RIPE discovers that you can skip the HSMs and just use Linux FDE if you define away the problem HSMs solve.pic.twitter.com/LCiqpW3LuA
Show this thread
-
The next best thing is indeed a maxium locked down and trimmed network box that only expose functions that:Generate priv/pub key-return pub key and priv key identifier,generate symmetric key- return identifier, use priv/symmetric key on input return result(PKCS11).
The only difference is that functionality for exporting sensitive keys is supposed to not exist in the HSM hardware- but that is bullshit anyway..... for the right amount of $ IBM/SAFENET/WHATEVER will send an consultant with a special firmware upgrade that will export anything!