Hot answers tagged

37

Some technical factors that may be relevant: Performance - across whatever matters for your application (if any): encryption/decryption/key generation/signing, symmetric, asymmetric, EC, ... Scale: Is there a limit to the number of keys it supports, and could that limit be a problem? How easy is it to add another HSM when your application becomes more ...


32

Trusted Platform Modules A Trusted Platform Module (TPM) is a hardware chip on the computer’s motherboard that stores cryptographic keys used for encryption. Many laptop computers include a TPM, but if the system doesn’t include it, it is not feasible to add one. Once enabled, the Trusted Platform Module provides full disk encryption ...


25

Sorry, but I think there are some gaps in this conversation: TPMs can't be added later : False. Many modern motherboards include a header to which a TPM can be added after the fact. Visit Amazon and look at the TPM modules cards for MSI, Asus, and other motherboards HSMs are typically removed or network attached : False. HSMs can be embedded in a range ...


23

A HSM will not avoid complexity; rather, it will add quite a lot of complexity to the whole system. What HSM do best is key storage: the key is in the HSM and does not get out of it, never. However, you still have to worry about the key life cycle. With a "software" key, stored in a file or in the entrails of the operating system, backups are a ...


19

The Thales nShield HSM (previously nCipher) allow for generic programming. This is a rather expensive option; it must first be enabled in the HSM (through a "feature file" which is signed by Thales and specific to the serial number of a HSM), and then the extra code can run as long as it is signed with a key known to the HSM for such usage. With that option,...


19

First, Apple's Secure Enclave is a module which ensures that the boot loader only runs code signed by Apple. That's not what you're doing, you are trying to build a Hardware Security Module (HSM). As you figured out, the proper way to do this is to have the HSM do all the crypto operations internally so that no keys ever leave the device - as you point out,...


14

In many HSM, there is very little capacity for safe storage (say, a few kilobytes). Therefore, what the HSM really stores in its entrails is some master key K (symmetric). The key pairs that applications use are stored externally, but encrypted with K; they get decrypted and used only within the HSM. In such a setup, keys are both "logically" inside the HSM, ...


11

Suppose that the question sent to the client can be about three characters: the server asks for (for instance) the 4th, 7th and 8th characters of the password. Freeze time! At that exact point, the server has asked the question above, and will be able to verify an answer from the client. This means that in its complete state, there is enough information to ...


10

The salt must be common for all the records. This is known as a "pepper", not a salt. the attacker could easily iterate all the possible values If the search space is small enough that it could be brute-forced even with a high cost hash like bcrypt, then you're relying entirely on the secrecy of the "pepper" to prevent brute-forcing. In this case, you ...


8

The -1 or -2 part is a version number. A module that is FIPS-140-2-compliant is not more secure than a module that is FIPS-140-1-compliant, it is only more up-to-date in the certification process. The requirements for FIPS 140-1 level N and FIPS 140-2 level N are broadly similar. In other words, you get the same amount of security from FIPS 140-2 level 1 as ...


7

The point of a key server or HSM is to isolate the application from the storage (and potentially usage) of the key. Ideally, you would want to offload and rate limit all cryptography operations to the HSM or Key Server so that the application never has access to the decryption key. This allows you to do intrusion detections such as rate limits and such ...


7

You've asked several questions here, so I'm going to provide several answers, and a couple of clarifications. I will be storing the AES key (DEK) in a HSM-based key management service (ie. Azure Key Vault / AWS KMS) and will retrieve the key to encrypt/decrypt data on my Nodejs server. This is not generally what you want to do. If you're using an HSM,...


7

A hardware security module (HSM), a secure element (SE), a smart card, a trusted execution environment (TEE) and a secure enclave (SE again) are all computing environments designed for secure execution. They generally have some properties in common: They are isolated environment with a degree of tamper resistance. They're designed to make it hard to extract ...


7

Size and performance don't matter, as a hardware security module (HSM) is defined by its functions to perform cryptographic operations and protection. From Peter Smirnoff on Cryptomathic: Understanding Hardware Security Modules (HSMs): The hardware security module (HSM) is a special “trusted” network computer performing a variety of cryptographic operations:...


6

The Utimaco/Sophos HSM has got plenty of FLASH for internal storage of keys, which you can manage via (for instance) the PKCS#11 interface. If you want to develop your own cryptographic algorithms or security protocols , there is also an SDK available. The CPU is a bit exotic (Texas Instruments DSP), but it is fully programmable in C and comes with a ...


