Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

Source

arXiv

arxiv.org/abs/2608.06130v1

Read the source

Source

Plain-Language Brief

The authors propose a new architecture to improve security for AI agents that perform cryptographic operations by replacing software-stored private keys with hardware-confined ones, using a vendor-neutral PKCS#11 interface. The hardware keystore (HSM, TPM, smart card) performs the cryptographic operations on-device and sends only the result to the host through opaque handles. The authors evaluate their system against various injection scenarios and find that it significantly reduces the success rate of attacks compared to a baseline.

What the Document Says

  • AI agents perform cryptographic operations using keys stored in software-accessible locations.
  • Recent production incident demonstrated the practical severity of key exfiltration via email injection.
  • Proposed architecture replaces software-resident keys with hardware-confined keys accessible through PKCS#11 interface.
  • Hardware keystore executes cryptographic operations on-device and sends only the result to the host via opaque handles.
  • Architecture includes a Zero-Trust enforcement stack consisting of session identity, scope bounds, semantic validation, taint tracking, and hardware execution boundary.
  • Evaluated against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template.
  • Run four LLM models in baseline mode and found a success rate of 19.3% for attacks, which reduced to 0% when protected.
  • No false positives across four benign task scenarios

Key Concepts Mentioned

  • AI agents
  • cryptographic operations
  • private keys
  • exfiltration
  • hardware keystore
  • PKCS#11 interface
  • Zero-Trust enforcement stack
  • injection scenarios
  • LLM models

Claims Made by the Document

  • Replacing software-resident keys with hardware-confined ones improves security.
  • Hardware confinement reduces the success rate of attacks compared to a baseline.

Evidence Used

  • Recent production incident demonstrated practical severity of key exfiltration
  • Evaluated against 12 injection scenarios and found that protected ASR is 0%

Methods / Approach

  • Using hardware-confined keys through PKCS#11 interface
  • Evaluating against various injection scenarios

Limitations Stated by the Authors

Not stated in source

Limitations Noted by the Agent

Agent interpretation — not from the source.

The data provided does not detail the specific implementation or potential limitations of the proposed architecture.

Open Questions

  • What is the specific implementation of the proposed architecture?
  • Are there any potential limitations or trade-offs with using hardware-confined keys?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The source does not provide detailed information about the specific implementation of the proposed architecture, nor any potential limitations or trade-offs associated with it.

Raw Abstract / Excerpt

AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.