3 ms·
> Ideally you'd want your TLS keys to be stored in an HSM Does an open spec HSM module exist? I can be somehow sure that linux and apache/nginx don't have back
by y0ghur7_xxx 13y ago
> Ideally you'd want your TLS keys to be stored in an HSM
Does an open spec HSM module exist? I can be somehow sure that linux and apache/nginx don't have backdoors as the source is audited by many people, but I need to be "sure" of my HSM too.
- praseodym 13y agoThere's an open-source software HSM: http://www.opendnssec.org/softhsm/ http://www.opendnssec.org/softhsm/
- erikano 13y agoIs SoftHSM meant for production use? I get a feeling it's not (but am not lure), based on this sentence: > You can use it to explore PKCS #11 without having a Hardware Security Module.
- remosi 13y agoIt runs in process tho, so it would have had the exact same result with heartbleed. Its keys need to be readable to that user, so exploits like http://blog.detectify.com/post/82370846588/how-we-got-read-access-on-googles-production-servers http://blog.detectify.com/post/82370846588/how-we-got-read-a... would also still leak your private keys. So no net win here unfortunately. opencryptoki has a softhsm too, but again, it appears to run in process. Same problems.