HACKER Q&A
📣 captaincrunch

Would a personal HSM be of interest?


Unsure if this is something I should market, and could use some advice. Would anyone be interested in a Personal HSM?

I've created an HSM with a Raspberry Pi and have integrated it with an add-on Security Module. The API has over 30 functions including Cryptographically secure RNG functions, hash/HMAC functions (supporting 40+ hash algo's), Pub/Priv key functions, and also has a CA Authority on it.

I am using it for storing my AWS API secrets, private keys, and a CA Authority for all my SSH keys.

The add-on chip provides:

- Multifactor Device ID & Authentication - Unique ID token created using multiple device specific measurements - Cryptographically derived ID token never exposed - Changes in host configuration trigger local API responses, policy dependent

- Data Encryption & Signing - Strong cipher suite includes ECDSA, ECDH, AES-256, SHA256 - AES-256 encrypt/decrypt data service - Integrates with TLS client-side certificates - TRNG – true random number generator, suitable seed for FIPS PUB 140-2, 140-3 DRNG.

- Key Storage & Generation - Private keys never exposed outside of silicon - Fusible keys available, policy dependent

- Physical Tamper Detection - Perimeter breach detection circuits - Accelerometer shock detection - Power rail monitor - perimeter integrity circuits detect breaks in user defined wire loops/mesh

- Real-time Clock - RTC clock service, available to client applications - 20ppm accuracy (standard). 5ppm accuracy (precision, temperature compensated)

- Hardware Root of Trust - Hard to penetrate dual secure-processor architecture - Secure elements from Microchip – ATECC608, ATECC508 - Secure microcontroller isolates and supervises services - Hardware based crypto-engine and key-store


  👤 xyzzy123 Accepted Answer ✓
This sounds pretty nice, how would you say it stacks up against YubiHSM? Can it be cheaper?

We shipped an application recently where groups of users use hardware keys to unlock sensitive information.

We were able to use FortifyApp (from PeculiarVentures) in conjunction with "regular" Yubikeys acting in PIV (smart card) mode. We seriously considered the YubiHSM instead with different shim software but it was really quite expensive when you need 1 per operator.

The other thing which would be a "must" for commercial uses (I think, anyway) would be supporting standard PKCS11 APIs. The API is... not that great, but it's the only thing that saves you from rewrites every hardware generation.

Would that be on the roadmap? If not, what's the interface between host(s) & hsm?


👤 phillipseamore
Very interesting! What pricing do you have in mind? This appears more featureful than USB HSMs (like Yubico's) that go for <$1000. I'm not sure that I'd like to use a RPI for something like this but I'm guessing that the module could be transferred to another RPI if the first one dies? Does the module have power protection to survive a surge from the RPI?

👤 rjes
This sounds very promising! If it’s cheap enough for personal use :)

👤 captaincrunch
Forgot to mention the SD card is encrypted using luks.