News for hackers. Stuff that matters.

A comment on Compromised Microsoft Key: More Impactful Than We Thought. Parent comment

Re:Compromised Microsoft Key: More Impactful Than We Thought by tatersolid on Sunday July 23, 2023 @07:30AM (#36834397)
> High performance HSMs capable of handling 10k+ transactions/second are well within the price range of a well funded startup.

Microsoft knows this, and even offers HSMs as a cloud service.

HSMs simply don’t scale up to something the size of azure AD. Even if you could use 10K+ of them in a global cluster, copying keys between HSMs inherently exposes the master keys anyway. And how do you secure access to the HSMs, with another secret shared on every validation server? Turtles all the way down.

[ Parent | on HN ]
Re:Compromised Microsoft Key: More Impactful Than We Thought by viralpoetry on Monday July 24, 2023 @03:32AM (#36844222)
> copying keys between HSMs inherently exposes the master keys anyway

that's not true, even with their BYOK you export the key from one HSM under a shared key and then import it to another device

[ Parent | on HN ]