Download Syllabus

HSM Security: Risks, Attacks and Mitigations
Training Course by Cryptosense
Venice, 16-17 March 2015
Audience
Security/Risk Managers, Pen-testers, Security Auditors.
Required background
The course is for professionals working in, or having familiarity with, enterprise IT security. Some familiarity with
applications using cryptography is required.
Course Syllabus
1. Introduction to secure cryptographic hardware
We briefly introduce cryptography and the idea of enforcing security through hardware accessed via a
security API. We give an overview of real attacks on Hardware Security Modules (HSMs).
•
•
•
•
•
•
•
Basic cryptography reminder
Typical cryptographic applications - PKI, VPN, Encrypted storage/backup, Payments..
Some specific cryptographic mechanisms
Security APIs and Trusted Computing Base
History of HSM attacks
Diginotar
RBS Worldpay
2. Security of cryptographic hardware
We discuss hardware security and certification. We also illustrate how secure hardware can be used to
protect cryptographic keys and operations. We discuss the role of middleware for secure hardware.
•
•
•
•
•
Physical Protection
Certification (FIPS, CC, …)
Roles of keys (properties and attributes)
Basic key management with practical examples
Middleware: where is the API implemented?
3. Cryptographic Interfaces
We describe the main structure and features of various real APIs for cryptographic devices. We illustrate
them through simple running examples that point out similarities and differences. We show that, in some
cases, different APIs can be used to access the same key leading to ambiguous situations. We demonstrate
using real hardware and simulators.
•
•
•
•
•
•
1/2
PKCS#11
Microsoft CAPI and CNG
OpenSSL
Thales financial
IBM CCA
Proprietary APIs (an overview)
Course Syllabus - Venice 16-17 March 2015
4. HSM attacks
We describe attacks on Hardware Security Modules (HSMs) of different kinds: API level, cryptographic,
infrastructural. We demonstrate attacks using real hardware and simulators.
• Exploiting HSM firmware implementation errors
• API configuration problems
• PKCS#11 management attacks
• How to make PKCS#11 secure?
• Financial APIs: the PIN cracking case study
• HSM Application flaws - how application errors negate HSM security
• Attacks on cryptography (implementation issues, side channels, …)
• Cracking a 1024-bits RSA ciphertext in 10 minutes - how the high-speed cryptography of an HSM
can be exploited to aid cryptanalytic attacks on HSM keys
• Attacks on encrypted key import
• HSM infrastructure attacks
• Accessing internal networks
5. Mitigations and fixes
We discuss mitigations to attacks. We discuss existing techniques and state-of-the-art tools to provide the
highest possible level of security. We demonstrate on real hardware and simulators.
•
•
•
•
•
•
•
•
•
Analysis of PKCS#11 devices: Cryptosense analyzer
Hardening configurations
Best practice key-management
Profiling HSM usage: how to detect an attack in progress
State-of-the-art tools:
Monitoring configurations
Intrusion detection
Review of HSM use by applications
Detection of key compromise, recovery
Logisitics
2/2
Venue
Ca' Foscari Alumni room, Calle Larga Foscari, 3246 Dorsoduro, Venezia VE
Hotels Wide variety in surrounding area to suit all budgets
Dates
16-17 March, 2015
Cost $3000 per person ($2500 tickets available until 31stJanuary 2015)

Download Report