Hardware security module

A TPM is for your laptop.

An HSM, hardware security module, is for the server.

If you are managing keys for a bank or a certificate authority, you aren't using a TPM.

You are using an HSM to offload that cryptographic processing.

If an attacker compromises the firmware, they own the machine before the operating system even loads.

But in the real world, we deal with side-channel attacks.

So basically it's a SaaS platform that is also leveraging hardware.

We are leveraging HSM on the backend, but also we are providing them with personal security device.

But at the end, it's a lot of software.

And to answer your question, today I would say that the hardware revenue is not the biggest one anymore.

All right, so in this model, we hold one key and you hold two keys.

So when you provision a wallet with us, That one key we provision on our servers, it's in HSMs.

We've been doing, those are hardware security modules.

We've been doing that longer than anybody because we were the first kind of into the space.

I mean, that's that's that's definitely part of it.

I think the political activism part of it is becoming more and more of a thing like Bitcoin is becoming bigger and bigger and therefore Bitcoiners could start being politically active in terms of donations and things like that.

i guess some people will have a bit of a that gives a bad taste in the mouth because maybe they don't want to be involved in the state or politics at all but yeah i kind of do align more on that side of hey uh it's uh what's the word uh what's the saying it's like politics you may not be interested in politics but politics is interested in you and for that reason um yeah i think uh we're gonna have to try to improve that situation and that's kind of in many places around the world um I wanted to get back to kind of the custody side of things and like security questions on like BitGo and HSMs and things like this.

How do...

But notice with many of these topics, that they give you the topic like trusted platform module, and then right after it, TPM.

Then they have hardware security module.

Right after that, HSM.

They have certificate revocation lists, CRLs.

They have online certificate status protocol, OCSP.

yeah

and then you re-wrap it using aes kw which managed HSM and Azure, and now Key Vault, actually, Key Vault Premium in public preview, supports AES-KW key wrapping, which is post-quantum resilient.

Yeah, go ahead.

So there's two issues that I see developers need to really, really think about.

And then the last one, which is incredibly important, is the key wrapping.

And we now have that in Azure.

So managed HSM has had AS key wrapping since day one.

And Azure Key Vault now has it, ASKW.

So if you have a 256-bit AES key, you just decrypt it or unwrap it using RSA, for example, and then you rewrap it using AES-KW.

which managed HSM in Azure, and now Key Vault, actually, Key Vault Premium in public preview, supports AESKW key wrapping, which is post-quantum resilient.

Yeah, go ahead.

So there's two issues that I see developers need to really, really think about.

And then the last one, which is incredibly important is the key wrapping.

And we now have that in, in Azure.

So managed HSM has had a key wrapping since day one.

And, um, as a key vault now has it, uh, ASKW.

The wipe has to complete faster than an attacker can reach the die.

That's why HSMs use battery-backed SRAM for key storage rather than flash.

SRAM is volatile.

Pull power, and the keys are gone.