Abstract- PKCS # 11 has been widely accepted in the community of researchers and developers of cryptographic security hardware devices, which includes companies providing security and information security products such as Utimaco, Safenet, Thales, AEP. In this article we summarize some potential weaknesses for PKCS # 11 (version 2.20) security, as an application programming interface for a hardware security device. We analyze the impact and provide solutions for developers to overcome the above weaknesses.
|
Tài liệu tham khảo [1] RSA Laboratories. “PKCS #11 v2.20: Cryptographic Token Interface Standard”, RSA Security Inc., 2004 [2] Jolyon Clulow. “On the security of PKCS#11”, Springer-Verlag Berlin Heidelberg, 2003. [3] Matteo Bortolozzo, Matteo Centenaro, Riccardo Focardi, Graham Steel. “Attacking and Fixing PKCS#11 Security Tokens”, Copyright 2010 ACM, 2010. [4] Mike Bond. “Attacks on Cryptoprocessor Transaction Sets” Springer-Verlag Berlin Heidelberg 2001. [5] Eric Brier, David Naccache, Phong Q. Nguyen, Mehdi Tibouchi. “Modulus Fault Attacks Against RSA-CRT Signatures”. https://eprint.iacr.org/2011/388.pdf. [6] Abderrahmane Nitaj, “A new attack on RSA and CRT-RSA”, AFRICACRYPT 2012. [7] Dan Boneh, Richard A. DeMillo, and Richard J. Lipton, “On the importance of checking cryptographic protocols for faults”. In Advances in Cryptology EUROCRYPT ’97, vol. 1233, pp. 37-51, 1997. [8] Adi Shamir, “How to share a secret”. 1979.di S [9] RSA Laboratories. PKCS #5 v2.1: “Password-Based Cryptography Standard”. RSA Security Inc., 2012. [10] NIST SP 800-57 , “Recommendation for Key management - Part 1: General (revised)”,2007. |
