Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Backbone of Cybersecurity: Hardware Security Modules

join.tech

Post reply on HN
Print view View original

11–20 of 38 posts

Re: The Backbone of Cybersecurity: Hardware Security Modules

#11

Post by RobotToaster »

throw0101d wrote: post #3

If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 * https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ Consider buying two to have backups ((encrypted) export/import-backup/restore is supported). Creating your own CA: * https://docs.nitrokey.com/hsm/mac/certificate-authority Considering using 'helper software' for running a CA: * https://git…

Do you know where I can find the source for the nitrokey HSM 2 hardware? It claims to be OSH but I can't find the schematics on their github? (Probably I've just overlooked it, they have a lot of repos)

Re: The Backbone of Cybersecurity: Hardware Security Modules

#12

Post by troyvit »

wslh wrote: post #7

I see many people here recommending products without the caveats included in the article such as tamper-resistant features. It is a warning for 1-Click [1] users. [1] https://en.wikipedia.org/wiki/1-Click

Good call. OnlyKey talks a little about it: https://docs.onlykey.io/security.html

Re: The Backbone of Cybersecurity: Hardware Security Modules

#13

Post by lossolo »

nimbius wrote: post #6

if anyone wants an open source HSM on the cheap based on a raspberry pi that is pkcs11 compatible, check out the picohsm project https://www.picokeys.com/pico-hsm/

Just be aware of this https://github.com/polhenarejos/pico-hsm/issues/28

Re: The Backbone of Cybersecurity: Hardware Security Modules

#14

Post by throwaway256346 »

I work with industrial HSMs (those expensive ones) on a daily basis and their SDKs are a bugfest (both client side and in-device). They are audited (FIPS140-2 and now 3 approved even!) but apperantly testing the firmware against the test vectors from the RFCs is too much too ask for...

Contacting support about broken firmware or broken documentation is a trip to tartarus in itself. Decompiling the libraries is usually faster to figure out what is wrong.

Don't put too much trust in them unless you really have to.

Re: The Backbone of Cybersecurity: Hardware Security Modules

#15

Post by client4 »

A tangential topic studies how you can actually trust the hardware. Andrew "Bunnie" Huang has done a lot of great work in the area, first with Precursor, and lately with Infra-Red, in situ (IRIS) inspection of silicone.

* https://www.bunniestudios.com/blog/2020/introducing-precurso...

* https://www.bunniestudios.com/blog/2024/iris-infra-red-in-si...

Re: The Backbone of Cybersecurity: Hardware Security Modules

#16

Post by madduci »

throw0101d wrote: post #3

If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 * https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ Consider buying two to have backups ((encrypted) export/import-backup/restore is supported). Creating your own CA: * https://docs.nitrokey.com/hsm/mac/certificate-authority Considering using 'helper software' for running a CA: * https://git…

Also worth mentioning EJBCA from PrimeKey. They also sell their own HSM appliance

Re: The Backbone of Cybersecurity: Hardware Security Modules

#17

Post by throw0101d »

RobotToaster wrote: post #11
throw0101d wrote: post #3

If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 * https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ Consider buying two to have backups ((encrypted) export/import-backup/restore is supported). Creating your own CA: * https://docs.nitrokey.com/hsm/mac/certificate-authority Considering using 'helper software' for running a CA: * https://git…

Do you know where I can find the source for the nitrokey HSM 2 hardware? It claims to be OSH but I can't find the schematics on their github? (Probably I've just overlooked it, they have a lot of repos)

* https://www.nitrokey.com/products/nethsm / https://github.com/Nitrokey/nethsm/

* https://security.stackexchange.com/questions/246547/open-sou...

Re: The Backbone of Cybersecurity: Hardware Security Modules

#18

Post by throw0101d »

madduci wrote: post #16
throw0101d wrote: post #3

If anyone wants their own HSM, Nitrokey and Yubikey sell them: * https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7 * https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/ Consider buying two to have backups ((encrypted) export/import-backup/restore is supported). Creating your own CA: * https://docs.nitrokey.com/hsm/mac/certificate-authority Considering using 'helper software' for running a CA: * https://git…

Also worth mentioning EJBCA from PrimeKey. They also sell their own HSM appliance

> They also sell their own HSM appliance

Lots of folks sell appliances, but if you want to homelab, DIY, or do a small-scale deployment then the above items are simply USB keys so that be put into any server (or VM, via pass-through).

Re: The Backbone of Cybersecurity: Hardware Security Modules

#19

Post by p_l »

throwaway256346 wrote: post #14

I work with industrial HSMs (those expensive ones) on a daily basis and their SDKs are a bugfest (both client side and in-device). They are audited (FIPS140-2 and now 3 approved even!) but apperantly testing the firmware against the test vectors from the RFCs is too much too ask for... Contacting support about broken firmware or broken documentation is a trip to tartarus in itself. Decompiling the libraries is usuall…

Any comments you could share about Luna HSM ones?

Recall seeing a lot of them as reasonably accessible in cloud and not only setups, thus my interest.

Re: The Backbone of Cybersecurity: Hardware Security Modules

#20

Post by dfox »

I particularly like the Luna USB HSM 7 that the DNSSec root is in the process of switching to. But price of the thing is truly ridiculous, especially for its handheld form-factor.

For a long time (10 years?) I'm thinking about how I would design an (possibly open source) HSM and I'm pretty sure that I have reasonably secure and tamper proof design (including external tamper input, which was the obvious feature for the original application I had in mind). But well, the idea of putting all that into handheld device with no battery…

Post reply on HN