RIPE discovers that you can skip the HSMs and just use Linux FDE if you define away the problem HSMs solve.pic.twitter.com/LCiqpW3LuA
Show this thread
-
The next best thing is indeed a maxium locked down and trimmed network box that only expose functions that:Generate priv/pub key-return pub key and priv key identifier,generate symmetric key- return identifier, use priv/symmetric key on input return result(PKCS11).
and that is anyway only relevant if you configure the HSM to use correct attributes by default, marking the keys as "sensitive" and disable functionality for using sensitive keys as input for key derivation algos(very rarely happens)