The Backbone of Cybersecurity: Hardware Security Modules
1–10 of 38 posts
Re: The Backbone of Cybersecurity: Hardware Security Modules
#2[flagged]
Re: The Backbone of Cybersecurity: Hardware Security Modules
#3If anyone wants their own HSM, Nitrokey and Yubikey sell them:
* https://shop.nitrokey.com/shop/nkhs2-nitrokey-hsm-2-7
* https://www.yubico.com/product/yubihsm-2-series/yubihsm-2/
Consider buying two to have backups ((encrypted) export/import-backup/restore is supported).
Creating your own CA:
* https://docs.nitrokey.com/hsm/mac/certificate-authority
Considering using 'helper software' for running a CA:
* https://github.com/smallstep / https://smallstep.com/docs/step-ca/
* https://github.com/OpenVPN/easy-rsa
* https://github.com/FiloSottile/mkcert (good for on-one-host dev stuff)
Re: The Backbone of Cybersecurity: Hardware Security Modules
#4[dead]
Re: The Backbone of Cybersecurity: Hardware Security Modules
#5I built my own key-vault/HSM since I wanted to use various cryptographic algorithms (argon2 and signing JWTs) not supported by typical HSMs.
repo for the software: https://codeberg.org/ChristopherChmielewski/cns
Re: The Backbone of Cybersecurity: Hardware Security Modules
#6if anyone wants an open source HSM on the cheap based on a raspberry pi that is pkcs11 compatible, check out the picohsm project https://www.picokeys.com/pico-hsm/
Re: The Backbone of Cybersecurity: Hardware Security Modules
#7I see many people here recommending products without the caveats included in the article such as tamper-resistant features. It is a warning for 1-Click [1] users.
Re: The Backbone of Cybersecurity: Hardware Security Modules
#8if anyone wants an open source HSM on the cheap based on a raspberry pi that is pkcs11 compatible, check out the picohsm project https://www.picokeys.com/pico-hsm/
> Operation Time
> RSA key length (bits) Average time (seconds)
> 1024 16
> 2048 124
> 3072 600
> 4096 ~1000
That must be a typo, that they mean milli seconds - right? Otherwise this seems too slow to do anything useful?
Re: The Backbone of Cybersecurity: Hardware Security Modules
#9if anyone wants an open source HSM on the cheap based on a raspberry pi that is pkcs11 compatible, check out the picohsm project https://www.picokeys.com/pico-hsm/
> Operation Time > RSA key length (bits) Average time (seconds) > 1024 16 > 2048 124 > 3072 600 > 4096 ~1000 That must be a typo, that they mean milli seconds - right? Otherwise this seems too slow to do anything useful?
That does seem exceptionally slow, although RSA key generation is also notoriously slow.
(In most settings where an HSM is used, you shouldn’t be generating keys all that often. So these times are often acceptable.)
Re: The Backbone of Cybersecurity: Hardware Security Modules
#10Two small notes on definitions:
---
"Secure Elements / Hardware Roots of Trust: Embedded within chips, these elements provide a secure base for trusted operations and are often used in mobile devices and IoT applications."
SEs (Secure Elements) are discrete components. Smartcards and SIM cards are examples of SEs. They are different from a root of trust. When talked about in a cryptographic context a 'hardware root of trust' is usually a public key embedded in an immutable ROM.
---
"Secure Enclaves: These provide isolated execution environments within a CPU..."
Not necessarily within a CPU. Apple has the SEP (Secure Enclave Processor) which is a discrete core on the die.