UCSD-led team simulates HSM operations without extracting keys

A research team led by the University of California, San Diego said it was able to simulate the operation of a hardware security module, or HSM, without extracting the cryptographic keys stored inside the device. The method targeted a weakness in the RSA signing process rather than breaking into the module to pull out secret material. According to the report, the attack worked by sending a large number of carefully crafted signing requests to the HSM and then examining side-channel signals such as response timing. Using that information, the researchers were ultimately able to forge valid digital signatures. The finding points to a potential security risk for crypto exchanges, custody providers, and blockchain networks that rely on HSMs for key management and transaction signing. The researchers said the result shows that even physically isolated hardware can still face remote attack risk, and that stronger defensive measures may be needed across the industry. The item was cited by Techub and attributed to Decrypt.