News for hackers. Stuff that matters.

A comment on Analysis of the GFW's Unconditional Port 443 Block on August 20, 2025. Parent comment

Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by UltraSane on Wednesday August 20, 2025 @08:18PM (#44967849)
Both KMS and CloudHSM are FIPS 140-2 Level 3 and AWS claims they cannot read private keys from KMS. The main difference is KMS uses IAM and the AWS REST API while CloudHMS uses PKCS #11/JCE and a separate permissions system.
[ Parent | on HN ]
Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by nijave on Thursday August 21, 2025 @08:43AM (#44972050)
The docs say both use HSM. Under "Secure" in the accordion menu https://aws.amazon.com/kms/features/#topic-0
[ Parent | on HN ]
Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by UltraSane on Thursday August 21, 2025 @09:17AM (#44972387)
My understanding is that AWS KMS uses AWS designed HSMs and are tightly integrated with all AWS services while while CloudHSM uses LiquidSecurity 2 Cloud HSM adapters and use more conventional APIs

https://www.marvell.com/products/security-solutions/liquidse...

[ Parent | on HN ]
Re:Analysis of the GFW's Unconditional Port 443 Block on Aug... by nijave on Friday August 22, 2025 @09:09AM (#44984226)
>My understanding is that AWS KMS uses AWS designed HSMs

That's my take as well reading about how they handle firmware (sounds like they're using their own chips, presumably similar to how they use other hardware acceleration and offload)

[ Parent | on HN ]