Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I don't like smartcards, HSMs, YubiKeys, etc.

devever.net

Post reply on HN
Print view View original

81–90 of 139 posts

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#81

Post by EvilTerran »

pmarreck wrote: post #74
sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

Is there any way to do what a HSM does, in software? (Maybe with OS support)

Not really, no. AIUI, the whole point of having a hardware security module is that it only leaves a very narrow attack surface (ie, the protocol for communicating with the device) for malicious software to try to exfiltrate the sensitive data through, with no way to get around it - so if that interface is sufficiently hardened, you should be secure regardless of any weaknesses elsewhere in the system.

In contrast, while you could think of, say, an ssh key agent as a sort of "software security module", such things are inherently vulnerable to low-level attacks that side-step the intended interface. Say, a kernel exploit that grabs the decrypted key straight from the agent's memory.

So if you need to keep your secrets safe even if you unwittingly use them on a comprised OS, you can only pull that off with a hardware module.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#82

Post by tjohns »

bogomipz wrote: post #20

The OP states: "Smartcards and HSMs are essentially two “brands” for the same thing: a chip which guards access to the data stored within it, and will only allow that data to be accessed in certain ways or under certain conditions. HSMs are the “enterprise” label for such devices, whereas smartcards are essentially the same thing, only cheaper." Yubikey(mentioned in the title) is a TOTP card that works with the HSM o…

A Yubikey can be run either in TOTP mode, in U2F mode, or as a generic smartcard. (Or a combination of the above.) It's configurable.

I use a Yubikey that's configured both as a U2F token for Google, as well as a smartcard for PGP/SSH use.

And their core, the construction of a Yubikey, smartcard, and HSM are very similar. The core idea is that you have physically secure memory guarded by a dedicated cryptoprocessor, so that your secrets never have to be exposed to the host OS when performing a signing operation.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#83

Post by kosma »

lisper wrote: post #80
kosma wrote: post #62

Earlier quoted context omitted.

Send me a locked STM32F1 chip and I'll send you back the binary contained in it. Not kidding. The problem with general purpose MCUs is that they are trivial to break.

Can you do that with an F4? If so, I'd like to take you up on your offer. I'll even pay you if you tell me how you did it.

Security on F4 is way better. I haven't found a way to circumvent the JTAG fuse - but to be honest, I never really tried as I don't have access to proper glitching hardware.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#84

Post by HNSucksAss »

I remember the '90s, when smartcards were supposedly about to revolutionize our personal data storage. Imagine, your MasterCard, American Express, ATM, stored-value, medical card (and history!), passport, loyalty cards... ALL IN ONE!

Here we are in the U.S. 20 years later, and we can't even get the credit-card portion right. We still have separate cards for everything, and somehow the card vendors in the U.S. are too stupid to implement chip-&-PIN, which the rest of the planet has understood for ages.

So now our transactions take longer, and we're STILL SIGNING for our card transactions with not a PIN in sight.

And given the results of the latest election, things aren't going to get better anytime soon.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#85

Post by lisper »

kosma wrote: post #83
lisper wrote: post #80

Earlier quoted context omitted.

Can you do that with an F4? If so, I'd like to take you up on your offer. I'll even pay you if you tell me how you did it.

Security on F4 is way better. I haven't found a way to circumvent the JTAG fuse - but to be honest, I never really tried as I don't have access to proper glitching hardware.

What would you need?

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#86

Post by bogomipz »

danpalmer wrote: post #60
bogomipz wrote: post #55

Earlier quoted context omitted.

I'm not sure there's any qualification for how much rack space or form factor HSM an HSM uses. For instance the YubiCo HSM is just a USB device that plugs into a server.

Sure, I did say "typically". Obviously the form factor does not define an HSM, but in general the term is used to refer to dedicated machines designed for high performance at scale with a large number of users, rather than a SmartCard/USB device which is, typically, for a single user.

I see, that makes sense. Cheers.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#87

Post by bogomipz »

nicolas314 wrote: post #72
bogomipz wrote: post #51

Earlier quoted context omitted.

I had to look up TPM, I didn't realize there was an open standard for crypto processors. Is it safe to say that most HSMs are TPMs?

They are quite different beasts. HSMs offer tamper protection through various physical means like wrapping all components in resin, or implementing self-destruction mechanisms. Smart cards protect their secrets against all kinds of side channel attacks trying to read keys off a thermal signature for example. TPMs in most cases are based on smart cards but can also be implemented in a TEE (Trusted Execution Environmen…

Thanks for the clarification.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#88

Post by yuhong »

sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

OT, but I wonder how many of these LBs are/were TLS version or extension intolerant: http://www.bus.umich.edu/KresgePublic/Journals/Gartner/resea...

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#89

Post by ci5er »

Cyph0n wrote: post #7

The issue of affordable HSM/TPM for general purpose use is something my research group is trying to solve. We have most of the theory down, but the implementation is a work in progress. The key point is trying to maintain full physical isolation from the CPU and OS, while also providing general low-level computing capabilities. Do you guys think something like this could be patented and/or commercialized?

IBM's Citadel project and Doug Tygar's group at CMU researched crypto co-processors about 20 years ago. You can still find Bennet Yee's PhD thesis online. It and it's bibliographical references gave a pretty good overview of the lay-of-the-land at that time. You'd think that the theory might have progressed some since then, but theory doesn't progress as fast as a front-end development framework...

Bad memories of how touchy these babies were when they first came out:

  - http://www-03.ibm.com/security/cryptocards/pciecc2/overview.shtml
EDIT: What the hell. Here's Bennet Yee's PhD thesis. So you don't have to convert it from PostScript. (That said - this is a nasty image scan - you might want to do that anyway!)

  - http://www.dtic.mil/dtic/tr/fulltext/u2/a281255.pdf
I don't think I'm going to be able dig around for the extant Usenix papers from that era on the topic right now.

Re: Why I don't like smartcards, HSMs, YubiKeys, etc.

#90

Post by EvanAnderson »

sofaofthedamned wrote: post #34

HSMs are shit. In a previous role we used a major vendor's HSM to protect our private keys. VERY expensive kit, more expensive than the load balancers and servers combined. We needed to use Elliptic Curve keys for a particular customer - so it got even more expensive as we had to buy: 1. A license from the LB vendor to use the HSM 2. A licence from the HSM vendor to use EC with the LB. ... even though they trumpeted…

We started looking into an HSM solution for a Customer and quickly found out that the entrenched "big" HSM manufacturers are all about lock-in, questionable documentation (and strong insistence that we use their very expensive service rather than attempt our own integration), severe granularity in licensing features, and _insane_ prices (on a 3-5 year product replacement 'treadmill').

We ended up using the Nitrokey HSM platform and have been very pleased with the results.

Post reply on HN