3 ms·
The keys are stored on SafeNet HSMs, you'd have to trust that they don't do anything with them but they can't exactly export them.
by iancarroll 12y ago
The keys are stored on SafeNet HSMs, you'd have to trust that they don't do anything with them but they can't exactly export them.
- SEJeff 12y agoYou can get the keys off of a HSM with a scanning tunneling electron microscope, a lot of time, and some electronics engineers depending on the type of hardware. It is possible, but unbelievably more difficult. If the get the server with the hsm in it via a NSL, game over. That being said, it is impossible for a hack to get the private keys, so this is still a massive win.
- Terretta 12y agoHow does AWS KMS compare to AWS CloudHSM? AWS CloudHSM provides you with a dedicated hardware device installed in your Amazon Virtual Private Cloud (VPC) that provides a FIPS 140-2 Level 2 validated single-tenant HSM to store and use your keys. You have total control over your keys and the application software that uses them with CloudHSM. AWS KMS allows you to control the encryption keys used by your applications and supported AWS services in multiple regions around the world from a single console. Centralized management of all your keys in AWS KMS lets you enforce who can use your keys, when they get rotated, and who can manage them. AWS KMS integration with AWS CloudTrail gives you the ability to audit the use of your keys to support your regulatory and compliance activities.