5 ms·

Building a More Assured Hardware Security Module [pdf]

31 points by bracewel 11y ago

mey 11y ago
Where is the call to action (where do you engage to get involved?)
- deleted 11y ago
  [deleted]
- JoachimS 11y ago
  The front page is here: https://cryptech.is https://cryptech.is More tech info etc are here: http://wiki.cryptech.is http://wiki.cryptech.is We use mail lists. The second link Provides links to archives, sign up info. There you also find web access to all repos. And if there are questions esp related to the digital HW side of Cryptech just ask and I'll try to answer.
  - imrehg 11y ago
    BTW, your wiki's certificate is untrusted, because it was issued for "bikeshed.cryptech.is".
    - JoachimS 11y ago
      Yes, that is correct and by design. It boils down to (the lack of) trust in the CAs and the HSMs they use. Basically.
vvanders 11y ago
Might not want to use pink comic sans on a slide deck if you want be taken seriously...
- corysama 11y ago
  I'm not sure if it's the NetBSD crowd or some general crypto-focused community, but there's a theme going on about presenting and publishing on security in comic sans. The goal is to see what you are more focused on: the slickness of the presentation or the correctness of the code. https://mobile.twitter.com/Nambitious/status/595230807138111489 https://mobile.twitter.com/Nambitious/status/595230807138111...
  - userbinator 11y ago
    I remember coming across quite a few networking-related slide sets that were almost exclusively in comic sans; they might've come from a widely used book, and it's not too far of a stretch to think that the trend spread over into security too.
  - pyvpx 11y ago
    many OpenBSD developers use comic sans intentionally in their presentations.
    - corysama 11y ago
      That's it. I said NetBSD, but meant OpenBSD.
- usmeteora 11y ago
  yup. I was excited to read this until....oh no....hot pink comic sans. Had to close me eyes for a second to recalibrate. Don't make it such an effort to have to get over the barrier to the knowledge.
bonobo 11y ago
The wiki[1] says that "Recent revelations have called into question the integrity of some of the implementations of basic cryptographic functions and devices used to secure communications on the Internet. There are serious questions about algorithms and about implementations of those algorithms in software and particularly hardware." I'm curious about that, does anybody here know about these recent revelations? I understand the feeling, but I don't remember seeing any news about the security of HSM recently, or ever actually. [1]: http://wiki.cryptech.is http://wiki.cryptech.is -- see JoachimS' comment
bobmagoo 11y ago
Man powerpoint presentations after the fact are all but useless for conveying the original point.
MichaelGG 11y ago
Regarding HSMs, a great read is the Cambridge team that broke the Luna CA3 Chrysalis HSM. A great reversing tale. "Unwrapping the Chrysalis": http://www.war-room.co.uk/~dc352/UCAM-CL-TR-592.pdf http://www.war-room.co.uk/~dc352/UCAM-CL-TR-592.pdf Search around for more- I remember them having a few different write-ups.
- JoachimS 11y ago
  Great tip, thanks!

31 points by bracewel 11y ago

mey 11y ago

Where is the call to action (where do you engage to get involved?)

deleted 11y ago
[deleted]
JoachimS 11y ago
The front page is here: https://cryptech.is https://cryptech.is More tech info etc are here: http://wiki.cryptech.is http://wiki.cryptech.is We use mail lists. The second link Provides links to archives, sign up info. There you also find web access to all repos. And if there are questions esp related to the digital HW side of Cryptech just ask and I'll try to answer.
- imrehg 11y ago
  BTW, your wiki's certificate is untrusted, because it was issued for "bikeshed.cryptech.is".
  - JoachimS 11y ago
    Yes, that is correct and by design. It boils down to (the lack of) trust in the CAs and the HSMs they use. Basically.

vvanders 11y ago

Might not want to use pink comic sans on a slide deck if you want be taken seriously...

corysama 11y ago
I'm not sure if it's the NetBSD crowd or some general crypto-focused community, but there's a theme going on about presenting and publishing on security in comic sans. The goal is to see what you are more focused on: the slickness of the presentation or the correctness of the code. https://mobile.twitter.com/Nambitious/status/595230807138111489 https://mobile.twitter.com/Nambitious/status/595230807138111...
- userbinator 11y ago
  I remember coming across quite a few networking-related slide sets that were almost exclusively in comic sans; they might've come from a widely used book, and it's not too far of a stretch to think that the trend spread over into security too.
- pyvpx 11y ago
  many OpenBSD developers use comic sans intentionally in their presentations.
  - corysama 11y ago
    That's it. I said NetBSD, but meant OpenBSD.
usmeteora 11y ago
yup. I was excited to read this until....oh no....hot pink comic sans. Had to close me eyes for a second to recalibrate. Don't make it such an effort to have to get over the barrier to the knowledge.

bonobo 11y ago

The wiki[1] says that "Recent revelations have called into question the integrity of some of the implementations of basic cryptographic functions and devices used to secure communications on the Internet. There are serious questions about algorithms and about implementations of those algorithms in software and particularly hardware." I'm curious about that, does anybody here know about these recent revelations? I understand the feeling, but I don't remember seeing any news about the security of HSM recently, or ever actually. [1]: http://wiki.cryptech.is http://wiki.cryptech.is -- see JoachimS' comment

bobmagoo 11y ago

Man powerpoint presentations after the fact are all but useless for conveying the original point.

MichaelGG 11y ago

Regarding HSMs, a great read is the Cambridge team that broke the Luna CA3 Chrysalis HSM. A great reversing tale. "Unwrapping the Chrysalis": http://www.war-room.co.uk/~dc352/UCAM-CL-TR-592.pdf http://www.war-room.co.uk/~dc352/UCAM-CL-TR-592.pdf Search around for more- I remember them having a few different write-ups.

JoachimS 11y ago
Great tip, thanks!