4 ms·

At least for me, this "HSM" makes the right trade-offs. I don't need tamper self-destruction, for example. My adversaries are either: 1) thieves of opportunity,

At least for me, this "HSM" makes the right trade-offs. I don't need tamper self-destruction, for example. My adversaries are either: 1) thieves of opportunity, or 2) the "world conspiracy" / nation state intelligence agencies who suddenly might decide to spy on me if the world takes a dystopian turn. For 1) tamper-proofness is total overkill. For 2), I doubt that any civilian technology would withstand a hardware attack e.g. by the NSA. If I just look at the equipment we have at our lowly, underfunded physics laboratory - probe stations, decapping facilities, wirebonders, an expert can already defeat many older hardware countermeasures with that. And I know there are much more sophisticated techniques out there, e.g. to image chips and extract secrets. Also, a variation of the "wrench" argument: Who says that the vendors of closed HSMs have not all been just forced to place backdoors? The biggest realistic threat to me (by probability times possible damage) is by far that I might catch a Trojan. This device provides at least partial protection, in that it makes it hard for a remote attacker to sign messages or log on in my name.

technion 10y ago
I see this as a lot like the "GPG is very secure but no one uses it" scenario. People who have certain needs can open up their wallets for certain products. The adversary for the vast majority of practical scenarios is some remote attacker exploiting some unpatched vulnerability. How much less of an issue would all the recent password dumps be if the hash algorithm was a simple HMAC on a device like this? And surely a bitcoin wallet has a better chance on this device, than sitting in a file on my desktop just hoping the password never gets key logged. And, moreso than any other point, at the current price point, this device is actually plausible to experiment with.
- lisper 10y ago
  > at the current price point, this device is actually plausible to experiment with Yes, that's really the idea at this point. Neither the hardware nor the firmware have been audited, so it would be unwise to use it to protect anything mission-critical at the moment (which is why there's a big disclaimer to that effect on the order page). On the other hand, the approach does seem to be holding up well to initial scrutiny.
akiselev 10y ago
> I doubt that any civilian technology would withstand a hardware attack e.g. by the NSA. You'd probably be wrong. There are several consumer accessible chips (i.e. from Atmel that you can order on digikey) that use tamper-proof silicon where the very act of opening up the package to inspect the die destroys the private key data. Even civilian tamper-proof tech is extremely robust, using physical phenomena to protect the data instead of obfuscation. That doesn't preclude someone with the resources of the NSA from figuring it out or backdooring the design but the resources needed to defeat tamper proof devices is orders of magnitude greater than those needed to use them and that gap is constantly growing.
- captainmuon 10y ago
  Well, that's probably true, but my only source for that is what people wrote on the internet. OTOH, I know e.g. the NSA has basically infinite resources. Anecdotally, I've heard that there are ways to destructively image complete chips, and not just the layout but also the internal charge state. I believe the technique used femtosecond lasers. Of course that is also hearsay and I can't validate it. My point is, as an interested layman, I don't know enough to trust this technology with my life - but it would be exactly useful if my life depended on keeping my secrets. So that contradiction kind of reduces its value for me. I'm sure people with the required knowledge can properly evaluate these products, and for those people they are probably immensely useful.
  - lisper 10y ago
    I would not bet my life savings against the NSA's ability to compromise the SC4-HSM if they had physical possession. On the other hand, there is a simple defense against physical compromise that would probably hold up even against the NSA: encrypt the keys with a strong pass phrase. That wouldn't hold up against a monkey wrench attack (https://xkcd.com/538/ https://xkcd.com/538/), of course, but there are limits to what you can do for <$100.
  - hellomoto998 10y ago
    Infinite resources don't exist. Something I was told back when I was working around WikiLeaks is, "You can't make it impossible for them to get your goat, but you want to make it very, very expensive."

technion 10y ago

I see this as a lot like the "GPG is very secure but no one uses it" scenario. People who have certain needs can open up their wallets for certain products. The adversary for the vast majority of practical scenarios is some remote attacker exploiting some unpatched vulnerability. How much less of an issue would all the recent password dumps be if the hash algorithm was a simple HMAC on a device like this? And surely a bitcoin wallet has a better chance on this device, than sitting in a file on my desktop just hoping the password never gets key logged. And, moreso than any other point, at the current price point, this device is actually plausible to experiment with.

lisper 10y ago
> at the current price point, this device is actually plausible to experiment with Yes, that's really the idea at this point. Neither the hardware nor the firmware have been audited, so it would be unwise to use it to protect anything mission-critical at the moment (which is why there's a big disclaimer to that effect on the order page). On the other hand, the approach does seem to be holding up well to initial scrutiny.

akiselev 10y ago

> I doubt that any civilian technology would withstand a hardware attack e.g. by the NSA. You'd probably be wrong. There are several consumer accessible chips (i.e. from Atmel that you can order on digikey) that use tamper-proof silicon where the very act of opening up the package to inspect the die destroys the private key data. Even civilian tamper-proof tech is extremely robust, using physical phenomena to protect the data instead of obfuscation. That doesn't preclude someone with the resources of the NSA from figuring it out or backdooring the design but the resources needed to defeat tamper proof devices is orders of magnitude greater than those needed to use them and that gap is constantly growing.

captainmuon 10y ago
Well, that's probably true, but my only source for that is what people wrote on the internet. OTOH, I know e.g. the NSA has basically infinite resources. Anecdotally, I've heard that there are ways to destructively image complete chips, and not just the layout but also the internal charge state. I believe the technique used femtosecond lasers. Of course that is also hearsay and I can't validate it. My point is, as an interested layman, I don't know enough to trust this technology with my life - but it would be exactly useful if my life depended on keeping my secrets. So that contradiction kind of reduces its value for me. I'm sure people with the required knowledge can properly evaluate these products, and for those people they are probably immensely useful.
- lisper 10y ago
  I would not bet my life savings against the NSA's ability to compromise the SC4-HSM if they had physical possession. On the other hand, there is a simple defense against physical compromise that would probably hold up even against the NSA: encrypt the keys with a strong pass phrase. That wouldn't hold up against a monkey wrench attack (https://xkcd.com/538/ https://xkcd.com/538/), of course, but there are limits to what you can do for <$100.
- hellomoto998 10y ago
  Infinite resources don't exist. Something I was told back when I was working around WikiLeaks is, "You can't make it impossible for them to get your goat, but you want to make it very, very expensive."