Cyberstudy
PDF p.66 In progress

Cryptoprocessors and Secure Enclaves

Open PDF at p.66 24 flashcards

Summary

PDF p.66

Cryptoprocessors, such as Trusted Platform Modules (TPMs) and Hardware Security Modules (HSMs), enhance key generation and storage security by providing a dedicated hardware environment. Secure enclaves protect decrypted data in system memory from unauthorized access. These technologies address the limitations of storing cryptographic keys in general-purpose operating systems.

In plain words

Supplementary — not from your PDF

Keys are safer in dedicated hardware than in ordinary files. A TPM is a chip in a computer that protects keys (for example for disk encryption). An HSM is a dedicated device for many keys. Secure enclaves protect data while it's being used in memory.

Detailed explanation

PDF p.66
  • Key Generation and Storage
    • Entropy: High entropy is needed for secure key generation. True random number generators (TRNGs) provide better security than pseudo-random number generators (PRNGs).
    • File System Storage: Keys stored in the file system are vulnerable to compromise and difficult to audit.
  • Cryptoprocessors
    • Function: Dedicated hardware for key generation, storage, and cryptographic operations.
    • Advantages: Smaller attack surface, tamper resistance, and secure key handling.
  • Trusted Platform Module (TPM)
    • Definition: A cryptoprocessor module for discrete computer platforms.
    • Versions: TPM 1.2 and 2.0 (not backward compatible).
    • Implementations
      • Discrete: Dedicated chip with tamper resistance.
      • Integrated: Part of a chipset or CPU, broader attack surface.
      • Firmware: Implemented in low-level operating code, relies on secure enclave functions.
      • Virtual TPM: Provides services to virtual machines.
  • Hardware Security Module (HSM)
    • Definition: Cryptoprocessor hardware in removable or dedicated form factors.
    • Form Factors: Rack-mounted appliances, PCIe adapter cards, USB security keys, virtual appliances.
    • Purpose: Centralized or portable key storage.
    • Certification: FIPS 140-2 for market trust.
  • Secure Enclave
    • Function: Protects decrypted data in system memory from unauthorized access.
    • Implementation: Trusted execution environment (TEE) like Intel Software Guard Extensions.
    • Security: Prevents access by untrusted processes, even with root or system privileges.

Important terms

taken from the text above
Entropy
High entropy is needed for secure key generation. True random number generators (TRNGs) provide better security than pseudo-random number generators (PRNGs).
File System Storage
Keys stored in the file system are vulnerable to compromise and difficult to audit.
Trusted Platform Module (TPM)
A cryptoprocessor module for discrete computer platforms.
Versions
TPM 1.2 and 2.0 (not backward compatible).
Discrete
Dedicated chip with tamper resistance.
Integrated
Part of a chipset or CPU, broader attack surface.
Firmware
Implemented in low-level operating code, relies on secure enclave functions.
Virtual TPM
Provides services to virtual machines.
Hardware Security Module (HSM)
Cryptoprocessor hardware in removable or dedicated form factors.
Form Factors
Rack-mounted appliances, PCIe adapter cards, USB security keys, virtual appliances.
Certification
FIPS 140-2 for market trust.
TPMs Trusted Platform Modules HSMs Hardware Security Modules TRNGs True random number generators TPM Trusted Platform Module HSM Hardware Security Module TEE Trusted execution environment

Examples & real-world scenarios

Supplementary — not from your PDF
  • BitLocker storing its key in the laptop's TPM.
  • A bank's HSM holding keys for payment systems.
  • An enclave (TEE) keeping decrypted data safe even from admin-level processes.

Scenario

A company stores its code-signing key as a file on a build server. After a scare, it moves the key into an HSM, so signing still works but the key can't simply be copied off the machine.

Common mistakes

Supplementary — not from your PDF
  • Mixing up TPM (built into one computer) and HSM (a dedicated, often shared, device).
  • Thinking a secure enclave protects data at rest. It protects data in use.

Practical skills

Supplementary — not from your PDF
  • Pick TPM, HSM or enclave for a key-protection need.

What I should remember

Key Points PDF p.66
  • Key Generation and Storage
    • Entropy: TRNGs for secure key generation.
    • File System Vulnerability: Keys in file systems are at risk.
  • Cryptoprocessors
    • Dedicated Hardware: For secure key handling.
    • Advantages: Smaller attack surface, tamper resistance.
  • Trusted Platform Module (TPM)
    • Versions: TPM 1.2 and 2.0.
    • Implementations: Discrete, integrated, firmware, virtual.
  • Hardware Security Module (HSM)
    • Form Factors: Various, including virtual appliances.
    • Purpose: Centralized/portable key storage.
    • Certification: FIPS 140-2.
  • Secure Enclave
    • Protection: For decrypted data in system memory.
    • Implementation: TEE like Intel SGX.
    • Security: Prevents unauthorized access.