[MUSIC PLAYING]
IL-SUNG LEE: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Il-Sung, and I'm a product manager
at Google Cloud.
Today we'll be walking through one of the top questions
we get from customers--
how do I generate and verify an encryption key in an HSM
on Google Cloud Platform?
So the first thing that we'll do is we'll go and create
a key in Cloud HSM.
And I want to demonstrate to you how easy this truly is.
So once you create your key ring and select a region,
you go to Create Key up there.
And then you'll be faced with a UI that tells you what to do.
Now, here's a key part.
The only thing you have to do is change the protection level
from software to HSM.
And that's it.
And from that point forward, the key will be in HSM,
and the system will take care of the creation for you.
So let's just create a key.
Let's call it Demo Key 2, because I already
created Demo Key 1.
And you get different options around what kind of key.
Let's do an asymmetric signing.
And then you also have different types of algorithms
that you can choose.
In this case we'll do something--
we'll use elliptic curve P-256.
OK.
And then we're going to generate it.
We can also import it, if we like.
And that's it.
And so once I hit Create, the key has been created.
So now that we've created our key,
I'm going to show you how you can download the attestation.
And the attestation is essentially
a signed statement that's verified by both Google
and the HSM vendor that indicates
that the key was created inside the HSM,
and that it has certain properties.
So in order to do that, all you have to do
is go and click on the hamburger button
and click Get Out of Station, and then hit Download.
Now once that key's downloaded, we
can actually go and run some scripts that will actually
do the parsing for you.
Or you can do it yourself.
But we provide scripts that you can
get through our documentation that make it a lot easier.
To do this I'm going to go and activate Cloud Shell.
And once Cloud Shell starts, now that I download the file, let's
upload the file to G Cloud so that we can actually
do some cool things with it.
The first thing that we want to do
is that we want to validate the signature of the file
to make sure that it's valid.
And so in this case, I'm going to validate using the Cavium
certificate chain to indicate that Cavium
is signed and tested to the contents of the file itself.
And so as you can see, the signature
is verified, which means that it's a valid file,
and everything in there should be taken as something
that Cavium has vouched for.
Now I'm going to actually parse the contents of the file.
And again, there are scripts available online
that you can actually download to do this.
And so now the file is parsed.
The next thing I'm going to do is
I'm going to check the key ID that's
indicated in the attestation file
to make sure it matches the key ID that we expect.
So to do that I'm just going to set up a local variable
to represent the key.
Then I'm going to use a simple command
to compare the contents of the hash of the key ID that's
in that attestation file with what we expect.
And as you can see from the output, the two hashes match.
So we know that the key that we think we're talking about
is actually the key that's indicated in the attestation
file itself.
Now that we're sure we're talking about the right key,
let's actually use this to actually
check for certain attributes of the key
to validate and make ourselves feel good about the fact
that the key has certain properties.
First of all, let's check to make sure
that the key is not exportable.
In order to do this, you need to understand a little bit
about PKCS 11, but not too much.
So there's a key property that's indicated by the hex 0162,
which indicates that the key is exportable.
And so as you can see here, there's two outputs.
One says yes, and one says no.
And that's to indicate the fact that there's one
public key and one private key.
The public key is obviously exportable,
and the private key is not.
The next thing you can do is that you
can check to make sure that the key that you created
is the same kind of key that the HSM believes it created.
In order to do so, you will look up property hex 0100.
And again, this is something that's
listed in the PKCS 11 standard.
And it comes back with the value of hex 03.
Now if you look that up, you would
know that this is an elliptic curve key.
So it is the type of key that we specified when we generated
the key in the first place.
Next, we're going to look for the property that
tells us whether the key was generated locally.
In other words, whether it was imported or not.
And so if you grep for hex 0163, you'll see that it says 01,
which means that both the keys were generated locally within
the HSMs, and they were not imported.
There are other things that you can do with attestations.
So in the attestation there's also a SHA-256 hash
of the public key itself.
So if you were to download the public key from the UI
or from the command line, you should
be able to actually take a SHA-256 hash of it,
compare it against the one that's in the attestation file,
and match them.
If they match, then you now have strong cryptographic evidence
that you're talking about the same key that's
in the attestation file.
Thank you for tuning in.
Please visit cloud.Google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]