CloudHSM: Frustration as a Service - Paul Kuliniewicz AWS Community Day aws community day | midwest 2019

1. CloudHSM:
Frustration as a Service
Paul Kuliniewicz
AWS Community Day Midwest
June 20, 2019

2. Outline
● What is an HSM?
● Should you use it?
○ Why are you saying "yes"?
● Here's how you use it
○ I know; I've done it
● What you're going to experience
○ Frustration

3. What is it?

4. Hardware Security Module
image: https://www.pexels.com/photo/colorful-raw-security-key-68174/

5. CloudHSM
image: https://www.pexels.com/photo/colorful-raw-security-key-68174/

6. Should you use CloudHSM?

7. Just use KMS
● It does encryption and decryption
● It integrates with other AWS services
● It uses HSMs behind the scenes
○ You can even back KMS with CloudHSM if you really
want your "own" HSMs

8. OK, you asked for it
● There are some upsides to using CloudHSM
directly
○ Possible to replicate keys across regions
○ Possible to export keys
● But now you're doing the work that KMS is
willing to do for you

9. Setting Up CloudHSM

10. Create the cluster itself

11. Create exactly one HSM in the cluster

12. State check
● Our cluster is UNINITIALIZED
○ We can't connect to it
○ We can't grow it
○ We can't use it

13. Issue the cluster a certificate
CSR
image: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

14. State check
● Our cluster is INITIALIZED
○ We can now connect to it!
○ We still can't grow it
○ We still can't use it
image: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

15. EC2 instance
cloudhsm-client daemon
cloudhsm_client
CLI tools
your application
image: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

16. Activate the cluster
● cloudhsm_mgmt_util
○ Its own interactive shell
● Log in with default admin credentials
● Change the admin account's password
● Create users allowed to do stuff with keys

17. No external user management
IAM
LDAP
SAML
literally
anything
else

18. State check
● Our cluster is ACTIVATED
○ We can still connect to it
○ We can now grow it!
○ We can now use it!
image: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

19. Using CloudHSM

20. cloudhsm-client library
● Your choices
○ PKCS#11 library for Linux
○ OpenSSL engine
○ Java JCE/JCA provider
○ KSP and CNG providers for Windows

21. Java library "documentation"
● Some small bits of sample code
○ Covers basic functionality
● No javadoc
○ Not in AWS docs
○ Not on HSM vendor's site
○ Not that I could find on Google

22. Authenticating to CloudHSM in Java
LoginManager lm = LoginManager.getInstance();
try {
lm.login("WHATEVER", user, pass);
} catch (CFM2Exception e) {
if (CFM2Exception.isAuthenticationFailure(e)) {
System.out.printf("Bad credentials");
}
}
adapted from: https://github.com/aws-samples/aws-cloudhsm-jce-examples/blob/master/src/main/java/com/amazonaws/cloudhsm/examples/LoginRunner.java

23. Using CloudHSM as a KeyStore
Security.addProvider(new CaviumProvider());
KeyStore keyStore =
KeyStore.getInstance("Cavium");
keyStore.load(null, null);
System.out.printf(
"Found %d keysn", keyStore.size());
https://github.com/aws-samples/aws-cloudhsm-jce-examples/blob/master/src/main/java/com/amazonaws/cloudhsm/examples/KeyStoreExampleRunner.java

24. Aliases and handles
KeyStore CloudHSM
Alias: west Handle: 100000
Alias: largo Handle: 200000

25. Labels
KeyStore CloudHSM
Alias: west Handle: 100000
Alias: largo Handle: 200000
Label: west
Label: largo

26. Labels are non-unique; aliases are
KeyStore CloudHSM
Alias: florida
Handle: 100000
Handle: 200000
Label: florida
Label: florida
???

27. Features That Look Appealing
But Are Actually Bad

28. Cross-Region Replication

29. The promise
image: https://www.pexels.com/photo/colorful-raw-security-key-68174/

30. The promise
cloudhsm_mgmt_util: syncKey
image: https://www.pexels.com/photo/colorful-raw-security-key-68174/

31. Only works for backup twins
backup create
from backup
image: https://www.pexels.com/photo/colorful-raw-security-key-68174/

32. Synchronize one key at a time
server 0
syncKey 111111 1
syncKey 222222 1
server 1
syncKey 333333 0
syncKey 444444 0

33. No user replication between clusters

34. The reality of user management
cloudhsm_mgmt_util
createUser
createUser
createUser

35. Exporting Keys

36. The promise
export
images: https://www.pexels.com/photo/colorful-raw-security-key-68174/ & https://commons.wikimedia.org/wiki/File:Standard-lock-key.jpg
import

37. Because you will not believe me
https://docs.aws.amazon.com/cloudhsm/latest/us
erguide/key_mgmt_util-exSymKey.html

38. How exports really work
images: https://www.pexels.com/photo/colorful-raw-security-key-68174/ & https://commons.wikimedia.org/wiki/File:Standard-lock-key.jpg
unwrapwrap

39. You can make exports weirder
images: https://www.pexels.com/photo/colorful-raw-security-key-68174/ & https://commons.wikimedia.org/wiki/File:Standard-lock-key.jpg
unwrapwrap

40. Quorum (M-of-N)
Authentication

41. The promise
n
m

42. Quorum authentication setup
● Alice: public key A
● Bob: public key B
● Carol: public key C
● ...
private key A private key B private key C

43. Get a quorum token
● Alice: public key A
● Bob: public key B
● Carol: public key C
● ...
getToken

44. Collect m signatures
private key A
private key B
A
B
image: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

45. Write a file about all the files you have
Multi Token File Path = my.token;
Token File Path = ;
Number of Approvals = 2;
Approver Type = 2; # 1 = CU, 2 = CO
Approver Name = alice;
Approval File = my.token.alice.sig;
# ...

46. Redeem your quorum token
● Alice: public key A
● Bob: public key B
● Carol: public key C
● ...
approveToken
A
Bimage: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

47. You now have a single blank check
A B
Pay to the
order of:
Amount:
Date:
You!
AWS CloudHSM Whenever
Please don't be evil
image: https://pixabay.com/vectors/award-ribbon-rosette-blue-161090/

48. Wrap-Up

49. Take aways
● Prefer using KMS instead if you can
○ Or at least KMS backed by CloudHSM if you must
● Understand whether CloudHSM features are
going to be usable for you
● Be prepared for an unusual integration