From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from v6.tansi.org (ns.km31936-01.keymachine.de [87.118.116.4]) by mail.saout.de (Postfix) with ESMTP for ; Thu, 6 Mar 2014 15:29:47 +0100 (CET) Received: from gatewagner.dyndns.org (77-57-44-24.dclient.hispeed.ch [77.57.44.24]) by v6.tansi.org (Postfix) with ESMTPA id BD68720DC3A6 for ; Thu, 6 Mar 2014 15:29:46 +0100 (CET) Date: Thu, 6 Mar 2014 15:29:45 +0100 From: Arno Wagner Message-ID: <20140306142945.GA16553@tansi.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [dm-crypt] LUKS/cryptsetup with HSM List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Hi, you cannot protect the encryption keys in an HSM. To be effective, they need to be known to the kernel and are hence exposed to root, see also FAQ Item 6.10. This is a fundamental limitation of software-nased encryption. Or maybe you want to _store_ the _passphrases_ in an HSM when not in use? In that case youmay want to feed them to cryptsetup via stdin, as described in the man-page. Arno On Thu, Mar 06, 2014 at 08:17:59 CET, Sharma, Manjari wrote: > Hi Cryptsetup team, > > This is Manjari Sharma from SafeNet. SafeNet is the largest company > exclusively focused on the protection of high-value information assets. > I'm trying to integrate our HSM with LUKS so that the encryption keys are > protected in an HSM. > > Could you please help to provide some pointer. I could not find anything > relevant after searching for hours, all I can be assured of is that it can > be done. > > Your help would be highly appreciated. > > Thanks, > > Kind Regards, > Manjari > > The information contained in this electronic mail transmission > may be privileged and confidential, and therefore, protected > from disclosure. If you have received this communication in > error, please notify us immediately by replying to this > message and deleting it from your computer without copying > or disclosing it. > > > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. - Plato