Collaborate Disseminate
I’m trying to figure out how to generate private key for the Root CA according the principles of WebTrust.
One additional requirement I have that the generate private key should be then imported to any HSM, independent of th… Continue reading Root CA key generation compliant with WebTrust and HSM independent
I work on a payments system. So DUKPT keys are a must-have requirement. In most cases PIN and Card data are encrypted using DUKPT keys. However, every time we have checked with AWS, we have found that none of the HSMs avai… Continue reading Managing DUKPT keys in AWS cloud
Basic Assumptions
Let us assume I work for a company, which aims to authenticate users using traditional usernames and passwords. The company currently uses a slow key-derivation function to hash passwords, such as Argon2, s… Continue reading Does the use of a Hardware Security Module improve the security of a password storage?
I am trying to connect with some HSM cloud service using a specific url:port provided by the service vendor. The connection works fine if CAfile is omited from the syntax of the s_client -connect command. However, when includ… Continue reading Line jump with openssl s_client -connect command when using CAfile
I have some private keys stored on the HSM but without public keys. I want to get the corresponding public key using PKCS11 interface.
If the private key is a RSA key, I can extract the modulus from CKA_MODULUS and exponent … Continue reading How to get public key from private key stored in HSMs [migrated]
French researchers have found a bug in a hardware security module (HSM) that could enable an attacker to steal highly prized secrets. Continue reading Researchers crack digital safe using HSM flaw
If I have AES256, RSA4K and ECDSA-512 keys as CEKs, which I need to securely store, what KEK can I use to securely wrap these without reducing the bit strength? I am aware that an AES256 key can wrap RSA4K without reducing t… Continue reading Which KEK can wrap AES, RSA and ECDSA keys securely?
I’ve been building a product using AWS CloudHSM and things are working well in the POC.
Now I want move to production, I’ve realised that there will be a need to authenticate with the HSM in order to have it sign messages with private key… Continue reading HSM best practice for access
What are the differences between a Hardware Security Module (HSM) and a Secure Element (SE)? Can both terms be used interchangeably?
I came across various related question (TPM vs. HSM and TPM vs. SE) but the various HSM and SE definition… Continue reading What are the differences between HSM and SE?
My question is in general but related to Oracle DB. I have a single table with different companies as rows. Each row has company id and company registration number. I would like to encrypt company registraiton number, but i w… Continue reading TDE – Encrypting different rows with different keys