Hacker News Reader

Comment by firesteelrain | Hacker News Reader

I use HashiCorp Vault paid version to interface with an on premises HSM and for its FIPS compliance. I don’t know of any other software that is as lightweight and easy to use with an HSM as vault. We are using Vault to store the signed intermediate CA and automatically unseal Vault by storing the shards in the HSM (along with the Root CA). OpenBao wouldn’t solve this for me.

View on HN

> OpenBao wouldn’t solve this for me.

I'd bet OpenBao gets native HSM support. The problem will be doing it in a clean room setting to avoid any legal issues.

Someone would have to fund it. The compliance issues alone are very expensive.

IBM, somewhat unofficially, is behind this recent fork. It might take a bit but if this fork gains traction then I would assume it gets this functionality.

Forgive my ignorance, but what does compliance have to do with HSM support? Aren't they orthogonal features?

The "HSM support" bit is totally dependant on compliance; it's not about APIs.

You didn't answer my question. How is it dependent?

The reason people pay Hashicorp for HSM support is so that they can run Vault in a FIPS-certified mode.

Vault isn't easy to use at any kind of larger scale, though. It works well enough for small deployment infrastructure. Once you get to a certain size, all of HashiCorp's tech starts to show its poor, overengineered design in both performance and stability.

> overengineered design

Having operated a large Vault (FOSS, not commercial) installation, "overengineered" is not the word I'd use.

What word would you use?

Cleverly designed to make you go commercial.

Could you elaborate a bit on what you consider large size? Did you have issues with Vault specifically? In my experience Terraform is the troublesome Hashicorp tool, not Vault.

We have a Vault cluster running in containers. It is working well

Can I ask what regulatory domain you are in that requires on-prem HSM(vs cloud offering)? Also do you have a recommendation for on-prem HSM vendors that work well with Vault?

Financial Sector and Thales TCT HSM

https://cpl.thalesgroup.com/sites/default/files/content/inte...

Reply on news.ycombinator.com