Questions tagged with AWS CloudHSM

I am testing out the cloudhsm and setting it up on a EC2 Win2019 server. I get the following error when I run the cloudhsm mgmt util to connect the server to the cloud HSM: ``` PS C:\Program Files\Amazon\CloudHSM> .\cloudhsm_mgmt_util.exe C:\ProgramData\Amazon\CloudHSM\data\cloudhsm_mgmt_util.cfg Ignoring E2E enable flag in the configuration file Connecting to the server(s), it may take time depending on the server(s) load, please wait... Connecting to server '172.xx.xx.xx': hostname '172.xx.xx.xx', port 2225... Connected to server '172.xx.xx.xx': hostname '172.xx.xx.xx', port 2225. C:\ProgramData\Amazon\CloudHSM\customerCA.crt, partition owner certificate not exist at given path Server 0(172.xx.xx.xx) is in unencrypted mode now... running in limited commands mode Error: partition owner certificate doesn't exist at given path. Failed to create client ssl ctx E2E Session failed: E2E setup failed Enabling E2E failed aws-cloudhsm>quit disconnecting from servers, please wait... PS C:\Program Files\Amazon\CloudHSM> ls Directory: C:\Program Files\Amazon\CloudHSM Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 6/2/2022 2:17 PM tools -a---- 12/30/2021 8:47 PM 18019 client_info -a---- 12/30/2021 9:18 PM 5475875 client_info.exe -a---- 12/30/2021 9:16 PM 2680320 cloudhsm_client.exe -a---- 12/30/2021 8:47 PM 24373 CLOUDHSM_LICENSE -a---- 12/30/2021 9:16 PM 2541056 cloudhsm_mgmt_util.exe -a---- 12/30/2021 9:16 PM 10240 cng_config.exe -a---- 12/30/2021 9:17 PM 5489038 configure.exe -a---- 6/2/2022 2:18 PM 1416 CustomerCA.crt -a---- 12/30/2021 9:17 PM 188416 import_key.exe -a---- 12/30/2021 9:17 PM 1641472 key_mgmt_util.exe -a---- 12/30/2021 9:16 PM 10240 ksp_config.exe -a---- 12/30/2021 9:17 PM 1417216 pkpspeed_blocking.exe PS C:\Program Files\Amazon\CloudHSM> ``` I have copied as per the manual the self signed root ca I created to sign the HSM cluster when initializing.. not sure what this partition certificate error is.

Are AWS services assigned IAM roles that allow them to access the CloudHSM API....and then use the CloudHSM client Crypto User account to complete their task encrypt/decrypt task? If no, how does an AWS service access CloudHSM? If unlike, AWS KMS, lots of services do not integrate with CloudHSM, how do they use it? Or, do only a few services use CloudHSM while the ones that integrate with Cloud KMS go that route? Is anyone aware of list of services that integrate with CloudHSM? I've been researching this for two days.

My understanding is, Private Key should never leave HSM cluster. HSM-Client should pass key-handle, Mechanism and payload to the HSM-Server and HSM-Server should encrypt or sign the payload and give it back to the HSM-Client. But the [examples in the official documentation](https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-samples_5.html) generates KeyPair and use actual PrivateKey to encrypt. Please let me know if my understanding is correct and point me to some **Java example** where encryption and signing happens on HSM-Server and not on HSM-Client

Hello, Basically, as I understand it, physical HSMs are managed by a team of people who have physical key to reset the HSM itself. That is, these people, let's say there are 3 of them, have 3 keys and each of them is needed to start or reset the HSM. In the cloud, however, for example with Amazon's CloudHSM, how does this happen? Why can't Amazon take the content in our CloudHSM? This team of people doesn't exist, so they still have full control of our encryption keys. Who has the CloudHSM primary key? Am I right? What am I missing? Thank you very much

