Ask HN: Would a personal HSM be of interest?
I've created an HSM with a Raspberry Pi and have integrated it with an add-on Security Module. The API has over 30 functions including Cryptographically secure RNG functions, hash/HMAC functions (supporting 40+ hash algo's), Pub/Priv key functions, and also has a CA Authority on it.
I am using it for storing my AWS API secrets, private keys, and a CA Authority for all my SSH keys.
The add-on chip provides:
- Multifactor Device ID & Authentication - Unique ID token created using multiple device specific measurements - Cryptographically derived ID token never exposed - Changes in host configuration trigger local API responses, policy dependent
- Data Encryption & Signing - Strong cipher suite includes ECDSA, ECDH, AES-256, SHA256 - AES-256 encrypt/decrypt data service - Integrates with TLS client-side certificates - TRNG – true random number generator, suitable seed for FIPS PUB 140-2, 140-3 DRNG.
- Key Storage & Generation - Private keys never exposed outside of silicon - Fusible keys available, policy dependent
- Physical Tamper Detection - Perimeter breach detection circuits - Accelerometer shock detection - Power rail monitor - perimeter integrity circuits detect breaks in user defined wire loops/mesh
- Real-time Clock - RTC clock service, available to client applications - 20ppm accuracy (standard). 5ppm accuracy (precision, temperature compensated)
- Hardware Root of Trust - Hard to penetrate dual secure-processor architecture - Secure elements from Microchip – ATECC608, ATECC508 - Secure microcontroller isolates and supervises services - Hardware based crypto-engine and key-store