2022 Developer Survey is open! Take survey.

Questions tagged [hsm]

an abbreviation for Hardware Security Module which is a security device that is compliant with PKCS11 standard and which is a secure storage for data specially private keys.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Import BDK encrypted under the Transport Key KEK on HSM

I received a two-component KEK TDES key and a BDK cryptogram, which is encrypted for this KEK. Do you have any suggestions on how to load such a key into the HSM device? Eg. Luna HSM
user avatar
0 votes
0 answers
54 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
user avatar
0 votes
0 answers
113 views

How to calculate Millenage OPc value while OP stored in HSM?

ETSI TS 135 206 defines the specification of MILENAGE algorithm which is an authentication algorithm for mobile networks. It defines 'OPc' as below: a 128-bit value derived from OP and K and used ...
user avatar
  • 185
0 votes
1 answer
72 views

Examples of custom key restriction policies for HSMs

Based on my understanding, some types of HSMs allow custom software to be developed that can run within the HSM's secure enclave. This capability allowed Square to do something very clever to boost ...
user avatar
  • 67
2 votes
0 answers
63 views

What are the "Design Patterns" for working with HSMs?

I've been attempting to learn about the different features and uses of HSMs, and I keep thinking that someone must have put together a set of design patterns for different ways that HSMs can be used ...
user avatar
  • 67
0 votes
2 answers
103 views

HSM High Volume Keys

Our project is to apply digital signature to PDF, so each user should have their own key pairs and a certificate. To keep key securely, we plan to purchase HSM, but from what I understand HSM have a ...
user avatar
  • 101
1 vote
1 answer
127 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
user avatar
0 votes
0 answers
114 views

Handling MTLS with HSM

Scenario: I need to implement MTLS between three of my services communicating with each other. Based on my understanding of MTLS, I need to import the certificate of target services in the trust store ...
user avatar
1 vote
1 answer
130 views

Is "time locking" a good strategy for protecting data with HSMs?

I've read several times that many HSMs support configurable rate limiting on cryptographic operations, as a way of protecting against a hacker that compromises a server that has access to the HSM. So ...
user avatar
  • 67
1 vote
2 answers
126 views

Can some HSMs send requests to other servers before performing an encryption/decryption operation?

In various discussions of Security Architecture, I have read that HSMs can be configured with rate limiting on the number of encryptions/decryptions that can be performed in a given amount of time. If ...
user avatar
  • 67
0 votes
1 answer
168 views

Using an HSM to protect encrypted data even when a server is compromised

Imagine a system architecture where an API server is able to send a request to an HSM, and the HSM is able to decrypt some data for a particular user/customer, in order to serve some hypothetical ...
user avatar
  • 67
1 vote
0 answers
209 views

AWS KMS CMK compromise

Given the usage of AWS KSM without CloudHSM. There is a two-tier key hierarchy: master key + data key. Master key encrypts data key, data key encrypts data. Encrypted data key is stored with the data ...
user avatar
0 votes
0 answers
95 views

Is using HSM worth in this scenario?

Long story short, I've assigned with the task to find a way to improve security in an application, they are using java keystores to save and protect the keys. The application owner is worried that ...
user avatar
  • 11
2 votes
3 answers
295 views

Does / Can a HSM or TPM encrypt my private keys

I'm still not completely sure about the role of using an HSM or TPM on a device when it comes to storing private keys for security purposes. My use case would be using TLS with an embedded device ...
user avatar
0 votes
1 answer
220 views

How does a cloud based application use a TPM to authenticate hardware devices?

