3 ms·
I've used both Thales nShield and Bull Proteccio models at my previous work. Both are priced in the five figure euros/dollars range for any reasonable operatio
by Darkstryder 8y ago
I've used both Thales nShield and Bull Proteccio models at my previous work.
Both are priced in the five figure euros/dollars range for any reasonable operational setup.
(In the sense that you need at least a production HSM and an additional machine to be able to react quickly to incidents and experiment with).
The YubiHSM v2 seems very promising to me too, but the thing you have to understand with HSMs is that their certifications are often as important, or even more important, than their actual security.
(Usually you use HSMs because you legally have to and not just for fun)
In that regard, both the nShield and the Proteccio are qualified at Level 3 of FIPS 140-2. This is a very expensive qualification to pass and the investment is reflected back in the price of those products.
Yubico does not advertise any qualification level for the YubiHSM 2, therefore I infer they did not pass any certification process. Hence I feel they will target a different market than Thales and Bull.
(People wanting more security but without needing certifications)
A 650$ FIPS level 3, eIDAS qualified HSM would be groundbreaking. As certification processes are quite political, I'm not even sure it would be possible as it would basically decimate current HSMs vendors.
Let's hope the YubiHSM v3 could be that though ? :)
- pmorici 8y agoYes, if you want FIPS 140-2 you are going to pay the big bucks. Yubico's Yubikey 4 has a FIPS certified version so they have been through the process with other products but you are right that their HSM is not certified. If you care about FIPS certification you can look up if a product is certified or not in NIST's database. [0] [0] https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search https://csrc.nist.gov/projects/cryptographic-module-validati...