hardware security module hsm

**Hardware Security Module and Secure Enclave: Cryptographic Key Storage with Physical Attack Resistance — dedicated security processor protecting sensitive keys and attestation against both logical and physical attacks** **Hardware Root of Trust (RoT)** - **RoT Definition**: immutable boot code stored in mask-ROM (read-only memory), known-good integrity established at power-up before any mutable code execution - **RoT Verification**: ROM contains secure bootloader that verifies next-stage firmware hash (SHA-256/3), prevents malicious OS/hypervisor boot - **Zero-Trust Model**: assume all mutable code potentially compromised, RoT authenticates boot chain (bootloader → firmware → kernel) - **Measurement and Attestation**: RoT measures system state (firmware hashes, configuration) in Platform Configuration Registers (PCRs), enables remote attestation **TPM 2.0 (Trusted Platform Module)** - **Cryptographic Keys**: storage for symmetric (AES encryption keys, TPM key hierarchy) + asymmetric keys (RSA 2048/3072 or ECC P-256) - **Key Hierarchy**: endorsement key (EK), storage root key (SRK), attestation key (AK), each encrypted under parent key, only TPM decrypts - **PCR Registers**: 24 PCRs store cryptographic hashes (SHA-256 default), updated during boot (measure firmware → hash → extend PCR) - **Sealing**: encrypt data tied to specific PCR values, data unseals only if system in known-good state (prevent offline attacks) - **Quote Operation**: TPM signs current PCRs + nonce with AK, proves boot-time measurements to remote verifier (attestation) **Secure Enclave Design** - **Apple SEP (Secure Enclave Processor)**: dedicated ARM processor (M4 core) isolated from main CPU + OS, stores biometric templates + encryption keys - **ARM TrustZone**: ARM extension enabling secure/normal world execution states, hardware MMU/TLB separation, secure interrupts - **AMD PSP (Platform Security Processor)**: Cortex-A5 processor handling platform security (IOMMU control, memory encryption SME), boots before main x86 - **Intel SGX (Software Guard Extensions)**: enclave execution (small trusted code region), enclave memory encrypted (MEE: memory encryption engine) **Physical Attack Countermeasures** - **Active Shield Mesh**: conductive mesh covering chip surface, detects probe/drilling attempts, triggers tamper response (erase keys, shutdown) - **Voltage/Temperature Sensors**: detect power glitch (voltage drop) or thermal attack (liquid nitrogen), initiates tamper response - **Glitch Detection**: sudden clock frequency anomaly (fault injection attempt), protective circuits disable execution - **Electromagnetic (EM) Shielding**: Faraday cage around secure region, prevents EM probing of signal lines - **Power Analysis Resistance**: smooth power consumption (add dummy operations), prevent power side-channel from revealing secret information **Side-Channel Attack Countermeasures** - **AES Masking**: split key into random shares (key = k1 XOR k2 XOR ...), prevent direct key observation via power/timing - **Constant-Time Implementation**: avoid data-dependent branches (if plaintext == key), prevent timing side-channel revealing key bits - **Dummy Operations**: add fake memory accesses / cache fills to mask access pattern (prevent cache timing attacks) - **Randomized Execution**: randomly interleave operations (prevent attacker from synchronizing power measurements) **HSM (Hardware Security Module) Specifications** - **FIPS 140-3 Level 3**: physical security (active shield, tamper detection), logical security (key wrapping, separation), audit trail - **Cryptographic Algorithms**: AES-256, RSA 4096, ECDSA, SHA-256/3, HMAC, random number generation (NIST DRBG) - **Key Storage**: N/A keys stored encrypted (master key in tamper-proof storage), extracted keys in secure memory with restricted access - **Command Interface**: Ethernet or USB interface (for appliances), host sends operations (encrypt, decrypt, sign, verify), HSM executes, returns result **Attestation Workflow** - **Local Attestation**: software on device challenges TPM/SEP, receives signed proof of system state (PCR values), verifies locally - **Remote Attestation**: device sends signed measurements to remote service (cloud), service verifies signature (device public key), checks acceptable state - **Supply Chain Verification**: remote service verifies device authenticity (certificate chain from manufacturer), prevents counterfeit devices **Secure Key Generation and Storage** - **TRNG (True Random Number Generator)**: entropy from physical source (thermal noise, oscillator jitter), not deterministic, suitable for cryptographic keys - **Key Derivation**: master key + salt → derived keys for different purposes (encryption, signing, authentication), PBKDF2 or HKDF - **Zeroization**: when key no longer needed, overwrite storage (multiple passes, NIST SP 800-88 guidance), prevent key recovery from discarded devices **Threats and Mitigations** - **Side-Channel Attacks**: power analysis, timing attack, cache attack, mitigated via constant-time implementation + masking - **Fault Injection**: glitch attack (voltage drop), electromagnetic pulse (EMP), mitigated via glitch detection + redundant execution - **Probing Attacks**: direct access to memory/registers via micro-probe, mitigated via shield mesh + tamper detection **Trust Anchors in Modern Systems** - **Mobile (iOS/Android)**: secure enclave + TPM, biometric + password authentication, full disk encryption - **Enterprise**: TPM 2.0 (Windows, Linux), hardware security keys (FIDO2 USB), enterprise HSM for key management - **Cloud**: tenant isolation (AMD SEV memory encryption), secure boot attestation (vTPM virtual TPM) **Future Directions**: formal verification of secure enclave code (eliminate software bugs), post-quantum cryptography (HSM support for PQC), standardized secure boot (UEFI Secure Boot + TPM 2.0 ubiquitous).