Hello there, I do have a requirement in my application to encrypt and decrypt data using a symmetric key algorithm (mostly AES/CBC/PKCS5Padding). CONSTRAINT and Requirements are 1. I need to use FIPS 140-2 Level 3 compliant key storage solution 2. This is an existing encrypted data and hence I should be able to import my existing keys (plain keys) to whatever solution I use. 3. Even in the future, keys should be open for EXPORT so that encrypted data with this new solution WILL NOT require another re-encryption with new keys. Keeping the above points in mind, I came across below solutions so far and need guidance and help if someone finds that not a good solution or it will break any of the above requirements I listed. 1. I can use AWS Encryption SDK with AWS KMS using a custom key store where the custom key store would be my own Cloud HSM. 2. I can directly use Cloud HSM by leveraging standard Cloud HSM integration using Cloud HSM JCE provider and client SDK. 3. I can AWS KMS with KMS API with a custom key store where the custom key store would be my own Cloud HSM. I knew #2 will work without breaking any of my requirement and compliance list but I want to see if I can use Encryption SDK and/or KMS for my use case as I can get help of SDK to choose best industry practices to write cryptography code instead of I write whole code (in case of Cloud HSM integration) but below points will stop me. 1. Custom key stores can not work with imported keys so it will break my requirement #2. 2. I can use AWS Encryption SDK with KMS but as import does not work for custom key stores, it's not usable any more. Can I use AWS Encryption SDK somehow to help me with data encryption directly with Cloud HSM? 3. Data enveloper protection (by AWS Encryption SDK) is really more secure for symmetric key encryption. If I use that today and later want to move to Cloud HSM, will it break the decryption flow? Any suggestion/experience learning/insights or architectural direction is greatly appreciated.

Hi, I am trying to use Cavium in a Java application for two-way SSL handshake. My application is the client application. However when the application runs, the client handshake fails with the following exception: 2022-02-21T18:30:39.152Z java.lang.RuntimeException: com.cavium.cfm2.CFM2Exception: A call to the API getRSAPrivateKeyComponents for size failed with error code ffffffff : Error: new error from underlying FW/SW, might need to upgrade to new SW to decode 2022-02-21T18:30:39.152Z at com.cavium.key.CaviumRSAPrivateKey.populateKeyComponents(CaviumRSAPrivateKey.java:154) 2022-02-21T18:30:39.152Z at com.cavium.key.CaviumRSAPrivateKey.getPrimeP(CaviumRSAPrivateKey.java:82) 2022-02-21T18:30:39.152Z at sun.security.rsa.RSACore.crtCrypt(RSACore.java:168) 2022-02-21T18:30:39.152Z at sun.security.rsa.RSACore.rsa(RSACore.java:122) 2022-02-21T18:30:39.152Z at sun.security.rsa.RSAPSSSignature.engineSign(RSAPSSSignature.java:371) 2022-02-21T18:30:39.152Z at java.security.Signature$Delegate.engineSign(Signature.java:1382) 2022-02-21T18:30:39.152Z at java.security.Signature.sign(Signature.java:698) 2022-02-21T18:30:39.152Z at sun.security.ssl.CertificateVerify$T12CertificateVerifyMessage.<init>(CertificateVerify.java:608) 2022-02-21T18:30:39.152Z at sun.security.ssl.CertificateVerify$T12CertificateVerifyProducer.produce(CertificateVerify.java:760) 2022-02-21T18:30:39.152Z at sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:421) 2022-02-21T18:30:39.152Z at sun.security.ssl.ServerHelloDone$ServerHelloDoneConsumer.consume(ServerHelloDone.java:182) 2022-02-21T18:30:39.152Z at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377) 2022-02-21T18:30:39.152Z at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444) 2022-02-21T18:30:39.152Z at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422) 2022-02-21T18:30:39.152Z at sun.security.ssl.TransportContext.dispatch(TransportContext.java:182) The application adds CaviumProvder at start-up: Security.addProvider(new com.cavium.provider.CaviumProvider()); My client application also attempts to sign a message using "NONEwithRSA" at the start of the application and successfully verifies the signing using the same key alias. I have also verified that the user my application is using to authenticate towards CloudHSM is of type CU (Crypto User). The CloudHSM jar file is cloudhsm-3.1.0.jar. Please help.

I am assuming that when you follow the steps to use "TLS client-server mutual authentication," the default key can still be used. * Is it possible to **only** allow "TLS client-server mutual authentication" connections to an HSM? * In other words, can we disable connections where the client uses the default ssl key? * Is there any difference in authorization between a session on a "TLS client-server mutual authentication" ssl connection and a session on a default key ssl connection? * If not, why would someone bother to use a trust-anchor-signed ssl key if anyone can make an equally authorized session with the default key? Background: > https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started-ssl.html > AWS CloudHSM uses an SSL certificate to establish a connection to an HSM. A **default** key and SSL certificate are included when you install the client. You can, however, create and use your own. Note that you will need the self–signed certificate (customerCA.crt) that you created when you initialized your cluster. > ... > To use a custom certificate and key for **TLS client-server mutual authentication** with Client SDK 5 on Linux

Can an application be architected so that it leverages CloudHSM clusters in multiple regions (at least 2)? Possibly by using the cross-region replication/cloning so data can be decrypted in both regions if needed. Assumption is that CloudHSM enveloping keys do not have a region affinity much like KMS CMKs.

