RIPE discovers that you can skip the HSMs and just use Linux FDE if you define away the problem HSMs solve.pic.twitter.com/LCiqpW3LuA
Show this thread
-
The next best thing is indeed a maxium locked down and trimmed network box that only expose functions that:Generate priv/pub key-return pub key and priv key identifier,generate symmetric key- return identifier, use priv/symmetric key on input return result(PKCS11).
ohh and the HSM is only worth its price if you remember to segment the administrative and the usage ip addressess into seperate networks- otherwise compromise of the usage subnet will make compromise of the HSM quite easy in practice...