6

The following is a possible series of steps you could take. I'm considering that you have a secondary, online HSM for the period during which the affected HSM is removed from service for repair. Destroy all key material on the HSM Notify vendor of device problem and serial number Return device in tamper evident packaging to vendor address using secure ...


6

Creating a certificate is NOT signing the CSR, or even the CSR body. You need to create a cert body containing data that is partly the same as the CSR and partly different, and sign that. First, do you have a CA cert (root or otherwise) matching the key in your HSM? If not, any cert(s) you do manage to create with that key won't be useful because software ...


5

This is most likely confidential, so I bet you won't get a 100% answer to this one. However, we know PayPal are PCI-DSS compliant. This means they are compliant with 3.4 in the standard, which states: "Render PAN unreadable anywhere it is stored". That means with a probability of at least 99% that they store the credit card numbers encrypted. It is possible ...


5

OK, these are a lot of questions for one answer, and I think I can probably only hit two of them.. but here it goes: FIPS 140-2 Level 2 The FIPS 140-2 requirements are centered around how keys are managed, protected, manipulated and stored. For reference, I'm reading the Security Requirements from the NIST site. What I'm seeing is that in the transition ...


5

Your question seems peculiarly obscure to me, so I'll write here some explanation about the meaning of the terms you employ, under the hope that it will reduce confusion and lead to either an answer or at least a clearer question. PKCS#11 is an Application Programming Interface: it is a set of functions, that applications use, and that are provided by a ...


5

[Disclaimer: I'm a developer on a FIPS 140-2 Level 2 software module, and I'm a little disgruntled about the whole process] The main difference I've seen is that things that are FIPS 140-2 certified are at least 6 months out of date when you get them, and cannot be patched in the case of a vulnerability. Getting something FIPS / CC certified costs $$$, ...


5

This can be accomplished in many ways. The most simple access control to a HSM is a physical button. So if a malware compromises the host computer, somebody still needs to be physically present to push the button for the HSM to do anything. Then you have a whole range of different access protection, ranging from verifying the software in the host server "...


4

You could, instead of hashes, use a MAC. That's a kind of hash function except that it uses a secret key, which is needed to recompute it. You would store the key in the HSM. The HSM would be needed to verify the password; if an attacker steals your database, he still cannot run a dictionary attack. This kind of scheme is sometimes called peppering and a HSM ...


4

A complete solution in the context of HSM must be HSM-specific because you do not want any piece of secret to ever go through the RAM of a PC, let alone its hard disk. The HSM should include a smart card reader, or establish a secure tunnel (encrypted and authenticated, à la SSL) with a hardware module which includes a smart card reader. The host PC, for a ...


4

I've never done this before. But here are some suggestive pointers. These points are NOT concrete steps to get it working. From the documentation for the new AWS CloudHSM (not classic) offering: Setup CloudHSM and generate private key using the CLI utility. Install and configure the CloudHSM OpenSSL library. Check if engine works openssl engine -t cloudhsm ...


4

Some HSM are configurable enough to allow adding functionality within the HSM. However, this will not be doable through PKCS#11, which is an API meant for invocation of cryptographic algorithm on externally provided data. What PKCS#11 offers and is closest to your problem is C_UnwrapKey() that can take as input an encrypted key (key is encrypted with another ...


4

Yeah, don't. That is to say, don't assume you will be storing 1m+ keys on an HSM, regardless of who made it. HSMs are not hard drives. Don't use them like one. Some HSMs support external keys. These are keys which are encrypted/wrapped using a specific AES-256 (for example) key, derived from some other key. This 'master' key derivation key remains in ...


4

I was hoping there were best practices available from some reputable source. Lacking that, I am posting this as a suggestion, and welcome any input on it. Methods for secure key storage in embedded devices depends on the threat scenario. Threat scenario 1: Both remote and physical attacks. Threat scenario 2: Only remote attacks. ------------ The best ...


4

Hardware Security Modules's (HSM's) are used in systems where a company has determined that the risk involved requires a higher level of control that a personal key. The Use of HSM's for Certificate Authorities HSM's are common for CA applications, typically when a company is running there own internal CA and they need to protect the root CA Private Key, ...


Only top voted, non community-wiki answers of a minimum length are eligible