Yubico announces tiny, cheap YubiHSM 2

confounded wrote: post #3

What's the advantage of this over the ~$100 open source NitroKey HSM? https://www.nitrokey.com/files/doc/Nitrokey_HSM_English.pdf

From a quick check, I'd say the big differences (Yubikey HSM 2 over Nitrokey HSM) are: 4096-bit RSA, curve25519, higher capacity, and smaller form factor.

EDIT: On further thought, the small form factor would be good for physical verification. I could get a good, high-quality server, plug this into the front USB port, and then use some sort of transparent epoxy to seal it in. Having it on the front of the server would make it easy to quickly confirm that it's in place (instead of hunting around the back of the server, and it would be small enough to seal into the USB port.

Re: Yubico announces tiny, cheap YubiHSM 2

#8

Post by packetized » Thu, Nov 02, 2017, 5:20 AM UTC

confounded wrote: post #3

What's the advantage of this over the ~$100 open source NitroKey HSM? https://www.nitrokey.com/files/doc/Nitrokey_HSM_English.pdf

4096-bit RSA keys, for one.

Re: Yubico announces tiny, cheap YubiHSM 2

#9

Post by babar » Thu, Nov 02, 2017, 5:22 AM UTC

How much of a market is there for HSMs that are not FIPS 140-2 certified?

Re: Yubico announces tiny, cheap YubiHSM 2

#10

Post by CaliforniaKarl » Thu, Nov 02, 2017, 5:37 AM UTC

babar wrote: post #9

How much of a market is there for HSMs that are not FIPS 140-2 certified?

It looks like the original YubiHSM wasn't FIPS 140-2 certified either.

https://www.yubico.com/support/knowledge-base/categories/art...

Presumably, the original YubiHSM sold well enough to justify the R&D to make the YubiHSM 2, even one that's not FIPS 140-2!