How to Create CSR and Key Attestation Using Luna Network HSM?

It is important to safeguard data integrity and cryptographic computations against unauthorized access in the modern environment that relies heavily on computation and information technology.

With threats such as hacking and data leakage becoming more rampant, it is key to have well-fortified security measures. HSMs are an essential factor in protecting assets and cryptographic keys with robust safe mechanisms. Of these, the Luna Network HSM is distinguished for being a dedicated HW security solution.

Luna Network HSM is a highly sophistical Hardware Security Module that operates in the cloud to ensure the safety of digital assets.

These are specifically designed to handle digital keys and do cryptographic computations, thus bringing in an insulated environment where keys can be created, administered, and employed independently of the other components of the system.

Buy Code Signing Certificates at the Affordable Cost – Starts at $215.99 Per Year

Understanding CSR and Key Attestation

Before diving into the process, it’s important to understand what CSR and key attestation are:

Certificate Signing Request (CSR):

A CSR is a message, an email essentially, that an applicant sends to a CA to apply for a digital identity certificate. It holds data that would be inserted into the certificate, like the organization’s name and common name, which is the domain name, locality, and country.

It also has the public key that will be used in the certificate granted to the client. The CSR is then authorized by the private key related to the public key.

Key Attestation:

Key attestation is a process that ensures that a created key is obtained and stored in a safe environment like the HSM. It gives confidence that a private key related to a certificate has never been in the environment outside the hardware, and it helps reduce key breaches.

Generating CSR and Key Attestation with Luna Network HSM

1. To begin with, Luna Remote Client should be started, and then you need to log in. Begin the procedure by connecting to the Luna HSM via the remote client. Log in to go to the part of the program that offers protection for the cryptographic tasks you will be executing.
2. This brings us to generate an RSA Key Pair. Follow the instructions presented in the post to utilize the LunaCM2 utility and generate an RSA key pair to a specific Luna Partition. The command differs based on your operating system:

For Windows:

c:\ cd c:\Program Files\SafeNet\LunaClient
c:\Program Files\SafeNet\LunaClient\> lunacm

For Linux:

>cd /usr/safenet/lunaclient/bin
./lunacm

Now, generate the RSA key pair using the “cmu gen” command:

cmu gen -modulusBits=3072 -publicExp=65537 -sign=T -verify=T -label=LABEL -extractable=false

Important: The parameters “-extractable=false” and “-sign=T” are crucial for successful CSR generation. For code signing certificates, ensure the RSA key size is at least 3072 bits.

Retrieve the Handle Numbers of the Keys

Get the handle numbers for your public and private keys using these commands:

cmu list -class public -label=LABEL
cmu list -class private -label=LABEL

Generate a CSR:

Create a Certificate Signing Request (CSR) using the “cmu requestcert” command. Replace “MNO” and “BCD” with your public and private key handles:

cmu requestcert -publichandle=MNO -privatehandle=BCD -C=CA -L=Ottawa -O=Sectigo -CN="PKC Test Cert" -outputFile=rsacsr.pem

Generate a PKC:

Create a Public Key Confirmation (PKC) to verify the key pair’s authenticity: Replace “MNO” with your public key handle and “attestation.p7b” with your preferred file name.

cmu getpkc -handle=MNO -outputfile=attestation.p7b -pkctype=2 -verify

Encode the PKC File to Base64 Format:

For compatibility, encode the attestation PKC file in base64 format:

For Windows:

certutil -encode attestation.p7b attestation.b64
findstr /v CERTIFICATE attestation.b64 > attestation.b64

For Linux:

base64 attestation.p7b > attestation.b64
Verify CSR and Encoded Attestation

Provide the CSR and base64-attestation to the enrollment form of reseller’s website. This step proves the existence of the HSMs and can be used for issuing code signing certificates.

