4 ms·

> An HSM. Please please let it be an HSM ! :) That is one of the options we're considering, but please tell me more. :) What companies, communities or individ

by kfreds 3y ago

> An HSM. Please please let it be an HSM ! :) That is one of the options we're considering, but please tell me more. :) What companies, communities or individuals are missing what features at what price point? The devil's advocate would argue that it can't be that important if the customer isn't willing to pay 1,000 EUR per HSM. Do you care about certifications such as FIPS or CC? If so, is this simply a matter of achieving compliance at the lowest cost rather than security?

traceroute66 3y ago
In terms of YubiHSM, they make two versions, the non-FIPS and the FIPS. My original post was made with the non-FIPS version in mind, which is effectively a non-certified glorified Yubikey that just has different firmware that allows HSM-esque functionality such as key-wrap, and a more API-friendly interface even if the documentation is terrible. :) I agree that for FIPS/CC, by all means charge what you like for the certification badge, since any company that needs the compliance tick-box will pay whatever price is asked. My beef is more with the non-certified pricing. Ultimatley the problem is when you clearly need more than one, and ideally minimum of three or five units in order to achieve suitable hardware redundancy. The sort of people I have in mind would be private individuals (e.g. freelance developer, OSS-project maintainer etc.) and SME-sized companies and non-profit organisations for whom 3x650 or 5x650 could be financially unattractive or even plain financially impossible. Perhaps we could meet half-way and you could have basic functionality and then more advanced functionality and/or increased storage capacity unlockable through software licensing on a pay-as-you-go model ? As long as the fees were one-off and not yet-another-company-selling-a-subscription-pricing-model.

4 ms·

> An HSM. Please please let it be an HSM ! :) That is one of the options we're considering, but please tell me more. :) What companies, communities or individ

by kfreds 3y ago

traceroute66 3y ago
In terms of YubiHSM, they make two versions, the non-FIPS and the FIPS. My original post was made with the non-FIPS version in mind, which is effectively a non-certified glorified Yubikey that just has different firmware that allows HSM-esque functionality such as key-wrap, and a more API-friendly interface even if the documentation is terrible. :) I agree that for FIPS/CC, by all means charge what you like for the certification badge, since any company that needs the compliance tick-box will pay whatever price is asked. My beef is more with the non-certified pricing. Ultimatley the problem is when you clearly need more than one, and ideally minimum of three or five units in order to achieve suitable hardware redundancy. The sort of people I have in mind would be private individuals (e.g. freelance developer, OSS-project maintainer etc.) and SME-sized companies and non-profit organisations for whom 3x650 or 5x650 could be financially unattractive or even plain financially impossible. Perhaps we could meet half-way and you could have basic functionality and then more advanced functionality and/or increased storage capacity unlockable through software licensing on a pay-as-you-go model ? As long as the fees were one-off and not yet-another-company-selling-a-subscription-pricing-model.