Hardware Security Module
Hey there fellow nerd! Today lets dig into HSM.
If you are new to my page, do checkout my complete list of Google Dorks and how to do Browser in the Browser attack. Links attached below.
Hardware Security Module
It is a physical device to provide extra security by using cryptographic keys to sensitive data. It can encrypt, decrypt, create, store and manage digital keys, and be used for signing and authentication. The purpose is to safeguard and protect sensitive data.
Encryption and Key
Definition of Encryption: The reversible transformation of data from the original to a difficult-to-interpret format as a mechanism for protecting its confidentiality, integrity and sometimes its authenticity.
A formula used to transform the input plaintext and the key into the output ciphertext is called encryption algorithm.
A key is a piece of information that controls the operation of a encryption algorithm (Ex: 7D0A 39TC 26F8 7ER3).
Keys can be compared to passwords, it is kept secret and discovery of it gives access to plaintext data.
Need for secrecy
To protect an encryption, either encryption algorithm or key need to be secret.
A key is often easier to protect than an encryption algorithm, and easier to change if compromised. Thus, the security of an encryption system in most cases relies on some key being kept secret.
Note: Here we will look in terms of an financial transaction but HSM can be used in any workflow where secrecy needs to be achieved while safeguarding data.
In an financial transaction, starting from the POS machine to the Issuer bank branch and back, there are multiple keys involved. These can be of various types and methods.
Encryption Algorithm
DES: Data Encryption Standard is an encryption algorithm. This algorithm is not strong enough to resist attacks performed using powerful computers
Triple DES: This is far better than DES; it uses three applications of the DES in Encipher-Decipher-Encipher mode with totally independent keys.
This algorithm is thought to be very secure and major banks use it to protect valuable transactions.
Key Management
Triple DES algorithm uses a type of key called symmetric key. In this type, a shared secret key is used to encrypt as well as decrypt the data. Both the parties involved in exchange of encrypted data need to know the key.
Key Management is the creation, distribution and maintenance of a secret key. Important part of key management is to protect keys during creation, transmission and storage.
Different Type of Keys
MFK (Master File Key): Master File Key is also known as Local Master Key (LMK) are a set of Data Encryption Standard (DES) keys stored in the HSM and is used to encrypt other cryptographic keys which are to be stored outside the Hardware Security Module (‘HSM’)
ZMK (Zone Master Key): A Zone Master Key (ZMK) is a key-encrypting key (KEK) which is distributed manually between two (or more) communicating sites, within a shared network, in order that further keys can be exchanged automatically (without the need of manual intervention). ZMK will be encrypted under MFK. This ZMK is used to encrypt keys of a lower level transmission like PEK (Pin Encryption Key) e.t.c.
TMK ( Terminal Master Key): A Terminal Master Key (TMK) is a key encrypting key which is distributed manually or automatically under a previously installed TMK. It is used to distribute data-encryption keys, within a local (non-shared) network, to an ATM or POS terminal or similar. The TMK is used to encrypt other TMKs or keys of a lower level for transmission. For local storage a TMK is encrypted under one of the LMK pairs.
ZPK (Zone PIN Key): The data-encrypting key used to encrypt PIN’s for transmission over a shared (interchange) network (for example, between network and issuers). For transmission, a ZPK is encrypted under a ZMK.
CVK (Card Verification Key): Card Verification Key (CVK) is used to verify the CVV/ CVC/ iCVC/ iCVV/ CVV2/ CVC2 of the card
PVK (Pin Verification Key:) In order to calculate a ‘PIN offset’ a ‘natural PIN’ must be derived and associated with each valid card number. The natural PIN is the result of encrypting the last 12 positions of the Primary Account Number (‘PAN’) under a key. This specific key is known as the PVK. The PVK is static so that for any given PAN, the same natural PIN will always be calculated. The HSM calculates the difference between the customer’s selected PIN and the card’s natural PIN. This difference — known as the PIN offset — is placed on your card database for subsequent PIN checks.
CAK (Cryptogram Authentication Key): An online EMV transaction will typically contain an Authorization Request Cryptogram (ARQC) value generated by the chip present on the card. This cryptogram must be validated by the card issuer and an Authorization Response Cryptogram (ARPC) value generated back to the card. To validate the ARQC and generate the ARPC a new cryptographic key needs to be defined in the Realtime system, namely a cryptogram authentication key (CAK).
CONF (EMV Confidentiality Key): Certain EMV script commands sent to an EMV card (for example, a PIN change) will require encryption of the script data (script will be generated for e.g. PIN change, PIN Unblock, card blocking e.t.c., and can be seen in ICC data in Issuer Script Template field send to Source (like MasterCard/Visa/Euronet) to ensure that the data remains confidential. We use EMV Confidentiality Key (ECK) for encryption of the script data.
MAC (EMV MAC Key): To prevent script data tampering each script will typically have a message authentication code (MAC) attached to the script data. This Message Authentication code is encrypted used EMV MAC Key (EMK).
KWA (MAC Key, Message Authentication Code): Message authentication ensures transaction messages are received exactly as created by the legitimate originator. Message authentication protects messages against accidental or deliberate alteration. The message authentication code (MAC) is generated by the originator of the message, based upon message elements identified in advance by the originator and recipient, and included with the message. The MAC is verified by the recipient, based on the same criteria as was used in its generation. Message authentication is done prior to normal processing of the message. This message authentication code is encrypted using MAC key (KWA) and is different from EMK (EMV MAC Key).
dCVV or CVC3: CVV3 or CVC3 are used for Contactless cards for verifying CVC3.
Hierarchy of Keys
Key Type Table
Direction: If your key is 002, we take the first digit(‘0’ in this example) and find it in the column. Then we find the remaining digits(‘02’ in this example) in the row to match the column of the first digit. This gives us PVK keys.
Key Scheme Table
Key Scheme is used to determine the method of encryption of keys.
Key Exchange
What is Key Exchange?
Every terminal or interface will have a ZPK (KWP) assigned to it for decryption of PIN. As a precaution/security purpose this ZPK will be regularly updated (mostly everyday).
How to identify if key exchange has happened for an interchange or terminal in Postilion?
Go to source node take the respective ZPK assigned for that source node and go to HSM load Balancer. Type the Key Name and click on search, go to Updated column and check if the date is updated to today’s date.
I hope this was informative to you. If you enjoyed it do put a clap and follow me. :)