# How secure is HSM2 data exchange channel?

**URL:** <https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690>\
**Category:** Nitrokeys\
**Created:** [October 13, 2020, 12:52pm UTC](https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690 "2020-10-13T12:52:05Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sanyo](https://support.nitrokey.com/user_avatar/support.nitrokey.com/sanyo/32/593_2.png) [@sanyo](https://support.nitrokey.com/u/sanyo)\
**Post date:** [October 13, 2020, 12:52pm UTC](https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690/1 "2020-10-13T12:52:06Z")

</div>

Hello,

According to HSM2 specification it uses a BSI TR-03110 protocol to secure data channel.

Do you know any results regarding it’s security analysis?

For example for a JavaCard SCP02 and SCP03 there is some research done:

> Cryptanalysis of GlobalPlatform Secure Channel Protocols

[https://anonfiles.com/j7zdY9e2pc/SCP02\_vs\_SCP03\_security\_pdf](https://anonfiles.com/j7zdY9e2pc/SCP02_vs_SCP03_security_pdf)

It indicates SCP02 is not secure enough and SCP03 shall be used instead.

---

<div class="post-metadata">

**Author:** ![jan](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/j/ce7236/32.png) [@jan](https://support.nitrokey.com/u/jan)\
**Post date:** [October 13, 2020, 3:03pm UTC](https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690/2 "2020-10-13T15:03:26Z")

</div>

To make things clear: You need a software to communicate with the Nitrokey HSM by using TR-03110. If you are looking at using it at a desktop, ordinary software doesn’t use that protocol.

---

<div class="post-metadata">

**Author:** ![sanyo](https://support.nitrokey.com/user_avatar/support.nitrokey.com/sanyo/32/593_2.png) [@sanyo](https://support.nitrokey.com/u/sanyo)\
**Post date:** [October 13, 2020, 3:12pm UTC](https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690/3 "2020-10-13T15:12:29Z")

</div>

Please let me know, which software does support BSI TR-03110 protection?

Does OpenSC uses this protocol or is it transparent for OpenSC so that OpenSC is even not aware of it being used and just passed through OpenSC?

Is there a command line software which can encrypt/decrypt text strings or messages by HSM2 algos provided the strings are being transferred to HSM2 via BSI TR-03110?

May be some PGP software is compatible like GPG or Sequoia PGP library ?

Where can I see a list of open source software for Linux and BSD which uses BSI TR-03110 protocol for protecting its data exchange channel?

---

<div class="post-metadata">

**Author:** ![jan](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/j/ce7236/32.png) [@jan](https://support.nitrokey.com/u/jan)\
**Post date:** [October 14, 2020, 10:26am UTC](https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690/4 "2020-10-14T10:26:24Z")

</div>

I’m not aware of any popular or open source software which supports TR-03110. This is an enterprise feature your software would need to incorporate. Beside of that, [PKI As A Service](https://pki-as-a-service.net/) supports it.

---

<div class="post-metadata">

**Author:** ![sanyo](https://support.nitrokey.com/user_avatar/support.nitrokey.com/sanyo/32/593_2.png) [@sanyo](https://support.nitrokey.com/u/sanyo)\
**Post date:** [October 14, 2020, 2:50pm UTC](https://support.nitrokey.com/t/how-secure-is-hsm2-data-exchange-channel/2690/5 "2020-10-14T14:50:18Z")

</div>

Jan, the page you mentioned requires me to login:

> Login Required  
> Please insert your SmartCard-HSM and press continue .

Where can I read more details about command line tools and/or API to encrypt and decrypt text strings via PKI software you referred using HSM2 via encrypted data channel of course?