Cryptosense Blog

Here's a D.I.Y. one that looks like a fun project: https://cryptosense.com/blog/building-a-raspberry-pi-hsm-for-rsa-2014/ The Nitrokey HSM is what the guardian project recommends and is super affordable actually: https://shop.nitrokey.com/shop/product/nitrokey-hsm-7 Edit: Changed from "what cloudflare uses" to "what the guardian project recommends"[1]. I was reading too many tabs at once and confused things. https://guardianproject.info/2017/12/18/building-a-signing-server/ Sorry to jgrahamc for the incorrect endorsement.

> That leaves a massive gap that seems like an opportunity: YC startups Isn't Thomas last start up exactly about that? https://latacora.com/ > So what do you do if you want to create a startup to fill this gap? Make tools Indeed, I believe the only "tool" on the market for crypto reviews is cryptosense: https://cryptosense.com/ > I have an xss.txt file that contains exploits that work on almost every client I throw Can you share that :) ?

>No, they aren't. The NSA can't just waltz into Apple and break into their HSM to steal their keys The NSA could waltz into the plant manufacturing the HSM. Or they could waltz into Apple and make sure Apple uses the right HSM with keys already known to the NSA, e.g. by replacing the shipment of the HSMs Apple ordered. (This would require the NSA knowing in advance when Apple buys HSMs for what purpose and from what vendor, but again, intelligence gathering business). >These systems are designed to be robust even against physical access attacks. They are designed by humans trying to make those things "robust" against attacks. "Robust" is a "best effort" word. Assuming that the thing that got shipped to you actually is the thing you think and not just some nice NSA chip with the name of a popular HSM vendor printed on top. You cannot really open up the chip and look inside as, if this is a properly designed HSM, this it is supposed to be destro if you tamper with the enclosure or any other vital parts of it. I'd be surprised if the NSA does not spend resources on research into breaking HSMs, and if it do esnot spend resources on designing "fakes". The level of their success is unknown until the next Snowden shows up. But if they did break some HSMs, they wouldn't be alone [0]. So, there is a chance the NSA can waltz into Apple and break into their HSM and steal their keys. This assumes Apple uses HSMs for this kind of stuff and uses them correctly. Since authorized…

OK, I looked. Here's my response. Call it "Against Against DNSSEC, and For DNSSEC". > DNSSEC is Unnecessary Quite the contrary. If nothing else, it's the only technology we have with proof of non-existence. That's very valuable. > DNSSEC is a Government-Controlled PKI If you use QName minimization then it's really hard for the government to abuse those keys: they'll get caught unless they MITM you all the time, and to do that they need to know exactly who to MITM all the time. It was always important to use QName minimization anyways -- essential, I'd say. Also, anyone can run their own roots, and you can bet that other governments (e.g., Russia's) have plans to run their own if need be. WebPKI is no-PKI. Whether it's WebPKI or real-PKI, CAs can be subverted by the governments that have jurisdictions over them. CT is not yet clearly a good enough answer (it's post-hoc, for one), but if it is then guess what: CT would also work for DNSSEC. I.e., everything is "government-controlled", and no technology beats the rubber hose. Thus "DNSSEC is government-controlled PKI" is grossly misinformed in the best case, or willful FUD in the worst case. > Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys. As if the U.S. could not get ICANN to change the .ly delegation if it came to it. > DNSSEC is Cryptographically Weak DNSSEC supports new algorithms. > No cryptosystem created in 2015 would share DNSSEC’s design. WebPKI has…

If the key is located only in the HSM, and there are no known flaws in the HSM, yep, that's a hard nut to crack, I'm not going to claim I could do it. But given enough resources, with time and planning and insiders? Take a look at https://cryptosense.com/blog/how-ledger-hacked-an-hsm - and that's a remote attack.

The point, yes, but it is not the case in reality: 2015: https://cryptosense.com/blog/the-untold-story-of-pkcs11-hsm-vulnerabil… 2017: https://cryptosense.com/blog/infineon-rsa-key-generation-bug-how-the-a… 2019: https://cryptosense.com/blog/how-ledger-hacked-an-hsm/ Stop trying to build scenarios where key escrow solutions are technically sound. They are not. This is an intractable problem that is not solved by these half cocked technical measures. Key escrow cannot by definition be secure, and wasting time trying to invent solutions just confuses the matter, weakens security and leaves us all vulnerable. Basically, Sssssssh, or the politicians might actually believe this fantasy.

Not as rare as it should be (see https://cryptosense.com/blog/more-weak-rsa-keys-in-network-devices/) -- but there are much easier fixes than QKD.