Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > sci.crypt > #33015

Re: storing passwords

Show all headers | View raw

Jakob Bohm <jb-usenet@wisemo.com> wrote:
> On 13/10/2015 23:48, Paul Rubin wrote:
>> Jakob Bohm <jb-usenet@wisemo.com> writes:
>>> I think HSM stands for Hardware Security Module, not Host
>>
>> I've seen it both ways.  Not sure which is more current.
>>
> 
> I have seen HSM products that were not placed within any specific host
> computer.  The most common these days is a tamper proof "SSL
> accelerator" HSM, which stores the secret key of a website certificate,
> handles all incoming HTTPS and SPDY requests, then forwards the actual
> request over a trusted Ethernet cable to the real web server.
> 
> These typically are installed as their own 1U box in a rack, and thus
> are not a "Host Security Module" for any particular host.
> 

They're not much of a hardware security module, either. Sometimes just LAMP
stacks (or equivalent or, worse, some homegrown code). In some ways that's
worse than managing things yourself, because such appliances aren't often
well maintained by the vendor in the long term, or even in the short term.

I always understood the module part to mean a device with very specific,
minimalist physical components and a very limited communications channel to
mitigate flaws in any firmware (i.e. anything with a network stack is not
sufficiently limited). In which case, it would follow as a practical matter
that it would be paired with a single host.

I bought several beta Yubikey NEO tokens. Alas, the firmware (Java Card
applet) contained a bug which allowed the PIN to be bypassed. That didn't
bother me so much--a smartcard without PIN protection is still much
preferable to the alternatives. I was just disappointed that the device
wasn't simpler.

At least they use a GPL'd Java Card applet, susceptible to independent code
review. And people have indeed submitted patches.

Presuming the Name Constraints extension to the X.509 PKI standard has
become useable, and there are root CAs that sell delegated CA rights for
subdomains, I'd chose that route over a 1U rack-mounted so-called HSM. The
price would presumably be similar. I'd generate and keep the secret key on a
cheap smartcard--the Yubikey should suffice. I'd periodically take it out of
the lockbox and generate new intermediate certificates for my servers. An
offline PC would work nearly as well.

It's basically what Google does. Although I think they're a global CA root
and so don't need to rely on the Name Constraints extension.

Back to sci.crypt | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-14 06:28 +1000
  Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-13 23:06 +0200
    Re: storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-15 08:45 +1000
  Re: storing passwords Paul Rubin <no.email@nospam.invalid> - 2015-10-13 14:22 -0700
    Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-13 23:42 +0200
      Re: storing passwords Paul Rubin <no.email@nospam.invalid> - 2015-10-13 14:48 -0700
        Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-14 00:09 +0200
          Re: storing passwords <william@wilbur.25thandClement.com> - 2015-10-16 18:08 -0700
            Re: storing passwords Jakob Bohm <jb-usenet@wisemo.com> - 2015-10-19 15:51 +0200
  Re: storing passwords "David Eather" <eather@tpg.com.au> - 2015-10-15 08:45 +1000
  Re: storing passwords Jeffrey Goldberg <nobody@goldmark.org> - 2015-10-15 15:51 -0500

csiph-web