Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I don't like smartcards, HSMs, YubiKeys, etc.

devever.net

Post reply on HN
Print view View original

51–60 of 139 posts

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#51

Post by bogomipz »

konstmonst wrote: post #19

What is the problem to take a 10$ stm32f discovery board and use it as TPM. There are different flash protections: 1) you can read/write flash via JTAG 2) you can only write flash, but not read the old one 3) you can't rewrite flash, neigher can you read it. You will still have to implement USB communication, but there is already a lib from STM for it. Some models also have generous flash (in MB ranges). You can use…

I had to look up TPM, I didn't realize there was an open standard for crypto processors. Is it safe to say that most HSMs are TPMs?

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#53

Post by jaytaylor »

kawsper wrote: post #21
wzdd wrote: post #16

Odd -- JavaCard smartcards are available for under $5, have crypto co-processors, and certainly support general-purpose code. See for example my project for KeePass, http://code.lardcave.net/2016/08/06/1/ . After programming, you can choose to lock down the card (which means you can only erase the card, not modify it). I'm using NXP chips and although I haven't investigated completely I would be highly surprised if i…

I even have a ring that runs JavaCard software on its JVM, they are sold for cheap, and I bought one just for fun and history, there is an eBay listing here: http://www.ebay.co.uk/itm/JAVA-RING-RARE-Sun-Microsystems-JA...

What can you actually do with it?

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#55

Post by bogomipz »

danpalmer wrote: post #31

I'd like to address the difference between a SmartCard and an HSM as I feel like the author doesn't acknowledge some of the practical differences. While at the core they are both "hardware security", i.e. a physical chip that implements security, an "HSM" as I have commonly seen the term used is a completely different thing in most other ways. An HSM is typically a 1-2U server, that is designed to provide high throug…

I'm not sure there's any qualification for how much rack space or form factor HSM an HSM uses.

For instance the YubiCo HSM is just a USB device that plugs into a server.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#57

Post by voltagex_ »

wzdd wrote: post #16

Odd -- JavaCard smartcards are available for under $5, have crypto co-processors, and certainly support general-purpose code. See for example my project for KeePass, http://code.lardcave.net/2016/08/06/1/ . After programming, you can choose to lock down the card (which means you can only erase the card, not modify it). I'm using NXP chips and although I haven't investigated completely I would be highly surprised if i…

Can I get something that would allow me to unlock an SSH key by tapping a card to my phone?

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#58

Post by runeks »

Cyph0n wrote: post #7

The issue of affordable HSM/TPM for general purpose use is something my research group is trying to solve. We have most of the theory down, but the implementation is a work in progress. The key point is trying to maintain full physical isolation from the CPU and OS, while also providing general low-level computing capabilities. Do you guys think something like this could be patented and/or commercialized?

> Do you guys think something like this could be patented > and/or commercialized?

I would definitely be interested if it's general purpose and open/verifiable.

I think it would make sense if you teamed up with an insurance company. That way, you could prove your technology once, to the insurance company, and sell devices with insurance against compromise. So all your potential customers wouldn't have to audit your technology, since this has been taken care of by the insurance company.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#59

Post by mentat »

akytt wrote: post #40
sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

Why do you have your HSM where Heartbleed matters?

This exactly. You use a HSM so it doesn't matter if your server gets popped.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#60

Post by danpalmer »

bogomipz wrote: post #55
danpalmer wrote: post #31

I'd like to address the difference between a SmartCard and an HSM as I feel like the author doesn't acknowledge some of the practical differences. While at the core they are both "hardware security", i.e. a physical chip that implements security, an "HSM" as I have commonly seen the term used is a completely different thing in most other ways. An HSM is typically a 1-2U server, that is designed to provide high throug…

I'm not sure there's any qualification for how much rack space or form factor HSM an HSM uses. For instance the YubiCo HSM is just a USB device that plugs into a server.

Sure, I did say "typically". Obviously the form factor does not define an HSM, but in general the term is used to refer to dedicated machines designed for high performance at scale with a large number of users, rather than a SmartCard/USB device which is, typically, for a single user.
Post reply on HN