I have heard about this, but not sure how it would work. I would imagine that when you register the device, the public RSA key burnt into the chip would be shared. That way, if the application sends a ...
user avatar
2 votes
2 answers
230 views

Secure boot for devices which don't have hardware security element

I understand that Root of Trust is necessary for implementing a secure boot on a device. Root of Trust is strong and trust worthy if this comes from hardware security elements like HSM/TPM/.. So for ...
user avatar
1 vote
1 answer
471 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
user avatar
1 vote
0 answers
124 views

Are there any options for Root CA eIDAS compliant HSMs? [closed]

Building the eIDAS compliant certification authority in hierarchy, meaning that the Root CA will issue Subordinate CAs. Root CA will be offline almost whole year and Subordinate CA is online providing ...
user avatar
  • 1,079
3 votes
2 answers
771 views

Open-Source Hardware Security Modules (HSM)

Are there any Open-Source Hardware Security Modules (meeting OSHWA requirements)? I've worked with Utimaco HSMs, but I'm not a big fan of closed-source hardware -- especially when it comes to security ...
user avatar
1 vote
1 answer
146 views

Use of SoftHSM2 in commercial products

I came across SoftHSM2 from OpenDNSSec(BSD license) which is a drop-in replacement for HSM except that SoftHSM2 only lacks physical security. Also, being the fact that PKCS#11 is the standard ...
user avatar
1 vote
0 answers
170 views

Better security for storing certificates in LUKS or softhsm?

What is the best place to store certificates and keys which are confidential and sensitive? As I understand LUKS is fine and kernel transparently handles encryption/decryption. Also, the LUKS volume ...
user avatar
0 votes
1 answer
212 views

key escrow vs secure storage(software/TPM/HSM)

From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-...
user avatar
1 vote
2 answers
613 views

pkcs11 with remote HSM

Seeking assistance on using PKCS11 with a remote HSM. I have a small linux host with an HSM card installed. The HSM has libraries and utility scripts provided to interact with it, on that host. ...
user avatar
  • 21
3 votes
1 answer
383 views

Why does it take so much time to create a secret key on a HSM?

I was testing key generation on a Hardware Security Module and I noticed that it takes so much time to generate an AES 256 secret key on the HSM. I've used pkcs11-tool to generate the key and it took ...
user avatar
  • 83
0 votes
0 answers
80 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
user avatar
0 votes
2 answers
107 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
user avatar
1 vote
1 answer
360 views

Is this a good way to manage encryption keys?

I'm a noob in data security area and I'm working on PoC for an app for managing some files. Now these files might be anything from a leave of absence form to potentially confidential agreements. Being ...
user avatar
-1 votes
1 answer
322 views

List all keys in Utimaco HSM created by PKCS11 and CNG?

Is there a way to list all keys inside the Utimaco HSM, created by PKCS11 interface and cngtool? currently, I only can view each of them separately: PKCS11: using "PKCS#11 CryptoServer ...
user avatar
  • 147
2 votes
0 answers
451 views

What are the prerequisites for cloning a Trusted Platform Module (TPM), and how does that affect security?

My company laptop recently needed a new mainboard as the old one was defective. The repair was carried out by the manufacturer, who sent a field engineer to my home. Since the laptop uses BitLocker ...
user avatar
-1 votes
1 answer
410 views

Why is YubiHSM an HSM?

What makes the YubiHSM an HSM? Most HSMs I have seen have more memory and are faster, perhaps due to crypto-accelerators. They're generally big and inserted in data center racks, or plugged as PCIe ...
user avatar
1 vote
1 answer
297 views

Conceptual question regarding signing with Yubikey/Solokey/Nitrokey using GnuPG

The named hardware dongles (or at least several models of them) allow me to store PGP secret keys key. Suppose I am using such a secret key to sign data (doesn't matter what). As I understand the ...
user avatar
  • 1,594
1 vote
1 answer
1k views

Wrap key operation in Azure Key Vault - symmetric keys

Could anyone explain why the bolded part of the wrap key description? Wraps a symmetric key using a specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key ...
user avatar
0 votes
0 answers
165 views

Parameters for HSM based symmetric Key Derivation Function (KDF)

I have a quick question regarding parameters for HSM based symmetric Key Derivation. My situation is that I have to implement HSM based symmetric key derivation for encryption of sensitive data to be ...
user avatar
1 vote
1 answer
289 views

Is it possible to sync up LMKs in two Thales PayShield 9000 instances>

Basically, when we execute a generate key command such as A0 then we receive a key-under-lmk for future use. What if we have multiple HSMs in a high availability configuration? How would we make sure ...
user avatar
  • 503
2 votes
1 answer
188 views

Does AWS KMS use HSM underneath by default?

