HSM Registry Access Hardening

info

This applies to Primus CNG/KSP Provider V1.35 and later.

As the CNG/KSP may be executed in the context of any application, the Hardware Security Modules (HSMs) can be accessed via CNG/KSP by any system user or service.

To restrict access to your HSMs for a specific user group, you must limit the permissions on the registry key containing the HSM connection details.

Step-by-Step Instructions

To limit permissions on the registry key, follow these steps:

For 64-bit Windows installations:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Securosys\hsm_ksp\HSMs

For 32-bit Windows installations:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Securosys\hsm\_ksp\HSMs

The following procedure requires administration rights:

• Define a new user group having access to the HSMs, e.g. Securosys_KSPUsers, either on

  • the local machine ("Computer Management", "Local Users and Groups")
  • or within the Active Directory ("Active Directory Users and Computers")

• Add the specific users or accounts to above user group, having access to the HSMs

• Open the Registry Editor as administrator (regedit.exe)

• Navigate to the above-mentioned registry key

• Assign the newly created group (Securosys_KSPUsers) to the registry key permissions: Right-click on the HSMs key and select Permissions…

  

  • On the following dialog click the button Add…

    

  • Enter the new group name and click the button Check Names and OK

  • Assign the Read permission tick for the new group

  • Click the button Apply

• To remove inheritance

  • Click the button Advanced

  • On the following dialog click Disable Inheritance

  • Select Convert inherited permissions …

  • Remove the group Users (…\…) by selecting it and clicking the button Remove

  • Confirm all changes by clicking the button OK twice

  • Exit the Registry Editor application and test the behavior

caution

Newer Windows versions use some unresolved and Special Security Identifiers (SIDs; e.g. for recovery purposes). Before deleting such SIDs, please consult Microsoft documentation. These hardenings have to be checked and eventually reapplied after every CNG/KSP update!