6 ms·

>but stealing a key only takes a pencil and a piece of paper. You need to have a serious discussion with your HSM vendor if that is the case.

brezelgoring 4y ago
A theoretical piece of paper and pen
patmcc 4y ago
Getting to it might be very, very hard. But once it's in your hand you've got it. Diamonds can found as you're leaving the building, or you can be stopped at the airport, or the big pile in your house can be found, etc. A signing key is like, 4096 bits at most? 4 sms messages will do it.
- NovemberWhiskey 4y ago
  So the plan is to ... what ... break the physical security precautions of the HSM during a burglary and then leave without the operator noticing? When I say "break the physical security precautions" that typically involves things like grinding open the casing, depotting the innards, avoiding trigger the self-zeroing mechanism etc etc. and doing so while avoiding the anti-tamper sensors.
  - sgjohnson 4y ago
    The threat is more of an insider one, and the human element is always the weakest link in the chain.
  - Xelynega 4y ago
    I think their point is that it's easier because you don't need to do the "leave without the operator noticing" that you need to for physical items. Once you have access to those 4096 bits you don't have to escape with them, you just need to transmit 4 sms messages.
    - klodolph 4y ago
      An HSM is going to make that difficult. The whole point of an HSM is that you can’t get the key from the HSM, you can only take the entire HSM with you. Of course it is possible to read a key from an HSM, it’s just designed to be incredibly difficult. I don’t think I would be able to do it, at all, even if I could bring the HSM home with me for a couple weeks.
      - banana_giraffe 4y ago
        And in the case of the HSMs I've dealt with, just taking it home is enough to render it useless without some incredibly specific and difficult precautions.
    - bad416f1f5a2 4y ago
      Are you familiar with the threat model an HSM is designed to counter?
  - MichaelBurge 4y ago
    Or have a corporate spy join the security team 3 years prior, and do just one subtle thing? The Googles and Apples of the world are probably safe against even their own people, but do you trust Tracfone?
    - bad416f1f5a2 4y ago
      No hand waving: what “one subtle thing” will this insider do to make this attack possible? I’m guessing FIPS 140-2 has already thought about it. HSMs are hardened against individual bad actors. Their threat model envisages the presence of nation state actors. Is it possible that an HSM attack happened here? I wouldn’t bet on it.
  - patmcc 4y ago
    If the key is located only in the HSM, and there are no known flaws in the HSM, yep, that's a hard nut to crack, I'm not going to claim I could do it. But given enough resources, with time and planning and insiders? Take a look at https://cryptosense.com/blog/how-ledger-hacked-an-hsm https://cryptosense.com/blog/how-ledger-hacked-an-hsm - and that's a remote attack.
gjsman-1000 4y ago
Are they though? I doubt that Apple, or Xbox, or PlayStation, use HSMs for storing their most sensitive keys. If something goes wrong with the HSM, can you recover the keys, or did you just bork your update system forever? In which case, does the key exist outside the HSM? If it only exists on multiple HSMs, how is it protected in transit between them, and is that vulnerable?
- akerl_ 4y ago
  This is why they make backup HSMs.
- saagarjha 4y ago
  I know that at least some of those companies use HSMs. Multiple, actually.
- NovemberWhiskey 4y ago
  That's why your HSM supports, for example, the ability for an appropriate entitled crypto officer to export the private key onto multiple different smart cards for separate custody with M of N required to restore the key, and all that other good stuff.
  - gjsman-1000 4y ago
    Right... but at the same time, does that mean that if I break into the homes of Phil Schiller, Tim Cook, Craig Federighi, Greg Joswiak, Jeff Williams, and Johny Srouji and steal their keys, that I could reassemble the key that would normally be stored on a HSM in Apple Park? In some ways attacking the homes might be easier than attacking Apple Park. (Just thinking out loud...)
    - NovemberWhiskey 4y ago
      Assuming that you also can get those people to disclose the eight-digit PINs that were required by the crypto officer at the time the custodians enrolled their smart cards?
gjsman-1000 4y ago
In 2019, Ledger investigated their HSMs, and got it to the point where they achieved a persistent backdoor. On the HSM. Because the HSM they targeted didn’t actually have working Secure Boot(!). It was also FIPS-certified if that comforts you. https://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybody-Be-Cool-This-Is-A-Robbery.pdf https://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybo... Better hope Apple didn’t use that one - and that they regularly apply updates… odds of Apple trucking along with a several-year-old HSM don’t seem that low…
- saagarjha 4y ago
  I don't believe they do.
- NovemberWhiskey 4y ago
  "only takes a pencil and a piece of paper" The attacker: - controls the host - can communicate with the PCI card
  - gjsman-1000 4y ago
    I wasn't saying you could just steal it as though it was on paper - you'd need to run terminal commands on even the least-secured system. I'm more talking about how, if you were an insider at a company (or managed to sneak in), you could potentially attack the HSM on-premises and dump the key, then smuggle it out with pencil and paper instead of having to sneak out the entire HSM (which would be quite bulky, likely to be detected as stolen)... If Apple was using that HSM model (which is only FIPS-2 Level 3, which is still bad but maybe not as secure as a FIPS-4 they would use), an employee could potentially acquire a similar model at home, discover the vulnerabilities, and then exploit it on-premesis under the guise of a firmware update or maintenance. After that, jot the key down on an index card and put the HSM back like nothing happened. Sleep on it for 3 years so nobody remembers, and then wreak havoc.
    - NovemberWhiskey 4y ago
      OK, but even then ... an offline root CA should be powered down and locked inside a safe. An online CA should be inside a data-center that has specific staff with badge access, audit trails, surveillance video and probably be in its own separately locked cage.

brezelgoring 4y ago

A theoretical piece of paper and pen

patmcc 4y ago

Getting to it might be very, very hard. But once it's in your hand you've got it. Diamonds can found as you're leaving the building, or you can be stopped at the airport, or the big pile in your house can be found, etc. A signing key is like, 4096 bits at most? 4 sms messages will do it.

