We have a Thales HSMS and upon going into the Cipher Suite, we have the DLf3072s256mRijndael cipher. What is this cipher and how does it work?

Is this an AES encryption? What does DLf mean? what about s256m?

The only information I can find is on here

  • $\begingroup$ not an answer but its also mentioned here, it says DLf1024s160mRijndael is the Thales nShield HSM legacy cipher suite whatever that is. $\endgroup$ – Aven Desta Feb 7 '20 at 13:24
  • $\begingroup$ Ah, yes "Module protection utilises an AES 256 bit symmetric key with 128 bit security secured by the Security World module key which is stored in the HSM hardware at FIPS140-2 level 3. The module key derived from the ciphersuite: DLf3072s256mRijndael conforms to NISTSP800-131A.". If it is an unspecifed scheme and AES gets called Rijndael then Microsoft must almost certainly have been involved. It looks like a proprietary method that has been created for key transport. You probably have to feed it the other HSM's DH public key. $\endgroup$ – Maarten Bodewes Feb 7 '20 at 15:50
  • $\begingroup$ s160 is of course SHA-1, Microsoft primarily (only?) uses FIPS algorithms, so you can bet s256 is then SHA-256. The older DLf1024s160mRijndael mainly uses a DL group that's too small, so that needed to be upgraded. Basically the only thing I'm not sure of is the key derivation mechanism, the symmetric mode used (Microsoft, so very likely CBC) and if there is a MAC over the ciphertext/wrapped key... $\endgroup$ – Maarten Bodewes Feb 7 '20 at 15:54
  • $\begingroup$ Most HSM's have a proprietary method such as this to transport keys from one vendor specific HSM to another. That way additional attributes can also be transported rather than just the key value. They are mainly used for backup / redundancy. They usually don't specify such schemes all that well, as it is not supposed to be used on its own. They point to NIST, but that's just for indicating that they use standard primitives like Discrete Log & AES. Well, yeah, duh. $\endgroup$ – Maarten Bodewes Feb 7 '20 at 15:56
  • $\begingroup$ Ah, so it is redundancy in this case. Storing keys outside of HSM. Oh wow, I wonder how many of those keys still get stored using a single 1024 bit DH key as protection, somewhere in a forgotten backup. $\endgroup$ – Maarten Bodewes Feb 7 '20 at 16:08


  • DL -> Discrete Logarithm
  • f -> finite field (of prime order)
  • 3072 -> size of finite field in bits
  • s -> (not sure) SHA?
  • 256 -> size of hash digest or subgroup size (used in DSA the old Digital Signature Algorithm?)
  • m -> don't know honestly.
  • Rijndael -> AES.
  • $\begingroup$ I would guess an IES cipher using SHA-256 within a KDF to derive the key. I was even thinking of MGF1, which basically is a KDF, but that's too speculative even for a guess. MessageDigest? Mac makes sense as well. Yeah, I'd go for Mac as in HMAC-SHA256... $\endgroup$ – Maarten Bodewes Feb 7 '20 at 14:00
  • $\begingroup$ Rijndael != AES $\endgroup$ – kelalaka Feb 7 '20 at 15:17
  • $\begingroup$ AES is a subset of Rijndael, and I'll happily bet it does mean AES-256 in this case though (confirmed through Microsoft "documentation"). $\endgroup$ – Maarten Bodewes Feb 7 '20 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.