I understand DocumentDB supports SSE via KMS (1 key per cluster). However, does it support client-side encryption or the AWS encryption SDK?

Hi, I'm trying to issue RSA key pairs on AWS CloudHSM with a JAVA application using IAIK PKCS#11 Wrapper and JVM JCE Provider and I'm facing some difficulties. Indeed, for now, the only way to generate a keypair is providing minimal templates for both public and private key: RSAPublicKey rsaPublicKeyTemplate = new RSAPublicKey(); RSAPrivateKey rsaPrivateKeyTemplate = new RSAPrivateKey(); // Modulus rsaPublicKeyTemplate.getModulusBits().setLongValue(new Long(keyLength)); // Public exp byte\[] publicExponentBytes = {0x01, 0x00, 0x01}; rsaPublicKeyTemplate.getPublicExponent().setByteArrayValue(publicExponentBytes); All other tries I made for customizing fail with the PKCS#11 error CKR_TEMPLATE_INCONSISTENT, for example when I try to make the generated key pair persistent: rsaPublicKeyTemplate.getToken().setBooleanValue(Boolean.TRUE); rsaPrivateKeyTemplate.getToken().setBooleanValue(Boolean.TRUE); It seems that the HSM does not understand the templates I provide... Has someone here even succeeded in using IAIK Provider or is AWS CloudHSM not compatible with this provider? Then, are we forced to use AWS JCE Provider? Thanks in advance for taking time to read my questions Eric Edited by: EricT on Jan 11, 2021 3:23 AM Edited by: EricT on Jan 11, 2021 6:51 AM

Hello, Can&#39;t launch any aws-cloudhsm-pkcs11-examples. C_Initialize() returns error code 5 (CKR_GENERAL_ERROR). What is missing? I&#39;m trying to integrate CloudHSM/PKCS11 library into existing C++ application. I started by studying official examples from https://github.com/aws-samples/aws-cloudhsm-pkcs11-examples.git. However no example is successful and stuck on C_Initialize() call. It returns error code 5 (CKR_GENERAL_ERROR). Tested on AWS Ubuntu 16.04 instance. What should be done to avoid this error? $ src/encrypt/aes_gcm --pin ... Failed to connect socket Failed to initialize $ make test 0% tests passed, 16 tests failed out of 16 $ gdb src/encrypt/aes_gcm 78 rv = funcs->C_Initialize(&args); 79 if (rv != CKR_OK) { (gdb) p rv $4 = 5

From the documentation, it seems that if you want to use TDE on Oracle on RDS, the TDE master key can be stored: - In RDS itself (Oracle Wallet) or - In ClassicHSM. Do you have any inputs on the possibility to store the TDE master key in KMS or in the new generation CloudHSM? Is it on the roadmap? Thank you in advance

Hello, What is the user of the private key used to the sign the cluster CSR ? The user guide <https://docs.aws.amazon.com/cloudhsm/latest/userguide/initialize-cluster.html> says _If you can demonstrate that you own the key, you can also demonstrate that you own the cluster and the data it contains._ _To sign into your AWS CloudHSM instance, the certificate must be present, but the private key does not. You use the key only for specific purposes such as restoring from a backup._ but <https://docs.aws.amazon.com/cloudhsm/latest/userguide/create-cluster-from-backup.html> doesn't mention the usage of private key to restore the cluster from a backup. I am a little confused with the wording here, so what does restoring from a backup mean ? Thanks Edited by: r3motecontrol on Oct 28, 2019 6:54 PM

Hello, Reading the user guides to manage keys, I see it is possible to create keys that can only be used following the M of N Access Control (e.g. in https://docs.aws.amazon.com/cloudhsm/latest/userguide/key_mgmt_util-genRSAKeyPair.html). However, it seems the generation and provision of the token with the signatures of all the users required is only done via the key management client application. Is this correct? Is there any other possibility that does not involve the interactive console based key management client? Looking into the Java library provided I don't see any class/method to manage the keys that includes anything about the M of N Access Control. Best, Jordi