Key Ceremony with an Untrained Backup Custodian
A card personalization bureau is bringing a new HSM online for EMV key generation. The ceremony procedure requires three key custodians, each holding one share, with dual control for every step; no single person may know or hold all shares. On the scheduled Saturday, custodian A is on medical leave, and the designated backup, an operations analyst, has read the procedure but has not completed the formal custodian training or signed the split-knowledge agreement. The HSM vendor's engineer is remote and will guide the ceremony over a web session. The service delivery manager proposes that custodian B enter both B's and A's shares while the analyst watches as a second person, arguing that 'two people are present, so dual control is satisfied.' The production cutover is Monday.
1. Is the manager's proposal-custodian B enters both B's and A's shares while the analyst watches-consistent with dual control and split knowledge? Explain.
Read the worked answer
No. Dual control means two or more people are required to perform a sensitive operation; split knowledge means no single person knows or holds the complete secret. If B enters A's share as well as B's, B has possession of two shares. Depending on the threshold, two shares may be enough to reconstruct or use the key, so the analyst's passive observation does not restore split knowledge. The analyst is not a trained custodian, has not signed the split-knowledge agreement, and cannot meaningfully challenge B's actions. The result is a ceremony controlled by one knowledgeable person with a witness, which is not the same as two knowledgeable custodians exercising independent control. The missing training and agreement are separate defects: the backup was never qualified to hold a share. I would stop the ceremony and not load production keys under this proposal.
2. What options could preserve the Monday cutover without violating the requirement? State the conditions for each.
Read the worked answer
Option one: use a fully trained alternate custodian who has signed the split-knowledge agreement and can independently hold A's share; if A's share is sealed, retrieve it under dual control with two authorized custodians and document the access. Option two: reschedule the ceremony to a time when A or a qualified alternate is available-this is the cleanest choice if the key is not yet in production. Option three: perform a new ceremony with a different threshold configuration only if policy explicitly allows it and the design still prevents any single person from reconstructing the key. What is not acceptable is having B enter both shares, or treating the analyst as a custodian after a quick briefing. If management wants a risk acceptance, it must be written, time-bound, approved by the security owner, and must not create a single person with access to the full key. Production pressure alone is not a control.
3. What controls should apply to the remote HSM vendor engineer during the ceremony?
Read the worked answer
Verify the engineer's identity and authorization before the session, use a dedicated session from a known endpoint, and require a custodian to observe every command and screen. The engineer should not have unattended control, should not receive shares through chat or email, and should not be able to copy files or use clipboard transfer. Record the session or capture a detailed command log, restrict the vendor to the specific HSM management functions needed, and terminate access immediately after the ceremony. The custodians remain responsible for entering shares; the vendor guides but does not hold them. If the vendor needs to run a command that exposes key material, the custodians must perform or confirm it under dual control.