HSM Advances Supporting quantum-safe PKI Automation

on YouTube ↗24m

" summary

HSMs produce a signed attestation bundle in an ASN.1 evidence format that includes a manufacturing-installed manufactured trust anchor (root cert), a freshness marker (timestamp or firmware version), and claims tying a public key to an HSM-resident private key; the CA verifies the attestation chain and issues the certificate, enabling automated code-signing issuance and secure audit logs. Implementation notes: presenter-requested claims, endorsement by manufacturing or third-party testing, and the need to use quantum‑safe signature algorithms (hash‑based LMS style or comparable schemes) because trust anchors are hard to replace.

AI-written summary · about

" chapters (16)

1. 0:00Postquantum PKI conference intro
2. 1:07Speaker intro
3. 1:29Why attestation for HSMs
4. 3:15Code signing with HSM attestation
5. 4:41Formal attestation definition RFC 934
6. 5:44HSM attestation format challenges
7. 7:09IETF draft for HSM attestation claims
8. 10:02ASN.1 format in attestation
9. 11:25Quantum-resistant HSM attestation
10. 12:31Trust anchors deployment
11. 13:33Quantum-safe signature algorithms
12. 15:40Trust anchors in HSMs
13. 16:46Updating trust anchors challenges
14. 17:50HSM attestation use cases
15. 19:14Quantum-safe attestation clustering
16. 20:39Q&A crypto agility

" related talks

• 28mIs your HSM quantum-ready? Here’s what you need to know!Bruno Couillard · Post-Quantum Cryptography Conference Austin 2025
• 37mSecuring Data in the Quantum Era: From the Root of Trust to Protecting EcosystemsNils Gerhardt · Post-Quantum Cryptography Conference Austin 2025
• 40mHardware Cryptographic ModulesGiuseppe Damiano, Blair Canavan, Volker Krummel, Marc Stevens · Post-Quantum Cryptography Conference Amsterdam 2023
• 23mHSMs in Plain Envelopes: A Code Signing StoryAlexis Hancock · BSidesSF 2023
• 35mHardware Cryptographic ModulesJohn Buselli, Bruno Couillard, Nils Gerhardt, Ed Reynolds, Eric Amador · Post-Quantum Cryptography Conference Austin 2025
• 27mSecurity++: Hide Your Secrets via a Distributed Hardware Security Mod...Malini Bhandaru, Iris Ding · CloudNativeSecurityCon North America 2023
• 32mCare and Feeding of HSMs: Key Management in Hard ModeNick Pelis · BSidesSF 2025
• 29mCrunching the Numbers Post Quantum Algorithm PerformanceTomas Gustavsson · Post-Quantum Cryptography Conference Amsterdam 2023