Certificate Authorities normally keep their private keys inside dedicated Hardware Security Modules (HSMs).

What happens when such a device is lost (fire, electronic fault, stolen, etc)?

How would that affect a big, established CA such as Comodo?

EDIT: I have seen the question about the key being compromised (see comments below), but my question is about the key becoming inaccessible.

  • $\begingroup$ Related: crypto.stackexchange.com/questions/11714/… $\endgroup$ – Daniel Feb 3 '18 at 18:49
  • $\begingroup$ @Daniel, I have seen that question. However, it deals with the situation of a key being compromised instead of lost. A compromised key can be revoked, while a lost one can't. $\endgroup$ – Mark Feb 3 '18 at 18:56
  • 1
    $\begingroup$ A compromised Root CA can't be revoked. Who'd sign the CRL? $\endgroup$ – garethTheRed Feb 3 '18 at 20:14

What happens when such a device is lost (fire, electronic fault, stolen, etc)?

Assuming the HSM is stolen: The CA will likely inform the police so they can hunt the thief down, then they will ensure that the thief has actually only stolen a brick (that is, they can't do anything useful with the HSM) and finally they will just continue business as usual and maybe inform the CA/B mailing list about this incident.

Assuming the HSM is no longer available to other reasons: The CA will ensure that the key material inside the HSM is no longer retrievable and then give it into the trash.

In either case: The CA will likely acquire a new HSM (or a new set of HSMs) and restore the key material from the other HSMs they have and import it into the new HSM(s). That's the big difference between HSMs and smart cards: With smart cards you usually can't get the key out at all. With HSMs you can get encrypted copies out of the HSM that can be read and used by other HSMs of the same type, given that they have been initialized in the same way. Also decent CAs will have their root keys at at least 2 different physical locations, exactly to deal with this type of scenario.

| improve this answer | |
  • 2
    $\begingroup$ TL;DR: They do what any sane company should be able to do in a similar case: They restore from backups. $\endgroup$ – SEJPM Feb 3 '18 at 21:05
  • 1
    $\begingroup$ How do you "ensure the thief has only stolen a brick"? $\endgroup$ – Paŭlo Ebermann Feb 3 '18 at 22:07
  • 1
    $\begingroup$ @PaŭloEbermann HSMs require authentication from the operator before they allow operation with the secret key material (e.g. authentication with smart-cards). Assuming you have a well-documented inventory list (and / or authentication is knowledge-based), you can ensure that the thief did not also steal the required authentication material, in which case the HSM will do what it does best: not work and not hand out key material and essentially be a really expensive brick. $\endgroup$ – SEJPM Feb 3 '18 at 22:27
  • $\begingroup$ This answer completely ignores the situation where the thief is able to use the HSM to generate signatures, allowing them to create certificates as if they were the CA, compromising the security of the web. $\endgroup$ – marcelm Feb 3 '18 at 23:21
  • 5
    $\begingroup$ @marcelm the OP explicitely asked about the HSM being lost and not compromised, so yes, it's indeed intentionally ignoring compromise-related consequences. $\endgroup$ – SEJPM Feb 3 '18 at 23:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.