Verify Key Attestation

Primus HSM can create different attestations to prove the provenance of artifacts, including keys.

This tutorial explains how you can verify key attestations using independent tools, such as OpenSSL. The verification can be done completely separate from the HSM. The verification confirms that the claimed key and its claimed attributes originate from a Primus HSM.

Obtain the Primus HSM Root Certificate

Download the Primus HSM Root Certificate. It serves as the root of the certificate chains for all types of attestations. The following code samples assume that you have saved the root certificate as hsm_rsa_root.crt.

warning

To ensure authenticity, it is important to obtain the root certificate separately from the key attestation. Always download the root certificate directly from Securosys. Do not accept it from an auditee.

Obtain the Key Attestation

As an auditee, create a key attestation using one of the APIs. As an auditor, you should receive the following files:

• Key attestation signature: ${LABEL}.sig
• Key attestation content: ${LABEL}.xml
• Attestation key certificate chain: PrimusHSM_Attestation.crt (full chain: attestation certificate, device certificate, root certificate)

Verify the Key Attestation

For ease of copy & pasting, the commands below assume that the attestation files are named by the key label of the attested key. Export the label to a shell environment variable:

export LABEL=my-signing-key

Step 1: Verify Attestation Certificate Chain

Recall that every key attestation is signed by an attestation key. Therefore, the first step is to verify the certificate chain of the attestation certificate (leaf), through the device certificate (intermediate), to the root certificate.

Run the following command:

openssl verify -CAfile hsm_rsa_root.crt -untrusted PrimusHSM_Attestation.crt PrimusHSM_Attestation.crt

• The -CAfile option provides the trusted root certificate.
• The -untrusted option provides the path to the intermediate certificate. It is "untrusted", because OpenSSL verifies that it is signed by the root CA.
• The final PrimusHSM_Attestation.crt argument provides the leaf certificate to be verified. (OpenSSL automatically selects the leaf certificate from the chain file.)

Successful Response

PrimusHSM_Attestation.crt: OK

Error Response

CN = attestation-key, C = CH, L = Zurich, O = Securosys, ST = ZH
error 20 at 0 depth lookup: unable to get local issuer certificate
error PrimusHSM_Attestation.crt: verification failed

tip

If verification succeeds, you know that attestation certificate chain was issued by a genuine Primus HSM.

Step 2: Extract Attestation Public Key

Next, extract the attestation public key from the certificate chain:

openssl x509 -in PrimusHSM_Attestation.crt -pubkey -noout > PrimusHSM_Attestation.pub.pem

This requires the attestation key leaf certificate to be the first element of the certificate chain in PrimusHSM_Attestation.crt.

This intermediate step is needed because for the signature verification (in the next step), OpenSSL does not support passing a certificate and instead requires a public key.

Step 3: Verify the Key Attestation Signature

Finally, verify that the signature ${LABEL}.sig over the message ${LABEL}.xml was created by the attestation key:

openssl dgst -verify PrimusHSM_Attestation.pub.pem -sha256 -signature ${LABEL}.sig ${LABEL}.xml

Successful Response

Verified OK

Error Response

Verification Failure

tip

If verification succeeds, you know that the ${LABEL}.xml file was created by a genuine Primus HSM and that the file has not been tampered with since.

Interpret Key Attributes

Now that you have verified the key attestation, how you interpret the metadata in ${LABEL}.xml is up to your use case. See the key attestation sample for how the XML looks like and what attributes you can review.

Verify Attested Key belongs to CSR

For qualified use cases, you may have a certificate signing request (CSR) and you want to verify that it was signed by a key generated inside Primus HSM. To this end, you need to verify that the CSR and the key attestation share the same public key.

First, verify that the CSR itself is intact and not tampered with:

openssl req -in ${LABEL}.csr.pem -noout -verify

Successful Response

Certificate request self-signature verify OK

Error Response

An error message.

Second, extract the public key from the CSR file:

openssl req -in ${LABEL}.csr.pem -noout -pubkey -out ${LABEL}_csr.pub.pem

Third, convert this public key from PEM to DER format so it can be compared later.

openssl pkey -pubin -in ${LABEL}_csr.pub.pem -outform DER -out ${LABEL}_csr.pub.der

Then, extract the public key from the key attestation file.

grep public_key ${LABEL}.xml | sed -e 's,[^>]*>,,' -e's,<.*,,' | base64 -d > ${LABEL}_attested.pub.der

Finally, compare the two public keys.

cmp ${LABEL}_csr.pub.der ${LABEL}_attested.pub.der && echo Verified OK

Successful Response

Verified OK

Error Response

label_csr.pub.der label_attested.pub.der differ: byte 1, line 1

tip

If verification succeeds, you know that the public key in the CSR is the same public key that ${LABEL}.xml attests to.