Lecture Notes: Cryptographic Hardware and Key Management Systems

Trusted Platform Module (TPM)

• What is TPM?
  • A standardized hardware chip/subsystem on modern motherboards.
  • Provides cryptographic functions.
  • Used for generating random numbers or cryptographic keys.
  • Contains persistent memory to store unique keys for the machine.
  • Keys can be used for full disk encryption and securely stored.
  • Protected by a password; resistant to brute force or dictionary attacks.

Hardware Security Module (HSM)

• What is HSM?
  • Used in data centers for large-scale cryptographic functions.
  • Provides secure storage for encryption keys for hundreds/thousands of devices.
  • Often clustered for redundancy (power supplies, network connectivity).
  • Can include additional hardware like cryptographic accelerators for real-time encryption/decryption.
  • Ensures centralized and secure management of sensitive keys.

Key Management Systems (KMS)

• Purpose of KMS

  • Manage various encryption keys from a centralized console.
  • Can be on-premises or cloud-based.
  • Keeps keys separate from the data they protect.
  • Supports automatic key rotation and comprehensive logging/reporting.

• Example Functions

  • Creation and management of SSL/TLS keys for web servers.
  • Management of SSH keys for remote console access.
  • Association of keys with specific users and services.
  • Reporting on key usage, activation, and expiration.

Secure Enclave

• What is Secure Enclave?

  • A security processor built into many modern devices (phones, laptops, desktops).
  • Separate from the primary CPU; solely dedicated to data privacy.
  • Has various names depending on the manufacturer.

• Functions and Features

  • Own boot ROM and management of system processes.
  • True random number generator and real-time encryption of data in memory.
  • Built-in cryptographic keys used as a root for system cryptography.
  • Hardware-based AES encryption.
  • Ensures data privacy even if the device is compromised.

Challenges in Data Privacy

• Distributed Data

  • Data spread across multiple devices (laptops, phones, etc.) making security complex.

• Constant Threats

  • Continuous need to stay ahead of attackers finding new vulnerabilities.

• Dynamic Data

  • The need for security measures that adapt to constantly changing data.

• Solutions

  • Employing technologies like secure enclaves to maintain data privacy across different systems.