Support for signing key on hardware security modules

[Cantor, Scott]

On 12/20/17, 7:44 PM, "users on behalf of Oluf Færø" <users-bounces at shibboleth.net on behalf of ofa at klintra.fo> wrote:

> What is required to integrate the IDP awith a hardware security module (HSM) for signing of assertions etc. ?

PKCS11 support that works with Java, basically, it's all done under the covers behind the keystore interfaces. I'm not aware of anybody having done it, but I think some people have played with it via xmlsectool.

I've been asked to investigate it a bit for OSU, but I'm not confident there will be any performant and scalable solution that isn't too expensive and hard to deploy.

My strategy is probably going to be to start using different signing keys for high-risk services that need frequent key rotation and a long lived key for other services. Of course, what OSU thinks is high risk is not the same thing as what an SP might think is high risk. I'm perfectly fine dividing the world into "handles key roll over" and "not", and rolling my key often for the former group. I just don't have a great way to recognize the two groups.

-- Scott