Questions tagged [hsm]

an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

Filter by
Sorted by
Tagged with
1
vote
0answers
26 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
0
votes
1answer
47 views

Managing DUKPT keys in AWS cloud

I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
0
votes
0answers
31 views

How Cloudera Key Trustee Servers are caching Master Keys from HSM

We are building Cloudera platform with Encryption at rest for HDFS. We plan to use HSMs for key management. To lower the load we can generate on HSMs we will be using KeyTrustee servers to cache ...
2
votes
2answers
78 views

Does the use of a Hardware Security Module improve the security of a password storage?

Basic Assumptions Let us assume I work for a company, which aims to authenticate users using traditional usernames and passwords. The company currently uses a slow key-derivation function to hash ...
0
votes
0answers
57 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
2
votes
1answer
65 views

Which KEK can wrap AES, RSA and ECDSA keys securely?

If I have AES256, RSA4K and ECDSA-512 keys as CEKs, which I need to securely store, what KEK can I use to securely wrap these without reducing the bit strength? I am aware that an AES256 key can wrap ...
1
vote
0answers
68 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
3
votes
2answers
329 views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TMP vs. HSM and TPM vs. SE)...
1
vote
0answers
151 views

Raspberry Pi with LAN, no WAN - Encryption Key Security - Zymbit/Zymkey

I am setting a up a Raspberry Pi that will be portable and often set up in areas without electricity or internet access and with poor cell service. I'd like to encrypt and decrypt data without ...
0
votes
2answers
72 views

TDE - Encrypting different rows with different keys

My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company ...
0
votes
1answer
194 views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
0
votes
0answers
205 views

Windows CA with HSM

Having some trouble finding documentation open on the web on this so I’m asking for help here. When using a HSM (Gemalto G5) for a windows CA is the private key ever exposed to the windows server at ...
1
vote
1answer
123 views

How secure is SSL private key in AWS ELB service?

We host a cluster of microservices on AWS. The cluster has a public-facing gateway that uses an Elastic Load Balancer to terminate SSL traffic. The certificate is issued by AWS Certificate Manager (...
0
votes
1answer
50 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
1answer
101 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
4
votes
0answers
337 views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
1
vote
1answer
57 views

Exposing HSM to a WAN via VPN

For our project we are using a 3rd party application (installed on their cloud). For crypto purposes, this application requires to access the HSM that is located in our LAN. So in terms of security ...
1
vote
1answer
196 views

How to configure more than one same Hardware Security Module (HSM)

---Updated--- I had a mis-understanding to HSMs, I thought that they were similar to huge USB tokens! (>﹏<)′ ~ Let's encrypt claim that their private keys are stored in HSMs, but how can they have ...
1
vote
1answer
298 views

HSM (Hardware Security Module) [closed]

I am implementing a security solution and I would like some recommendations on existing HSM software. If anyone has done a comparison on the existing HSM software and can recommend good and supported ...
1
vote
2answers
2k views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
3
votes
4answers
996 views

Securing hashes of short enumerated values

The system manages and stores sensitive data of short strings. Because the sensitive data is of an enumerated type with limited set of well known values, the attacker could easily iterate all the ...
3
votes
1answer
122 views

Is there some type of x-ray that can see through HSM or shielded integrated circuit?

I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or ...
4
votes
0answers
537 views

Where to put a code signing server with EV code signing certificate and plugged-in HSM

Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
3
votes
1answer
207 views

Are there any limits to what a HSM will sign?

For a cryptocurrency application, I take it that pretty much the main function of an HSM is to generate/store keys; it mainly just signs data that is fed to it? But what controls that? Will it happily ...
6
votes
1answer
965 views

TLS private key storage for embedded systems. Are there any best practices?

I am looking for best practices regarding TLS private key storage for small single chip embedded systems, such as Cortex-M MCUs, with monolithic firmware stored in internal flash. Most recommendations ...
3
votes
2answers
865 views

Storage of certificates and keys in hardware security modules (Use-case TLS)

I am interested in the general security goals for public key cryptography and the different elements of it. Outline of the use-case: My use case is an embedded device, which will use TLS to establish ...
1
vote
4answers
144 views

RAID on HSM network

I want to implement a network of HSMs to secure millions of private keys. To increase fault tolerance and speed, I would want this network to run RAID 50 (striping, parity and duplication). As I ...
1
vote
0answers
278 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
3
votes
2answers
803 views

What is the limit of the number of keys an HSM supports?

