufacturer to generate the IPEK key and inject it into the ...
1
vote
2answers
150 views

mod_nss vs openssl behavior vis-a-vis key storage vs use

Maybe I'm just asking for the correct search terms. mod_nss and the NSS information/design idea is that if the key storage device (in this case, an HSM) is capable of performing a DH/SSL handshake, ...
1
vote
1answer
289 views

Cloud based private key storage for users

Say I want to create a cloud based private key storage for users, which they can use to sign documents. On the server side I would use a HSM to make the key storage more secure. One option is that ...
1
vote
0answers
679 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...