[ksk-change] FIPS-140 levels

[Tomofumi Okubo]

Hello Paul,

On Sun, Oct 5, 2014 at 3:16 PM, Paul Hoffman <paul.hoffman at vpnc.org> wrote:
> On Oct 5, 2014, at 2:50 PM, Tomofumi Okubo <tomofumi.okubo at gmail.com> wrote:
>
> It wasn't "for convenience", it was to enable us to have a wider choice of HSMs that meet our needs. For example, one of our possible needs is "have HSMs from a variety of manufacturers", which is something you proposed just the other day. Another possible need is "have an HSM that uses the signing algorithm we want", given that there are some people who want to move towards modern elliptic curve signatures in the future.

Yes, I do agree that we need more variety (right now there is only
one) but I'm just against opening the door for inferior options or
reducing the security around the KSK. FIPS140 level 1 does not require
any physical controls. This is why softwares like OpenSSL can be
FIPS140-2 level 1 certified.

BTW, I personally like EC (especially curve 25519). EC will solve the
size issue but I think it is a great idea but I think we should tread
carefully before trying to make radical changes to the HSM
requirement.


> I did not propose "removing controls": I proposed meeting specific requirements ourselves if IANA can do it better. If the tamper evidence provided by the additions in the Level 2 part of an HSM's FIPS-140 certification is as good as, or not even as good as, what is provided by IANA's design (the tamper-evident bags), then it is not an actual control. The same is true for Level 3 and Level 4, I believe. I'm not sure, so I'm asking for others who know the specifics of how the levels are met *in HSMs* to comment.

What I'm trying to say is the security controls in the key management
environment are redundant by design. It's not about choosing the
better one but actually having both controls in place for additional
security.


>> IMHO, it is better to have tamper evidence (level2) and tamper
>> resistance (level3) at the HSM level.
>
> Why? This is a serious question. Why rely on the tamper evidence and tamper resistance of a system when you can add better functionality for both, which is what IANA is already doing?

I'm sorry for repeating myself but this is to accomplish defense in
depth (layered security). We can't solely rely on the tamper evident
bag for tamper evidence. Putting all eggs in one basket is not the
best practice when it comes to security. It is about adding redundancy
(e.g. 2 door is better then 1). The safety mechanism on the HSM is the
last resort if any other process-based security control gets
compromised.


> In the case of the HSMs that IANA uses, what specific attacks are those? I would be somewhat surprised if the same controls weren't required for Level 1, but you are more familiar with how HSMs meet the FIPS-140 requirements.

Environmental controls adopted by level 4 crypto modules are not
required for level 1 crypto modules neither are tamper evidence
(level2) or tamper resistance (level3). The controls each level is
quite different. Requirements for FIPS140 level 1 is pretty loose
compared to others.

Below is what the HSM that is currently used by ICANN reacts to and
renders the cryptographic key useless by destroying the keys that
protect the KSK (IMK, ISMK, SMK).

- External (mains) voltage outside of specified fatal range
- External (mains) voltage outside of specified operational range
- Storage temperature outside of normal operating range
- Physical breach of tamper casing (mesh)
- Operational temperature outside of normal operating range
- External tamper switch triggered
- Power fluctuation
- Total power failure (both internal battery and mains power)

Below is some example if attacks it mitigates.

- Probe attacks (physical tampering will blow up the key)
- Side channel attacks (module attenuates readable signals)
- Electrical attacks (applying unusual voltage to cause error will
blow up the key)
- Fault attacks (whatever unusual input will blow the key)


This might sound weird but I'm not actually advocating for FIPS140
level 4 HSMs and I do like EC too. I just think we shouldn't go down
to FIPS140 level 1 if we still decide to use HSMs to store and manage
the KSK. In addition, if we are to change the security level, we need
to come up with compensating controls or a good justification.


Cheers!
Tomofumi