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss ...
user avatar
1 vote
0 answers
120 views

HSM: How multiple users are supported (using SAM)?

So far, I knew that traditional HSMs (Hardware Security Module) can be used to store key of a single user. But, recently, I came to know that newer HSMs have the capability to store keys of multiple ...
user avatar
2 votes
1 answer
253 views

Reason for lack of asymmetric cryptography in AWS KMS for regions in China

In the documentation of the AWS Key Management Service (KMS) I found this interesting sentence: Asymmetric CMKs and asymmetric data key pairs are supported in all AWS Regions that AWS KMS supports ...
user avatar
  • 1,253
1 vote
2 answers
212 views

Purpose of Secure Element

What is the purpose of embedding a Secure Element to enhance the security - especially the storage of keys- if a key is required to connect with it in order to get its secrets? For example: Let's ...
user avatar
1 vote
2 answers
1k views

RSA insensitive and extractable private key export from SoftHSM 2

I've created an RSA private key in SoftHSM 2 via EJBCA with the following config: attributes(*, CKO_PUBLIC_KEY, *) = { CKA_TOKEN = false CKA_ENCRYPT = true CKA_VERIFY = true CKA_WRAP = false }...
user avatar
  • 83
1 vote
1 answer
3k views

Thales HSM: relationship between the various key types?

I am going through the Thales HSM manuals, and frankly the key acronyms are driving me crazy. I would like to understand the differences between the following keys, and how they relate to one another: ...
user avatar
  • 111
1 vote
0 answers
190 views

Is Yubikey HSM2 FIPS Compliant?

I searched for Yubico on this NIST validated modules but found only a module from the Yubico 4 series. (https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Validated-Modules/Search) ...
user avatar
1 vote
2 answers
365 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
user avatar
  • 139
1 vote
0 answers
106 views

TDE - Does Key Rotation involve full tablespace Decryption and Re-Encryption?

In Oracle DB 12c, which uses TDE-Tablespace level. If i want to implement key rotation policy, what is the impact? 1. Is it the Tablespace key that will be rotated or the Masterkey? 2. Does key ...
user avatar
  • 157
1 vote
0 answers
132 views

Root CA key generation compliant with WebTrust and HSM independent

I'm trying to figure out how to generate private key for the Root CA according the principles of WebTrust. One additional requirement I have that the generate private key should be then imported to ...
user avatar
  • 1,079
1 vote
1 answer
542 views

Managing DUKPT keys in AWS cloud

I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found ...
user avatar
  • 11
2 votes
2 answers
528 views

Does the use of a Hardware Security Module improve the security of a password storage?

Basic Assumptions Let us assume I work for a company, which aims to authenticate users using traditional usernames and passwords. The company currently uses a slow key-derivation function to hash ...
user avatar
0 votes
0 answers
441 views

Line jump with openssl s_client -connect command when using CAfile

I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect ...
user avatar
2 votes
1 answer
502 views

Which KEK can wrap AES, RSA and ECDSA keys securely?

If I have AES256, RSA4K and ECDSA-512 keys as CEKs, which I need to securely store, what KEK can I use to securely wrap these without reducing the bit strength? I am aware that an AES256 key can wrap ...
user avatar
  • 123
2 votes
1 answer
236 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
user avatar
  • 689
8 votes
2 answers
5k views

What are the differences between HSM and SE?

What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably? I came across various related question (TPM vs. HSM and TPM vs. SE)...
user avatar
  • 145