3 ms·

I also don't know why the author thinks HSMs cost "hundreds to tens of thousands of dollars". In the first place, TPMs are a subcategory of HSMs and don't cost

I also don't know why the author thinks HSMs cost "hundreds to tens of thousands of dollars". In the first place, TPMs are a subcategory of HSMs and don't cost that much. In the second place, HSMs like the Microchip ATECC608B cost <$1 for the bare board.

OJFord 6y ago
OP says devices, so I read rack-mount gear that you buy when you can't use (or trust) AWS KMS, not chips.
- noinsight 6y ago
  Even then, you can buy a Yubico YubiHSM device for 650€.
  - asalahli 6y ago
    Well, that is hundreds of dollars, isn't it? :)
- gnufx 6y ago
  Not yet implemented, but Solo 2 has a "stretch goal" to provide HSM functionality, if that would be good enough. https://www.indiegogo.com/projects/solo-v2-safety-net-against-phishing#/updates/all https://www.indiegogo.com/projects/solo-v2-safety-net-agains...
- Arnavion 6y ago
  Well, I don't know if they really meant rack-mount gear, but sure it costs a little extra to get it usable with a general-purpose computer. Specifically, you can get that Microchip HSM in a form factor that plugs into a click shield, then plug the click shield into a Raspberry Pi's GPIO pins. You now have a PKCS#11-usable HSM from a Pi. Including the click shield still puts the cost at <$20. (I have a few such setups lying around because my $dayjob includes a PKCS#11-consuming application that runs on such setups.)
- EvanAnderson 6y ago
  I implemented a firmware signing infrastructure for a large embedded hardware manufacturer using USB Nitrokey HSM devices (sub-$100/ea). We got the functionality we wanted from them at a fraction of the price point of the "big name" HSM manufacturers' offerings. The development effort to integrate the Nitrokey HSM, as a simple PKCS#11 device, was very simple. What we could get of the big-name HSM manufacturers' development docs, w/o an NDA or a purchase, looked to be much more difficult to integrate.

OJFord 6y ago

OP says devices, so I read rack-mount gear that you buy when you can't use (or trust) AWS KMS, not chips.

noinsight 6y ago
Even then, you can buy a Yubico YubiHSM device for 650€.
- asalahli 6y ago
  Well, that is hundreds of dollars, isn't it? :)
gnufx 6y ago
Not yet implemented, but Solo 2 has a "stretch goal" to provide HSM functionality, if that would be good enough. https://www.indiegogo.com/projects/solo-v2-safety-net-against-phishing#/updates/all https://www.indiegogo.com/projects/solo-v2-safety-net-agains...
Arnavion 6y ago
Well, I don't know if they really meant rack-mount gear, but sure it costs a little extra to get it usable with a general-purpose computer. Specifically, you can get that Microchip HSM in a form factor that plugs into a click shield, then plug the click shield into a Raspberry Pi's GPIO pins. You now have a PKCS#11-usable HSM from a Pi. Including the click shield still puts the cost at <$20. (I have a few such setups lying around because my $dayjob includes a PKCS#11-consuming application that runs on such setups.)
EvanAnderson 6y ago
I implemented a firmware signing infrastructure for a large embedded hardware manufacturer using USB Nitrokey HSM devices (sub-$100/ea). We got the functionality we wanted from them at a fraction of the price point of the "big name" HSM manufacturers' offerings. The development effort to integrate the Nitrokey HSM, as a simple PKCS#11 device, was very simple. What we could get of the big-name HSM manufacturers' development docs, w/o an NDA or a purchase, looked to be much more difficult to integrate.