Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

CloudHSM RSA key generation size limitation

0

Hi everyone,

As I checked the documents, the CloudHSM servcie seems not support to generate the RSA key size less than 2048 bits. But for some industry, required to generate the RSA key size such as 1408 bits/1984 bits. How to generate such RSA key size in AWS CloudHSM ?

Topics
Security, Identity, & Compliance
Tags
AWS CloudHSM
Language
English
asked a year ago230 views
2 Answers
0

Hi Leo K,

Thanks for your information. But my requirement is base on the industry (EMV), according the EMV standard current the max CA's Modulus bit is 1984 bits, and for the smart card vendors, it required the less modulus bit size for the ICC such as 1024 bit/1408 bits.

We used to use the Local HSM for this kind of task, and we intend to migrate to support the cloud hsm that's why I raised this question.

Is it possible for the CloudHSM to support this kind of requirement ?

answered a year ago
  • Leo K EXPERT
    a year ago

    The CloudHSM service doesn't include that capability, but if this is a common requirement in the payments industry, it's conceivable the CloudHSM service team might have a way to accommodate exceptions. If you have an Enterprise level support contract with AWS, I suggest you ask the TAM in your account team about the requirement. If you have Business level or higher support, you could try raising a support ticket. With only basic level support, I'm not sure if there's a way easier than contacting AWS sales to ask them to consult with the CloudHSM service team.

0

The minimum length still considered secure today for RSA is 2048 bits. CloudHSM is rather an expensive piece of technology specifically meant for security-sensitive use cases, so it's intentionally hardwired to enforce that minimum.

https://docs.aws.amazon.com/cloudhsm/latest/userguide/cloudhsm_cli-key-generate-asymmetric-pair-rsa.html#key-generate-asymmetric-pair-rsa-arguments

<MODULUS_SIZE_BITS>
Specifies the length of the modulus in bits. The minimum value is 2048.
Required: Yes
EXPERT
answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content