Questions tagged [hsm]
an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.
146
questions
0
votes
1
answer
135
views
How to secure hundreds of AES keys
I need to store a large amount of AES keys and provide an API to decrypt user-provided ciphertext.
The application flow is as follows:
The user authenticates
The user makes a POST request with some ...
1
vote
1
answer
116
views
CVV2 calculation with TR-31 Key
I need to use the CVK Key (in key block format) to calculate the CVV2.
In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
- 11
0
votes
1
answer
70
views
PCI compliance - use of ANSI X9.17 for export keys
we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
- 11
0
votes
0
answers
78
views
Management of CVK key in Key Block format
I use a Thales PayShield 10K with a LMK KeyBlock 3DES. I have to send a CVK Key to a Scheme for the valorization of CVV2 value. Now, in my envorinment i generated a CVK Key with "Key Usage"= ...
- 11
1
vote
2
answers
89
views
Does saving of ECDHE keypairs to HSM increase security of TLS?
When ephemeral Diffie-Hellman (DHE) is used with TLS, the key-exchange key can/will be discarded after a key-exchange. right?
Is there good reason to use HSM for generating and storing DHE key, when ...
- 303
0
votes
0
answers
49
views
Data Encryption Key protection during transmission in Envelope-Based Encryption
When using cloud HSM (eg: AWS CloudHSM, Google Cloud HSM etc) for client-side encryption, they always refer to Envelope encryption. In this encryption approach, the data encryption key (DEK) is ...
0
votes
0
answers
113
views
Windows CSP for remote signing
I have a system (lets call it signer) that has private keys for doing Authenticode code signing. I have bunch of build systems that want to sign generated build artifacts. Obviously I can't use ...
- 101
1
vote
1
answer
87
views
Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?
Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
- 285
0
votes
1
answer
131
views
How do RSA smartcards prevent key exfiltration?
Extracting private keys directly from the card is nearly impossible. With some acid package destruction and electron microscope work, a skilled team, and enough time, money, and luck you can in theory ...
3
votes
1
answer
158
views
Is it (under FIPS) possible to generate a CSR for an asymmetric key with usage=WRAP?
To clarify: The FIPS module Security Policy lists using RSA keys for wrap/unwrap. FIPS is a moving target, and the state of the requirements when the CMVP approved module went through the process ...
- 271
3
votes
1
answer
172
views
What is the right way to transfer public-private keypairs over intranet?
First asked on StackOverflow and referred to this board, here:
I have an embedded system (Netburner 5441x) that encodes public-private RSA keypairs into devices. I have ported OpenSSL into the system ...
- 33
0
votes
1
answer
170
views
How do centralized crypto exchanges store seed phrases and users' private keys?
Say I'm trying to develop a CEX, hence I will hold custody of users' keys. How would I go about doing that and ensuring safety and security?
From what I know, I can generate the users' keys from a ...
0
votes
0
answers
93
views
Storing an encryption key securely
I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options.
Option 1) Storing the key on the same server (not recommended, ...
- 121
1
vote
1
answer
151
views
Examples of custom key restriction policies for HSMs
Based on my understanding, some types of HSMs allow custom software to be developed that can run within the HSM's secure enclave. This capability allowed Square to do something very clever to boost ...
- 87
2
votes
0
answers
108
views
What are the "Design Patterns" for working with HSMs?
I've been attempting to learn about the different features and uses of HSMs, and I keep thinking that someone must have put together a set of design patterns for different ways that HSMs can be used ...
- 87
1
vote
2
answers
169
views
HSM High Volume Keys
Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
- 111
1
vote
1
answer
253
views
How do I get my server HSM working while connected via RDP? (Win 2019)
The error I get from pkcs11-tool.exe is "No slots."
My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
- 403
1
vote
1
answer
145
views
Is "time locking" a good strategy for protecting data with HSMs?
I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
- 87
1
vote
2
answers
189
views
Can some HSMs send requests to other servers before performing an encryption/decryption operation?
In various discussions of Security Architecture, I have read that HSMs can be configured with rate limiting on the number of encryptions/decryptions that can be performed in a given amount of time. If ...
- 87
0
votes
1
answer
262
views
Using an HSM to protect encrypted data even when a server is compromised
Imagine a system architecture where an API server is able to send a request to an HSM, and the HSM is able to decrypt some data for a particular user/customer, in order to serve some hypothetical ...
- 87
1
vote
0
answers
408
views
AWS KMS CMK compromise
Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
- 672
2
votes
3
answers
665
views
Does / Can a HSM or TPM encrypt my private keys
I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes.
My use case would be using TLS with an embedded device ...
- 267
0
votes
1
answer
326
views
How does a cloud based application use a TPM to authenticate hardware devices?
