Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Could CKA_MODIFIABLE attribute of a key be set to false?

1

AWS CloudHSM v5 documentation says, regarding CKA_MODIFIABLE attribute of a secret key

This attribute is partially supported by the firmware and must be explicitly set only to the default value.

The default value is true, but when I try to generate an AES secret key with explicitely the CKA_MODIFIABLE attribute set to false in my template, I succeed: the issued key shows, in its retruned values, CKA_MODIFIABLE=false

Can anyone help me solve this problem? Is this a bug or have I missed something?

Topics
Security, Identity, & Compliance
Tags
AWS Key Management ServiceAWS CloudHSM
Language
English

asked 2 years ago229 views

2 Answers
1
Accepted Answer

Hello,

"Modifiable" attribute or in this case "CKA_MODIFIABLE" can be set to true/false at key creation.

Note: After "modifiable" attribute is set to false, it cannot be set back to true.

We are currently working on updating the CloudHSM public documentation.

AWS
SUPPORT ENGINEER

answered 2 years ago

EXPERT

reviewed a year ago

  • Aaron Rose
    2 years ago

    Hi Amit,

    Thank you so much for clarifying the behavior of the CKA_MODIFIABLE attribute and providing additional insights! Your response helped clear up the ambiguity, and I’ve updated my original answer to reflect this information, including the note about the attribute being irreversible once set to false.

    I also mentioned that the CloudHSM documentation is being updated, as per your comment, so readers can stay informed. Your input ensures the guidance here is accurate and helpful—much appreciated! 😊

    Best regards,
    Aaron 🚀

  • EricT
    2 years ago

    Hi Amit, Sorry for the late answer and acceptance. Your response is perfectly clear and helped us to clarify our documentation about key creation using AWS CloudHSM v5 Thanks a lot

    Éric

0

Greeting

Hi EricT,

Great question! Let’s dive in and clarify the issue you’re facing with the CKA_MODIFIABLE attribute. It’s always interesting to tackle nuanced behaviors like this in hardware-backed systems. I’m here to help make sense of it all and guide you to a resolution. 😊

Clarifying the Issue

You're encountering a situation where the AWS CloudHSM v5 documentation states that the CKA_MODIFIABLE attribute for a secret key must default to true and explicitly mentions partial firmware support. However, as clarified by AWS Support, this attribute can indeed be set to false at the time of key creation. It's important to note that once the attribute is set to false, it cannot be reverted to true. This behavior is consistent with the CKA_MODIFIABLE attribute's design under the PKCS#11 standard.

Additionally, AWS Support has confirmed that the CloudHSM documentation is currently being updated to reflect this functionality more clearly. It’s always helpful to cross-reference documentation with support responses for cases like this, especially when working with specialized hardware like CloudHSM.

Key Terms

  • CloudHSM: A hardware-based security module for managing cryptographic keys in AWS.
  • CKA_MODIFIABLE: An attribute in PKCS#11 specifying whether a cryptographic object's attributes can be modified after creation.
  • AES Secret Key: A symmetric key used for encryption and decryption, compliant with the Advanced Encryption Standard.

The Solution (Our Recipe)

Steps at a Glance

  1. Review the CloudHSM documentation on the CKA_MODIFIABLE attribute.
  2. Confirm the firmware's support for setting CKA_MODIFIABLE to false.
  3. Investigate PKCS#11 specifications for CKA_MODIFIABLE to identify edge cases.
  4. Validate your process for generating the key and its returned attributes.
  5. Verify if this behavior aligns with CloudHSM's expected functionality.

Detailed Steps

1. Review Documentation

Check the official AWS CloudHSM documentation for any notes on firmware limitations or behavior regarding CKA_MODIFIABLE. AWS has indicated that updates are underway, so keep an eye out for revised information about this attribute.

2. Confirm Firmware Support

Use the CloudHSM Management Utility (CMU) or APIs to determine the firmware version of your HSM instance. Then, cross-check with release notes or AWS support to confirm whether your specific version allows setting CKA_MODIFIABLE to false. Some firmware versions might silently support configurations not explicitly documented.

3. Investigate PKCS#11 Specifications

The CKA_MODIFIABLE attribute is part of the PKCS#11 cryptographic standard. Review the specifications (available on the OASIS website) to see how this attribute is expected to behave. Certain edge cases in PKCS#11 implementations may allow for deviations when interacting with hardware-backed key stores like CloudHSM.

4. Validate Key Generation

Perform another test to generate an AES secret key using a slightly altered template while setting CKA_MODIFIABLE=false. Capture detailed logs of the process. Note any anomalies in the returned attributes to identify patterns or inconsistencies.

5. Contact AWS Support

If the observed behavior persists and contradicts the documentation or raises further questions, open a support case with AWS. Provide the steps to reproduce the behavior, your HSM's firmware version, and any relevant logs. AWS engineers can confirm whether this is intended behavior or a bug in the implementation.

Closing Thoughts

It’s always interesting when hardware-backed systems like CloudHSM exhibit unexpected or undocumented behavior. While the ability to set CKA_MODIFIABLE=false appears to be supported, understanding its irreversible nature and aligning your implementation with AWS guidance ensures compliance and security. With AWS Support confirming this behavior, you're on solid ground, but keeping an eye on upcoming documentation updates will help you stay informed.

Note: This answer has been updated to reflect recent clarifications from AWS Support regarding the CKA_MODIFIABLE attribute. Let us know how this works out for you—it could be a valuable learning experience for others encountering a similar situation! 😊

Farewell

Looking forward to hearing how this works out for you! It’s always exciting to see how these kinds of issues get resolved, especially when they lead to clearer insights for everyone. Let us know if you need further assistance—happy to help anytime! 🚀

Cheers, Aaron 😄

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content