软件安全模块/工具包替代 HSM 用于开发加密功能
我工作并完成了一个 PKI 项目，该项目使用 HSM 来生成 - 存储密钥和执行加密功能。我使用 PKCS#11 与我们的应用程序交互以进行签名/验证和加密/解密。我们的平台是windows。
现在，我们希望通过用软件安全模块替换 HSM 来提供低成本替代解决方案。我必须在这里指出，我知道不使用 HSM 的缺点。这是安全性与成本之间的权衡。
我发现 Microsoft 提供了下一代 CryptoAPI (CNG)、密钥存储和证书服务。我的高级管理层不倾向于使用开源软件。我还发现 RSA 和 cryptomathic 提供工具包来执行基于软件的解决方案。
有人遇到过任何商业软件安全模块工具包来执行密钥生成、密钥存储和加密功能吗？
编程语言 - c/c++
谢谢
Raj
I worked and completed a PKI project which used a HSM for generating - storing keys and performing crypto functions. I used PKCS#11 to interface with our application for sigining/verifying and encryption/decryption. Our platform is windows.
Now we are looking to offer a low cost alternative solution by replacing the the HSM with a software security module. I must note here that i am aware of the drawbacks of not using a HSM. Its a trade off between security Vs Cost.
I found that Microsoft provides the Next Generation CryptoAPI (CNG), key store and certificate services. My senior management are not inclined to use open source software. I also found RSA and cryptomathic offering toolkits to perform software based solutions.
Has anybody come across any commercial software security module tool kits to perform key generation, key store and crypto functions?
Programming language - c/c++
Thanks
Raj
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
您可以使用 SoftHSM，它是纯软件 PKCS #11 实现。 OpenDNSSEC 项目正在使用它，以便在真正的 HSM 不可用的情况下进行替换，因此它也可能适合您。然而，它是 BSD 许可的，所以我猜你的管理层可能不喜欢它。
如果您正在寻找低成本且商业化的产品（我不确定您是否专门寻找专有的东西，即 CryptoAPI，或者是商业支持的东西，而 CryptoAPI 不是，除非您与Microsoft），重写您的应用程序以使用 Win32 CryptoAPI 对我来说似乎是唯一可行的选择。根据我的经验，RSA 的工具包并不便宜。
You could use SoftHSM, which is a pure-software PKCS #11 implementation. It is being used by the OpenDNSSEC project precisely to be swapped out in cases a real HSM is not available, so it might work for you too. However, it's BSD licensed, so I guess your management may not like it on that basis.
If you are looking for low-cost and yet commmercial (I'm not sure if you're specifically looking for something proprietary, which CryptoAPI is, or for something that is commercially supported, which CryptoAPI is not, unless you have a contract with Microsoft), rewriting your application to use the Win32 CryptoAPI seems the only viable option to me. RSA's toolkits are not cheap, in my experience.
我有一位客户使用 Mozilla 的 NSS 附带的软件 PKCS#11 实现作为 HSM 的直接替代品。它们在 Linux 上使用 ruby-pkcs11，因此您的情况可能会有所不同。
I have a customer who used the software PKCS#11 implementation that comes with Mozilla's NSS as a drop-in replacement for the HSM. They're on Linux using ruby-pkcs11, so your mileage may vary.
您最好的选择应该是找到软件 PKCS#11 库。市场上应该有几种实现方式 - 我知道我工作的公司出售一种。这样，您仍然能够切换回符合 PKCS#11 的 HSM，并且对应用程序的必要修改应该最少。
您的其他选择是 Microsoft 的 CryptoAPI 或 CNG 或 RSA、Cryptomathic 或其他供应商的工具包。这可能需要更多的工作来重写应用程序 - 除了 CryptoAPI 和 CNG 是免费的之外，我真的看不出这个选项有任何优势。
Your best option should be to find a software PKCS#11 library. There should be several implementations on the market - I know that the company I work for sells one. That way you would still be able to switch back to a PKCS#11-compliant HSM and the necessary modifications to the application should be minimal.
Your other options are CryptoAPI or CNG from Microsoft or a toolkit from RSA, Cryptomathic or another vendor. That would probably require more work to rewrite the application - I can't really see any advantage to this option, except that CryptoAPI and CNG are free.
看看http://www.openssl.org/lated/kits.html 适用于 LSM-PKCS11。这可能是一个解决方案。
Take a look at http://www.openssl.org/related/kits.html for LSM-PKCS11. That could be a solution.
我正在测试一个名为 Hashicorp 的 Vault 的解决方案，该解决方案类似于 SSM（软件安全模块），可以保护密钥并进行加密操作。它有一个可以在“开发者模式”（用于测试和编程）下使用的服务器和一个可以在最终环境中使用的非常严格的“生产模式”。基本解决方案是开源，如果您需要更多东西，可以使用“企业解决方案”，它们提供更多灾难恢复、备份、复制等方法。
他们用这句话提供了解决方案：
“管理机密并保护敏感数据 使用 UI、CLI 或 HTTP API 保护、存储和严格控制对令牌、密码、证书、加密密钥的访问，以保护机密和其他敏感数据。”
下载并测试它。
I'm testing a solution called Vault from Hashicorp that is something like a SSM (Software Security Module) that can protect keys an make cryptographic operations. It has a server that can be used in "developer mode" (for testing and programming) and a very strict "production mode" that can be used in a final environment. The basic solution is Open Source, and if you need something more there are the "Enterprise Solutions" that are offering more methods of disaster recovery, backup, replication and more.
They are offering the solution with this exact words:
"Manage Secrets and Protect Sensitive Data Secure, store and tightly control access to tokens, passwords, certificates, encryption keys for protecting secrets and other sensitive data using a UI, CLI, or HTTP API."
Download it and test it.