Re: [TLS] TLS and hardware security modules - some issues related to PKCS11

[Michael StJohns <[e-mail]>]

On 9/17/2013 8:49 AM, Martin Rex wrote:
> I fail to understand what you're trying to protect.
>
> The master secret of a session is never a secret that is hidding
> within the hardware module, instead, it is something known to the
> calling TLS protocol stack and part of the TLS session cache.

Um.  No, not if you designed things properly.  It should be possible for 
any protocol the IETF designs to do all the crypto operation inside a 
hardware module and not depend on the weak security of a general purpose 
computer.

I want to protect inside of the HSM all of the following:

a) the private keys related to the server or client identity
b) the pre-master key
c) the master key
d) the session keys.

I want to be able to do all the cryptographic processing inside that 
module and only allow out true plain text.

> For vanilla RSA cipher suites, it is deterministically derived
> from randomness generated by the client and conveyed under
> RSA encryption, deterministically combined with data known
> in plain to the TLS protocol stack.

I think you're talking about the pre-master secret?  If so, yes, but 
so?  The encrypted pre-master secret goes to the HSM where it's 
decrypted, run through a KDF and used to produce the master secret. 
Ideally, that master secret may be retained within the HSM and protected 
from disclosure.

Later, Mike

>
> -Martin