At CSS we are all about helping clients manage their Public Key Infrastructure (PKI). We always recommend that customers store their important private keys using Hardware Security Modules (HSMs) because without an HSM it is hard to protect your keys from malware or misconfigured security in your operating system. It turns out there is another good reason that due to extreme rarity is not considered often: CPU flaws.
Making the tech news rounds is just such an occurrence. The Register is reporting on a flaw with Intel processors that would potentially allow unprivileged software access to kernel memory. Kernel memory is memory protected by the operating system and contains sensitive security information including private keys. Of note here is that the issue is actually an issue within the CPU itself; it is not because of a software bug in the operating system. Patches are forthcoming for both Windows and Linux operating systems, but until those patches are available and deployed, the vast majority of computing platforms out there are potentially vulnerable. These patches work around the flaw at the expense of performance.
The reason HSMs exist is to provide a dedicated piece of hardware with the sole purpose of protecting private key material and performing basic cryptographic calculations. It is simply not possible to securely perform this task on a general-purpose computer, as the attack surface is far too broad.
In addition to the existing risks of bugs, malware, and misconfiguration that exist with general-purpose computers (Windows and Linux servers and workstations), we can now add CPU hardware flaws.
In short, use an HSM!
