3 ms·
Precisely. The very reason HSM vendors will be shouting about this for years as well, as anyone using those will at least have ensured their private key hasn't
by fidotron 13y ago
Precisely.
The very reason HSM vendors will be shouting about this for years as well, as anyone using those will at least have ensured their private key hasn't gone AWOL.
- tptacek 13y agoExplain how the existence of Microsoft SChannel and HSMs corroborates your argument instead of refuting it?
- fidotron 13y agoI need an open source crypto library to do SSL on my cloud based Linux VM. Which are you going to recommend?
- tptacek 13y agoNSS. Now, back to my question?
- fidotron 13y agoAnd that is the same recommendation you'd have made as a week ago? (In fairness, I can believe it might be). I am honestly struggling to see how you don't think having all Linux servers running incredibly similar crypto stacks is a bad thing. For sure HSMs and Windows boxes add to the diversity of the world, but Linux boxes form such a massive proportion of servers connected to the net that any common vulnerability there is a major problem. Just assuming you've found all vulnerabilities is not the way to go, so mitigating the effect of a vulnerability happening seems like a reasonable thing to do. After all, this is a good reason for things like process separation.
- tptacek 13y agoIf you had the option not to use OpenSSL, you can count on me not to recommend using OpenSSL.