PKCS#11 Device Audit

Audit without manual analysis

Analyzer screenshot

Test the security of your PKCS11 implementations.

Cryptosense software ensures the ongoing security of your PKCS#11 deployments with comprehensive testing and monitoring tools.

Hardware-based cryptography is a core technology for controlling risk in potentially hostile environments such as mobile, cloud and Internet of things. However, choosing, configuring, deploying and securely using a cryptographic device like a Hardware Security Module (HSM) is far from simple. A small mistake in the details can lead to a complete loss of security. Cryptosense offers a comprehensive suite of tools for black-box testing the security of HSMs (including CloudHSMs), and auditing the way applications use them to make sure your most precious keys are always secure.

Using Cryptosense Analyzer for Automated Pen-Testing

Use Cryptosense Analyzer to perform an automated, systematic penetration test of the cryptographic API of your HSMs. This can be scheduled to take place regularly for Cloud HSMs, or applied as part of a procurement or deployment process to on-prem HSMs.

The advantages of using Cryptosense Analyzer for an automated penetration test are:

Repeatability. Cryptosense Fuzzer and Analyzer can be configured to produce a standard level of testing. Identified risks for which there are existing mitigating controls can be ignored. Users can iterate the testing to find a secure configuration using the options provided by the HSM manufacturer.

Clarity. The findings in Cryptosense Analyzer are explained for non-expert users of HSMs, to help in understanding what the PKCS#11 standard interface is supposed to keep secure, and what is is actually doing in case of a vulnerable configuration.

Speed. Time to get a satisfactory penetration-test depends somewhat on the speed of the HSM, but typically 24 hours of fuzzing is enough to get a solid set of results.

State of the art coverage. Our vulnerability research teams work in close co-operation with the best applied crypto groups in academia and industry on new ways to attacks cryptographic APIs.

Cryptosense Analyzer is always updated to take the latest results into account. Additionally, our extensive experience testing many models of HSM, means that our fuzzer knows where to look to find new anomalies that may be exploited.

Analyzer screenshot

How it works

Cryptosense PKCS#11 Fuzzer is the only commercially available fuzzing tool for PKCS#11 HSMs, allowing you to test their security without needing access to source code.

Mutation-based Fuzzing

Our adaptative mutation-based fuzzing engine explores the corner-cases of the PKCS#11 standard as implemented in the device under test. The results are passed through more than 140 compliance and vulnerability filters to detect memory management errors, anomalies and weaknesses, including a number of issues that can compromise private keys like CVE-2015-5464 and CVE-2015-6924. This facilitates security testing of vendor equipment before procurement, , and evaluation of firmware updates and configuration changes.

Our PKCS#11 fuzzer can either be run in full auto mode, or configured at the command-line to go deeper on certain configurations of commands. If a crash in the HSM driver is discovered, the fuzzer returns the call required to reproduce the issue. Automated inconsistency detection allows memory management flaws within the HSM to be discovered. Fuzzing can also be resumed from existing traces to save analysis time.

PKCS#11 Security White Paper

In this white paper, we discuss attacks on systems using the PKCS#11 API. We consider what it means for an interface to be secure, and we discuss how to audit applications’ use of the API. There are also concrete examples of attacks.

read whitepaper