I have an application that does RSA hybrid encryption/decryption – i.e., messages are encrypted with a fresh AES key, which is then itself encrypted with RSA-OAEP and sent with the message. Decryption then does the reverse.
I want to now provide support for hardware security modules (HSMs) via PKCS#11. (The application is written in Java, so this will actually be via some wrapper such as the default SunPKCS11 library). I can see two options for implementing decryption:
- Use the HSM to decrypt the temporary AES key and return the raw bytes of that key to my application, which then does the AES decryption in-memory.
- Use the HSM to “unwrap” the AES key as a (sensitive) session object and then use the HSM to perform the AES decryption.
My instinct is that option 1 will generally be faster than option 2 on a server with AES-NI instructions. As the AES keys are unique to each message, it also doesn’t seem less secure - the AES key is therefore no more sensitive than the message itself.
Are there any reasons to prefer option 2? My only thought is that if a customer has spent a lot of money on a FIPS-compliant HSM then they may want all crypto to be performed on the device for compliance reasons. Is that a likely scenario?