I have heard about this, but not sure how it would work.
I would imagine that when you register the device, the public RSA key burnt into the chip would be shared.
That way, if the application sends a ...
- 47
2
votes
2
answers
564
views
Secure boot for devices which don't have hardware security element
I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/..
So for ...
- 163
2
votes
1
answer
776
views
How to get Future Keys (Session Key) from IPEK for decryption data?
I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal.
So far, when I receive KSN and encrypted data, I understand that I ...
1
vote
0
answers
180
views
Are there any options for Root CA eIDAS compliant HSMs? [closed]
Building the eIDAS compliant certification authority in hierarchy, meaning that the Root CA will issue Subordinate CAs. Root CA will be offline almost whole year and Subordinate CA is online providing ...
- 1,109
7
votes
3
answers
3k
views
Open-Source Hardware Security Modules (HSM)
Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)?
I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
- 978
1
vote
1
answer
232
views
Use of SoftHSM2 in commercial products
I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
0
votes
0
answers
308
views
Better security for storing certificates in LUKS or softhsm?
What is the best place to store certificates and keys which are confidential and sensitive?
As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
0
votes
1
answer
318
views
key escrow vs secure storage(software/TPM/HSM)
From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-...
2
votes
2
answers
1k
views
pkcs11 with remote HSM
Seeking assistance on using PKCS11 with a remote HSM.
I have a small linux host with an HSM card installed. The HSM has libraries and utility scripts provided to interact with it, on that host. ...
- 21
3
votes
1
answer
540
views
Why does it take so much time to create a secret key on a HSM?
I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM.
I've used pkcs11-tool to generate the key and it took ...
- 193
0
votes
0
answers
107
views
Authenticate Windows/Linux process against hardware security module
I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
0
votes
2
answers
120
views
Secure Authentication of Technical User to a Network-Appliance-HSM
Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
1
vote
1
answer
479
views
Is this a good way to manage encryption keys?
I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything
from a leave of absence form to potentially confidential agreements.
Being ...
- 111
-1
votes
1
answer
628
views
List all keys in Utimaco HSM created by PKCS11 and CNG?
Is there a way to list all keys inside the Utimaco HSM, created by PKCS11 interface and cngtool?
currently, I only can view each of them separately:
PKCS11: using "PKCS#11 CryptoServer ...
- 157
3
votes
0
answers
813
views
What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?
My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home.
Since the laptop uses BitLocker ...
- 367
0
votes
1
answer
563
views
Why is YubiHSM an HSM?
What makes the YubiHSM an HSM?
Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
- 169
1
vote
1
answer
359
views
Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG
The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key.
Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
- 1,649
1
vote
1
answer
2k
views
Wrap key operation in Azure Key Vault - symmetric keys
Could anyone explain why the bolded part of the wrap key description?
Wraps a symmetric key using a specified key. The WRAP operation
supports encryption of a symmetric key using a key encryption key ...
- 113
0
votes
0
answers
258
views
Parameters for HSM based symmetric Key Derivation Function (KDF)
I have a quick question regarding parameters for HSM based symmetric Key Derivation.
My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
- 1
1
vote
1
answer
428
views
Is it possible to sync up LMKs in two Thales PayShield 9000 instances>
Basically, when we execute a generate key command such as A0 then we receive a key-under-lmk for future use. What if we have multiple HSMs in a high availability configuration? How would we make sure ...
- 513
2
votes
1
answer
261
views
Does AWS KMS use HSM underneath by default?
Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
- 21
1
vote
0
answers
148
views
HSM: How multiple users are supported (using SAM)?
So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
- 121
2
votes
1
answer
310
views
Reason for lack of asymmetric cryptography in AWS KMS for regions in China
In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence:
Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
- 1,272
1
vote
2
answers
284
views
Purpose of Secure Element
What is the purpose of embedding a Secure Element to enhance the security - especially the storage of keys- if a key is required to connect with it in order to get its secrets?
For example:
Let's ...
- 11
1
vote
2
answers
2k
views
RSA insensitive and extractable private key export from SoftHSM 2
I've created an RSA private key in SoftHSM 2 via EJBCA with the following config:
attributes(*, CKO_PUBLIC_KEY, *) = {
CKA_TOKEN = false
CKA_ENCRYPT = true
CKA_VERIFY = true
CKA_WRAP = false
}...
- 193
1
vote
1
answer
6k
views
Thales HSM: relationship between the various key types?
I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another:
...
- 111
1
vote
0
answers
221
views
Is Yubikey HSM2 FIPS Compliant?
I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series.
(https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search)
...
- 111
1
vote
2
answers
521
views
Storage of SSL private key in load balancer VS HSM
I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
- 139