News for hackers. Stuff that matters.

A comment on Key to Simplicity: Squeezing the hassle out of encryption key recovery. Parent comment

Re:Key to Simplicity: Squeezing the hassle out of encryption... by themoonisachees on Wednesday April 10, 2024 @02:24AM (#39987524)
What work does "individually" do in this last sentence? Can 2 evil services collaborate (or more realistically 2 non-evil services get breached) to extract part of the secret? What is the mechanism keeping me from setting up n realms and extracting secrets from their shared info?
[ Parent | on HN ]
Re:Key to Simplicity: Squeezing the hassle out of encryption... by imperiopolis on Wednesday April 10, 2024 @02:46AM (#39987665)
Yes, that is the work "individually" is doing here – multiple realms (services) could collude to combine shards and attempt to extract secrets.

However, programmable HSMs, with verifiable software (e.g. via a key ceremony), minimize this form of collusion. The shards they hold can't be extracted by a malicious operator, at least without substantial effort (requiring HSM hardware vulnerabilities).

[ Parent | on HN ]
Re:Key to Simplicity: Squeezing the hassle out of encryption... by themoonisachees on Wednesday April 10, 2024 @04:50AM (#39988442)
Interesting. Thanks for the explanations!
[ Parent | on HN ]