I am pretty new to HSMs, and I need an HSM that supports a large number of keys (around few hundred thousand at least). Is there a limit in a number of keys an HSM support? I can't seem to find this ...
4
votes
2answers
2k views

Yubico 4 or Nitrokey as an HSM

Would it be possible to use Yubico or Nitrokey as a HSM that is used infrequently? Both devices seem to prevent users from accessing the private key. Does this seem to be correct? How about if the ...
2
votes
1answer
337 views

Securing an HSM on the network [closed]

I've never had to place an HSM on a network before so I want to ask this question to get a consensus on best practice for this. The HSM will reside on an internal network which will look like this; ...
1
vote
2answers
179 views

HSM key management system on AWS/Azure

I need to store user database credentials securely for an application to access. I have considered: - using AWS RDS with an encrypted PostgreSQL instance - using the AWS key management system, backed ...
2
votes
1answer
517 views

Offloading hashing and symmetric encryption to HSM

When using a (PKCS#11) based HSM (for S/Mime or PGP) the public key operations for signing or decryption is done by the HSM so that the key has to never leave the protected environment. The bulk part ...
3
votes
2answers
313 views

What is sent between an HSM and an application?

When an application calls an HSM using PKCS#11/KSP/etc. what is actually exchanged between the two? For example, if a CA needs to sign a CRL, is the entire CRL actually sent to the HSM for signing?
1
vote
0answers
358 views

Where do i get BDK for DUKPT decryption

I have generated a BDK Type3 key for DUKPT in Thales HSM. I have sent this BDK which is encrypted under the LMK of the HSM to the terminal manufacturer to generate the IPEK key and inject it into the ...
1
vote
2answers
118 views

mod_nss vs openssl behavior vis-a-vis key storage vs use

Maybe I'm just asking for the correct search terms. mod_nss and the NSS information/design idea is that if the key storage device (in this case, an HSM) is capable of performing a DH/SSL handshake, ...
1
vote
1answer
255 views

Cloud based private key storage for users

Say I want to create a cloud based private key storage for users, which they can use to sign documents. On the server side I would use a HSM to make the key storage more secure. One option is that ...
1
vote
0answers
642 views

Implementing Internal Certificate Authority

We're considering setting up an internal certificate authority to issue ssl certificates. The certificates would primarily be used to secure internal websites, but I could foresee us potentially ...
0
votes
1answer
252 views

Internal storage scheme for storing private keys inside an HSM

I am trying to understand the internal storage scheme used by HSMs to store the private keys. My question is: are keys stored in plaintext inside an HSM? Are there any variations?
2
votes
1answer
765 views

What does the private key look like for an HSM based certificate?

Can someone explain what makes up the anatomy of a certificate’s private key when the key itself is stored on an HSM? I’m using nShield in this example but I’m assuming the principals are the same for ...
3
votes
1answer
88 views

How is tivoization implemented in hardware?

I am trying to understand how Tivoization worked; but the Internet is filled with discussions about the legal aspect of the matter, rather than technical details of how it was implemented. My ...
1
vote
1answer
727 views

Using a HSM device for code signature generation

I currently generate code signatures for my open source package by using openssl. The way I do it is : Generate RSA private-public key pair (E.g. openssl genrsa) During packaging , I create a ...
4
votes
1answer
984 views

How to securely transfer DUKPT BDK between HSMs?

I'm trying to understand best practices and capabilities regarding the use of an HSM, e.g the Thales Payshield 9000. Specifically, I wish to securely transfer a BDK for DUKPT from one HSM to a second,...
2
votes
0answers
768 views

Is it possible to use Bouncy Castle crypto library with PKCS#11 HSMs?

Is it possible to use Bouncy Castle crypto library with PKCS #11 HSMs?
0
votes
0answers
362 views

Affordable web security: sending private key to service over HTTPS vs storing in disk image vs HSM

I'm currently building an application whose only real complexity lies in private key security. I don't feel comfortable keeping the private key in the disk image, from which the server would read it, ...
7
votes
1answer
1k views

How is HSM access gated?

On the backend if I use a HSM (or even have the master key on a physical server), I need to do operations using that key. That means the app server is going to call into the HSM (or keyserver). What ...
1
vote
0answers
134 views

If a HSM RNG is FIPS 140-2 compliant, does that imply FIPS 186-2 compliance also?

If the RNG of an HSM is said to be compliant to FIPS 140-2 (approved DRBG - SP 800-90 CTR mode) does also imply that it is compliant to FIPS 186-2?
1
vote
0answers
4k views

How to safely store/process secret key for JWT

After reading this: https://stackoverflow.com/questions/30089604/jwt-whats-a-good-secret-key-and-how-to-store-it-in-an-node-js-express-app, on how to store "secret key" to assign JWT tokens. I had ...
3
votes
2answers
171 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
0
votes
1answer
1k views

Public Key Encryption vs HSM for storing encryption keys

Let's say I have sensitive data in the database server that needs to be encrypted (i.e emails, etc..) and I want to make sure that in the event that the server is compromised, the attacker shouldn't ...