<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">On 17 Feb 2017, at 13:03, Wasa Bee <<a href="mailto:wasabee18@gmail.com" class="">wasabee18@gmail.com</a>> wrote:<br class=""><div><blockquote type="cite" class="">On Fri, Feb 17, 2017 at 7:51 AM, Mike Hamburg <span dir="ltr" class=""><<a href="mailto:mike@shiftleft.org" target="_blank" class="">mike@shiftleft.org</a>></span> wrote:<br class=""><div class=""><div dir="ltr" class=""><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><span class="gmail-"><blockquote type="cite" class=""><div class="">On Feb 16, 2017, Bill Cox <<a href="mailto:waywardgeek@gmail.com" target="_blank" class="">waywardgeek@gmail.com</a>> wrote:</div><br class="gmail-m_1029177473038271310Apple-interchange-newline"></blockquote><div class=""><blockquote type="cite" class="">The cost per signature is the main metric for being "practical" in this case. A 100K/second signature capable HSM that costs $1M would be worse than a 10/second signature capable device that costs $1. I don't care about FIPS compliance, as it no longer seems well correlated with good security.</blockquote></div><div class=""><br class=""></div></span><div class="">The image of 10,000 smart card readers dangling out of your host gives me a chuckle.</div></div></div></blockquote><div class=""><br class=""></div><div class="">this company is building a rack full of smart cards to build a cheap HSM with high throughput - see <a href="https://enigmabridge.com/" class="">https://enigmabridge.com/</a></div></div></div></div></div></blockquote><div><br class=""></div>While 10k is a bit much - it is pretty common in some industries to have in the mid 1000’s in something called simbanks, poolGSM or simtrays; typically 128 or 256 cards; often fitting by two per 1U enclosure. </div><div><br class=""></div><div>E.g:</div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="https://www.alibaba.com/product-detail/YX-256-pool-gsm-sim-card_60571655761.html" class="">https://www.alibaba.com/product-detail/YX-256-pool-gsm-sim-card_60571655761.html</a></div><div><br class=""></div><div>While usually used for large GSM gateways or complex dialout (or spoofing/gatewaying things like bulk WhatsApp / Signal bridges) - most models are quite happy with typical PKCS#15/x509 style simcards and a doddle to integrate with OpenSSL or OpenSC.</div><div><br class=""></div><div>It is quite useful if you are doing things like encrypting/signing against some key in backup scenarios; with daily or `per retention policy’ key sets; which you then swap/take offsite on a weekly or so basis - but you do not want key/card PKI swap protocols daily or too regularly. Yet the auditor or regulator wants a single ‘non duplicatable’ key.</div><div><br class=""></div><div>Dw</div><br class=""></body></html>