Understanding the PKC Structure

PKC package created by Luna HSMs is one of the essential components of a key attestation, which will be discussed in the next chapter. It’s important to understand its structure:

1. DER PKCS7 Format: The PKC is of the DER encoded PKCS7 type which is a cryptographic message syntax.
2. Certificate Chain: This is a chain of certificates that are incorporated in the PKC for the purpose of verifying the genuineness of the key pair.
3. Chrysalis-ITS Format: This format is composed of five certificates in the PKC structure and concluded with Safenet Root CA.
4. TC-Trust Center Format: Another format of certificates that contains three of them but does not terminate by SafeNet root.

Which of these formats to use depends on the particularities of the representation of security and compatibility of the formats.

Advantages of Luna Network HSM

Enhanced Data Privacy:

HSM implementation on Luna Network guarantees that crucial and sensitive data is protected and cannot be accessed by invader parties. These data-path processors conduct arithmetic operations inside a protected context, thus eliminating the possibility of exposure of data.

Secure Cryptographic Operations:

These protect facilities as cryptographic processes happen within the HSM in a manner that cannot be interfered with. It is applied from the key generation and storage up to the performance of encryption and decryption algorithms.

Robust Key Attestation:

Luna Network HSM performs exceptionally well in creating solid confirmations of the strength of keys for the fact that it offers unchallengeable evidence of the stability of a given key. This capability is supported by the Public Key Confirmation package (PKC).

Compatibility and Integration:

It is pertinent to mention here that base 64 encoding of PKC files is useful in making integration with other systems that use attested keys for trust establishment, for cross-functioning intact.

Flexible Attestation Formats:

The availability of different formats such as TC-Trust Center and Chrysalis-ITS expands the possibilities to satisfy different security needs and norms.

Tamper-Resistant Environment:

Pertaining to the hardware, physical attacks are prevented and an anti-tamper approach to key storage and management is provided.

Compliance with Security Standards:

Luna Network HSM offers its users compliance with the different requests for regulations and standards for data protection and key management.

Scalability and Performance:

Due to its cloud-based nature, it supports the expanding security requirements and provides high-performance data cryptographic operations.

Best Practices for Using Luna Network HSM

1. Regular Updates: The Luna Network HSM firmware and software should be upgraded normally to obtain the newest release to patch the newest security hole or to incorporate the newest feature to safeguard your applications and data more efficiently.
2. Access Control: There should be strict measures for controlling beings that can have direct contact with the HSM to a minimal number to avoid interactors that may not be allowed to do so.
3. Audit Logging: Allow it and see its functionality to track HSM activity and prevent any potential threats in audit logs periodically.
4. Backup and Recovery: There should be a backup plan and recovery of the HSM configuration and keys to avoid loss of data on the same.
5. Key Rotation: Major key-related issue: To reduce the consequences of potential key compromises, use different keys frequently.
6. Network Security: Shield the network that connects to the Luna Network HSM in order to make the communication between them encrypted and through the firewalls only.
7. Multi-Factor Authentication: Include administrative access to the HSM which requires other forms of identification such as two-factor authentication or MFA for enhanced security.
8. Regular Testing: Security should be tested on a regular basis to be sure that there are no significant holes that can be exploited.

Troubleshooting Common Issues

However, when in use of Luna Network HSM, one is bound to experience several trials. Here are solutions to common issues:

1. Connection Problems: Sometimes, the connectivity to the HSM may be an issue and in that case, one should use the appropriate network settings for the HSM IP address and the ports.
2. Authentication Failures: Verify your credentials and have proper authorization to connect with the HSM from the client program.
3. Key Generation Errors: If key generation fails, ensure that you have enough space in the HSM and that you are using the supported key sizes and algorithms.
4. CSR Generation Issues: Make sure that the key pair, which is used for CSR generation has the proper characteristics, specifying parameters, such as the “-extractable=false” and the “-sign=T”.
5. PKC Encoding Problems: If base 64 encoding is ineffective, consider other encoding tools or refer to the Luna HSM literature to check if it has any encoding standards.

Conclusion

Luna Network HSM is a comprehensive solution for creating CSRs and Key Attestations, substantially improving safety in corporate networking areas. Thus, using the primary form of protection in the form of HBSS, corporate information can be effectively protected and preserve its confidentiality from numerous threats on the Internet.