Unsure if this is something I should market, and could use some advice. Would anyone be interested in a Personal HSM?
I've created an HSM with a Raspberry Pi and have integrated it with an add-on Security Module. The API has over 30 functions including Cryptographically secure RNG functions, hash/HMAC functions (supporting 40+ hash algo's), Pub/Priv key functions, and also has a CA Authority on it.
I am using it for storing my AWS API secrets, private keys, and a CA Authority for all my SSH keys.
The add-on chip provides:
- Multifactor Device ID & Authentication
- Unique ID token created using multiple device specific measurements
- Cryptographically derived ID token never exposed
- Changes in host configuration trigger local API responses, policy dependent
- Data Encryption & Signing
- Strong cipher suite includes ECDSA, ECDH, AES-256, SHA256
- AES-256 encrypt/decrypt data service
- Integrates with TLS client-side certificates
- TRNG – true random number generator, suitable seed for FIPS PUB 140-2, 140-3 DRNG.
- Key Storage & Generation
- Private keys never exposed outside of silicon
- Fusible keys available, policy dependent
- Physical Tamper Detection
- Perimeter breach detection circuits
- Accelerometer shock detection
- Power rail monitor
- perimeter integrity circuits detect breaks in user defined wire loops/mesh
- Real-time Clock
- RTC clock service, available to client applications
- 20ppm accuracy (standard). 5ppm accuracy (precision, temperature compensated)
- Hardware Root of Trust
- Hard to penetrate dual secure-processor architecture
- Secure elements from Microchip – ATECC608, ATECC508
- Secure microcontroller isolates and supervises services
- Hardware based crypto-engine and key-store
I've created an HSM with a Raspberry Pi and have integrated it with an add-on Security Module. The API has over 30 functions including Cryptographically secure RNG functions, hash/HMAC functions (supporting 40+ hash algo's), Pub/Priv key functions, and also has a CA Authority on it.
I am using it for storing my AWS API secrets, private keys, and a CA Authority for all my SSH keys.
The add-on chip provides:
- Multifactor Device ID & Authentication - Unique ID token created using multiple device specific measurements - Cryptographically derived ID token never exposed - Changes in host configuration trigger local API responses, policy dependent
- Data Encryption & Signing - Strong cipher suite includes ECDSA, ECDH, AES-256, SHA256 - AES-256 encrypt/decrypt data service - Integrates with TLS client-side certificates - TRNG – true random number generator, suitable seed for FIPS PUB 140-2, 140-3 DRNG.
- Key Storage & Generation - Private keys never exposed outside of silicon - Fusible keys available, policy dependent
- Physical Tamper Detection - Perimeter breach detection circuits - Accelerometer shock detection - Power rail monitor - perimeter integrity circuits detect breaks in user defined wire loops/mesh
- Real-time Clock - RTC clock service, available to client applications - 20ppm accuracy (standard). 5ppm accuracy (precision, temperature compensated)
- Hardware Root of Trust - Hard to penetrate dual secure-processor architecture - Secure elements from Microchip – ATECC608, ATECC508 - Secure microcontroller isolates and supervises services - Hardware based crypto-engine and key-store