3
$\begingroup$

i have a pretty straightforward question but i can’t seem to find an answer :

Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys generated in hardware “higher quality” than those generated in software?

in the sense that in software, pseudorandom number generators will be used, while in an HSM physical noise will typically be used to generate random numbers.

In that case, does it make sense to create a key in hardware then export it to be used on a server for example?

thanks

$\endgroup$

1 Answer 1

3
$\begingroup$

Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys generated in hardware “higher quality” than those generated in software?

This is not necessarily the case.

The fact that these systems are often certified to work correctly and securely does increase the likelihood of their efficacy. However, there are also FIPS certified software libraries and random number generators of modern operation systems are generally well designed nowadays.

There have been instances where smart card chips, commonly used as TPM chips, encounter difficulties in generating random numbers at startup. Implementations algorithms within smart card chips designed to expedite prime number generation have also been discovered to be flawed. Hardware doesn't always mean "good".

Expectations exist for these systems to be less susceptible to side channel attacks during creation. However, this is not always true; sometimes, the creation of RSA key pairs is excluded from certification because incorporating side channel analysis protection might require excessive time or effort.

Ultimately, the effectiveness of any system depends on the implementation.

in the sense that in software, pseudorandom number generators will be used, while in an HSM physical noise will typically be used to generate random numbers.

The likelihood is high that this noise undergoes processing, including "whitening". Without such processing, the resulting distribution may deviate significantly from a uniform distribution. Generally, a well-seeded, reputable pseudorandom number generator is more trustworthy than a direct entropy source.

For seeding, an entropy source is essential, but most server systems accumulate sufficient entropy after startup. Moreover, contemporary CPUs often feature instructions or I/O capabilities for acquiring "true" random values from an integrated entropy source.

In that case, does it make sense to create a key in hardware then export it to be used on a server for example?

Indeed, there are scenarios where this approach is beneficial, particularly when utilizing a verified, robustly randomized key pair generator. Ideally, the key remains within the hardware module though, with cryptographic operations conducted internally.

Effective key management, encompassing protection and destruction, poses significant challenges. Utilizing a TPM or HSM simplifies many aspects of this process. Employing a certified device for actual operations is advisable when the importance of key creation requires the same.

Note too that many cryptographic operations require a good RNG; that requirement is not specific to key pair generation.

$\endgroup$
4
  • $\begingroup$ Thank you so much! all clear now! $\endgroup$
    – khaled
    Commented Nov 11, 2023 at 8:24
  • 2
    $\begingroup$ Addition: I am much more confident in keys generated by software I can inspect running on hardware that I provide, than in keys generated by some hardware+software I can't inspect. Beside goof in that HW+SW that have unintentionally occurred, there is a risk of deliberately weakened keys, which is easy. NIST supervises the certification of HSMs, have rigged key generators, and sometime got caught at that. Worse, they promote complex and invalid certification methods, based on statistical tests of the output, that have let these rigged generators be certified. Draw your own conclusions. $\endgroup$
    – fgrieu
    Commented Nov 11, 2023 at 9:22
  • 2
    $\begingroup$ The probability distribution we want for keygen (and all other crypto I can think of) is uniform not normal. $\endgroup$ Commented Nov 11, 2023 at 23:54
  • $\begingroup$ @dave_thompson_085 Right you are! Adjusted. $\endgroup$
    – Maarten Bodewes
    Commented Nov 12, 2023 at 1:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.