Support for signing key on hardware security modules

[Cantor, Scott]

On 12/20/17, 8:14 PM, "users on behalf of ofaklintrafo" <users-bounces at shibboleth.net on behalf of ofa at klintra.fo> wrote:

> So it would basically work if it can be configured using the Sun PKCS#11
> Provider. But this would be transparent to the Shibboleth IdP.

There's probably a lot to making it work, but it has to be transparent and handled entirely by a JCE provider or it won't work.

> But it would be interesting to know if there is anyone who has an
> installation runnning with a Sun PKCS#11 Provider configuration. 

I very much doubt it.

> Yes, it is more expensive, but provides better protection of the private key
> which may be required in some cases. And a HSM can perform quite many
> signing operations pr second.

Cheap HSMs can't, and expensive ones that operate over a network just have a network bottleneck. I think there are simply more effective ways of dealing with the risk, and I don't think HSMs are really geared to online signing as a rule. Offline is a different story.

-- Scott