3 ms·

Yeah it's just compliance. But Amazon having physical access doesn't matter because this level of CIA (confidentiality, integrity, availability) is enforced by

• count 14y ago
  It's also been tested for technical enforcement - the Luna SA stuff is FIPS certified.
• marshray 14y ago
  Contracts are only a substitute for physical or cryptographic security when you're not the one with the most to lose from a successful compromise.
• edwintorok 14y ago
  How can you know that your instance is talking to the real CloudHSM and not a software emulation that can reveal the keys? At some point Amazon might be forced (by some wiretapping lawys, or subpoena) to fake the HSM presented to your instances and give others access to your keys. Of course the attack window is considerably reduced, if they want to perform this attack they have to do it when you initially set up the CloudHSM, they can't replace it later with a fake HSM, but still...
  • rdl 14y ago
    Generally HSMs have manufacturer keys, too, so you'd need to compromise both Amazon and SafeNet (admittedly, both US companies which could be subject to court order...). The weak point is initial provisioning, as you point out.
    • rdl 14y ago
      Fuck, sadly I just talked to safenet at their booth at aws and they don't do this, so you are totally vulnerable to giving keys to a fake hsm, essentially making cloud hsm useless. Unless their booth dudes were misinformed.