3 ms·
Then isn’t the HSM just the part of your hardware that you don’t control? Isn’t that the complaint?
by tshaddox 4y ago
Then isn’t the HSM just the part of your hardware that you don’t control? Isn’t that the complaint?
- altairprime 4y agoYou would still absolutely control the HSM, in this example, and whether you installed an HSM provided by a third-party or your own would be entirely your choice. It’s just another open source hardware component. Microsoft could release the source code to the Pluton HSM and it would still be just as effective at secure attestation. If you want Microsoft’s online gaming services to trust your computing environment in ranked competitive play, then you may find that booting with a self-signed certificate in your HSM isn’t sufficient for them to allow you into ranked play; they might choose to require a Pluton HSM. That has nothing to do with “open source”, though; the signing keys stored in an HSM’s secure vault are not part of its schematic or software source code, any more than the SSL certificate for a Wordpress blog hosted on Linux is part of the Wordpress or Linux source code.