4 ms·

Yubico also offers the YubiHSM which is more tailored towards this use case (albeit much more expensive): https://www.yubico.com/product/yubihsm-2/ https://www.

Yubico also offers the YubiHSM which is more tailored towards this use case (albeit much more expensive): https://www.yubico.com/product/yubihsm-2/ https://www.yubico.com/product/yubihsm-2/

deleted 8y ago
[deleted]
excalibur 8y ago
That price point needs to come way down. Yubico thinks they're competing with established HSM vendors, but they're really competing with their own products. If I have a small business and am considering a hackish YubiKey-as-HSM for $40, it may be worth it to spend around $100 on an officially supported YubiHSM instead.
- closeparen 8y ago
  If $650 is a lot for your business, wouldn’t you just keep the keys on disk? Hardware-based security implies that you have a compliance regime to satisfy, or at least something valuable to protect.
  - lwhalen 8y ago
    Agreed. For even a small tech business, $650 should be in the 'lol whatever' category of purchasing - especially if there's compliance regimes mandating some kind of HSM in the stack.
  - kondor6c 8y ago
    However, this device lacks FIPS 140-2 certification of any type, which is a huge detractor for any company wanting to shovel that kind of money towards a solution. I checked the "NIST List" (rhymes haha), and they might have this module under evaluation: https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Modules-In-Process/Modules-In-Process-List https://csrc.nist.gov/Projects/Cryptographic-Module-Validati...
    - closeparen 8y ago
      FIPS certified HSMs cost 10-100x what the YubiHSM does.
- StavrosK 8y ago
  Why aren't they competing with established vendors?
  - deleted 8y ago
    [deleted]
kakwa_ 8y ago
If you want a cheap HSM, there is also nitrokey: https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 I've bought one, but didn't use it yet. I had ideas to use it to test an HSM + pkcs11 OpenSSL engine setup in a personal project (RFC3161 server), but I didn't found the time to play with it yet. However, the standard tooling to interact with a P11 device under Linux is a bit of a mess, you have tooling from gnutls, p11-kit and OpenSSL (kind of actually, they kind of broke arguments passing, for example the URI of the key not being a valid path, when using external engines). Also, if you want to play with an HSM without a physical HSM, softhsm is for you (https://www.opendnssec.org/softhsm/ https://www.opendnssec.org/softhsm/).

Yubico also offers the YubiHSM which is more tailored towards this use case (albeit much more expensive): https://www.yubico.com/product/yubihsm-2/ https://www.yubico.com/product/yubihsm-2/

deleted 8y ago

[deleted]

excalibur 8y ago

That price point needs to come way down. Yubico thinks they're competing with established HSM vendors, but they're really competing with their own products. If I have a small business and am considering a hackish YubiKey-as-HSM for $40, it may be worth it to spend around $100 on an officially supported YubiHSM instead.

closeparen 8y ago
If $650 is a lot for your business, wouldn’t you just keep the keys on disk? Hardware-based security implies that you have a compliance regime to satisfy, or at least something valuable to protect.
- lwhalen 8y ago
  Agreed. For even a small tech business, $650 should be in the 'lol whatever' category of purchasing - especially if there's compliance regimes mandating some kind of HSM in the stack.
- kondor6c 8y ago
  However, this device lacks FIPS 140-2 certification of any type, which is a huge detractor for any company wanting to shovel that kind of money towards a solution. I checked the "NIST List" (rhymes haha), and they might have this module under evaluation: https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Modules-In-Process/Modules-In-Process-List https://csrc.nist.gov/Projects/Cryptographic-Module-Validati...
  - closeparen 8y ago
    FIPS certified HSMs cost 10-100x what the YubiHSM does.
StavrosK 8y ago
Why aren't they competing with established vendors?
- deleted 8y ago
  [deleted]

kakwa_ 8y ago

If you want a cheap HSM, there is also nitrokey: https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 I've bought one, but didn't use it yet. I had ideas to use it to test an HSM + pkcs11 OpenSSL engine setup in a personal project (RFC3161 server), but I didn't found the time to play with it yet. However, the standard tooling to interact with a P11 device under Linux is a bit of a mess, you have tooling from gnutls, p11-kit and OpenSSL (kind of actually, they kind of broke arguments passing, for example the URI of the key not being a valid path, when using external engines). Also, if you want to play with an HSM without a physical HSM, softhsm is for you (https://www.opendnssec.org/softhsm/ https://www.opendnssec.org/softhsm/).