NovemberWhiskey 4y ago
So the plan is to ... what ... break the physical security precautions of the HSM during a burglary and then leave without the operator noticing? When I say "break the physical security precautions" that typically involves things like grinding open the casing, depotting the innards, avoiding trigger the self-zeroing mechanism etc etc. and doing so while avoiding the anti-tamper sensors.
- sgjohnson 4y ago
  The threat is more of an insider one, and the human element is always the weakest link in the chain.
- Xelynega 4y ago
  I think their point is that it's easier because you don't need to do the "leave without the operator noticing" that you need to for physical items. Once you have access to those 4096 bits you don't have to escape with them, you just need to transmit 4 sms messages.
  - klodolph 4y ago
    An HSM is going to make that difficult. The whole point of an HSM is that you can’t get the key from the HSM, you can only take the entire HSM with you. Of course it is possible to read a key from an HSM, it’s just designed to be incredibly difficult. I don’t think I would be able to do it, at all, even if I could bring the HSM home with me for a couple weeks.
    - banana_giraffe 4y ago
      And in the case of the HSMs I've dealt with, just taking it home is enough to render it useless without some incredibly specific and difficult precautions.
  - bad416f1f5a2 4y ago
    Are you familiar with the threat model an HSM is designed to counter?
- MichaelBurge 4y ago
  Or have a corporate spy join the security team 3 years prior, and do just one subtle thing? The Googles and Apples of the world are probably safe against even their own people, but do you trust Tracfone?
  - bad416f1f5a2 4y ago
    No hand waving: what “one subtle thing” will this insider do to make this attack possible? I’m guessing FIPS 140-2 has already thought about it. HSMs are hardened against individual bad actors. Their threat model envisages the presence of nation state actors. Is it possible that an HSM attack happened here? I wouldn’t bet on it.
- patmcc 4y ago
  If the key is located only in the HSM, and there are no known flaws in the HSM, yep, that's a hard nut to crack, I'm not going to claim I could do it. But given enough resources, with time and planning and insiders? Take a look at https://cryptosense.com/blog/how-ledger-hacked-an-hsm https://cryptosense.com/blog/how-ledger-hacked-an-hsm - and that's a remote attack.

gjsman-1000 4y ago

Are they though? I doubt that Apple, or Xbox, or PlayStation, use HSMs for storing their most sensitive keys. If something goes wrong with the HSM, can you recover the keys, or did you just bork your update system forever? In which case, does the key exist outside the HSM? If it only exists on multiple HSMs, how is it protected in transit between them, and is that vulnerable?

akerl_ 4y ago
This is why they make backup HSMs.
saagarjha 4y ago
I know that at least some of those companies use HSMs. Multiple, actually.
NovemberWhiskey 4y ago
That's why your HSM supports, for example, the ability for an appropriate entitled crypto officer to export the private key onto multiple different smart cards for separate custody with M of N required to restore the key, and all that other good stuff.
- gjsman-1000 4y ago
  Right... but at the same time, does that mean that if I break into the homes of Phil Schiller, Tim Cook, Craig Federighi, Greg Joswiak, Jeff Williams, and Johny Srouji and steal their keys, that I could reassemble the key that would normally be stored on a HSM in Apple Park? In some ways attacking the homes might be easier than attacking Apple Park. (Just thinking out loud...)
  - NovemberWhiskey 4y ago
    Assuming that you also can get those people to disclose the eight-digit PINs that were required by the crypto officer at the time the custodians enrolled their smart cards?

gjsman-1000 4y ago

In 2019, Ledger investigated their HSMs, and got it to the point where they achieved a persistent backdoor. On the HSM. Because the HSM they targeted didn’t actually have working Secure Boot(!). It was also FIPS-certified if that comforts you. https://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybody-Be-Cool-This-Is-A-Robbery.pdf https://i.blackhat.com/USA-19/Thursday/us-19-Campana-Everybo... Better hope Apple didn’t use that one - and that they regularly apply updates… odds of Apple trucking along with a several-year-old HSM don’t seem that low…

saagarjha 4y ago
I don't believe they do.
NovemberWhiskey 4y ago
"only takes a pencil and a piece of paper" The attacker: - controls the host - can communicate with the PCI card
- gjsman-1000 4y ago
  I wasn't saying you could just steal it as though it was on paper - you'd need to run terminal commands on even the least-secured system. I'm more talking about how, if you were an insider at a company (or managed to sneak in), you could potentially attack the HSM on-premises and dump the key, then smuggle it out with pencil and paper instead of having to sneak out the entire HSM (which would be quite bulky, likely to be detected as stolen)... If Apple was using that HSM model (which is only FIPS-2 Level 3, which is still bad but maybe not as secure as a FIPS-4 they would use), an employee could potentially acquire a similar model at home, discover the vulnerabilities, and then exploit it on-premesis under the guise of a firmware update or maintenance. After that, jot the key down on an index card and put the HSM back like nothing happened. Sleep on it for 3 years so nobody remembers, and then wreak havoc.
  - NovemberWhiskey 4y ago
    OK, but even then ... an offline root CA should be powered down and locked inside a safe. An online CA should be inside a data-center that has specific staff with badge access, audit trails, surveillance video and probably be in its own separately locked cage.