Hardware-Enabled Security - Revision history

Tom: /* References */

2025-10-20T05:39:40Z

‎References

Tom: /* Hybrid */

2025-10-19T23:23:28Z

‎Hybrid

Tom: /* References */

2025-10-19T23:19:23Z

‎References

Tom: /* Hybrid */

2025-10-05T18:46:20Z

‎Hybrid

Tom: /* Hybrid */

2024-11-04T21:37:54Z

‎Hybrid

Tom: /* Context */

2024-11-04T21:37:24Z

‎Context

Tom: /* Context */

2023-02-26T00:50:38Z

‎Context

Tom at 00:48, 26 February 2023

2023-02-26T00:48:53Z

Tom: /* Full Title or Meme */

2023-02-23T16:54:57Z

‎Full Title or Meme

Tom: Created page with "==Full Title or Meme== Hardware-Enabled Security originated as a government category that includes a variety of implementations like TPM, Secure Enclave, T https://csrc..."

2023-02-23T16:50:26Z

Created page with "==Full Title or Meme== Hardware-Enabled Security originated as a government category that includes a variety of implementations like TPM, Secure Enclave, T https://csrc..."

New page

==Full Title or Meme==
[[Hardware-Enabled Security]] originated as a government category that includes a variety of implementations like TPM, Secure Enclave, [[T

https://csrc.nist.gov/publications/detail/nistir/8320d/draft

==References==

← Older revision		Revision as of 05:39, 20 October 2025
Line 20:		Line 20:

	==References==		==References==
−	* See ~~siki~~ on [[Hardware Protection]] for devices like TPM and HSM protection for keying material.	+	* See wiki on [[Hardware Protection]] for devices like TPM and HSM protection for keying material.

@@ Line 13: / Line 13: @@
 Use an EAL4+ Common Criteria certified HSM. The “+” indicates the extra advanced vulnerability analysis at level 5. Good news: such HSMs already exist, for example: the Thales Luna HSM7, Utimaco CP5 and I4P Trident.
 These HSMs are Common Criteria certified under EN 419221-5, a European norm widely used for remote qualified signing. Interestingly, both the Signer Interaction Component (SIC) in remote signing and the EUDI wallet are user-controlled components. This means the user—not the provider—initiates and authorizes critical actions, ensuring strong alignment with eIDAS principles of user consent and control.
 ==References==
 * See siki on [[Hardware Protection]] for devices like TPM and HSM protection for keying material.

← Older revision		Revision as of 23:19, 19 October 2025
Line 15:		Line 15:

	==References==		==References==
		+	* See siki on [[Hardware Protection]] for devices like TPM and HSM protection for keying material.

@@ Line 5: / Line 5: @@
 ==Hybrid==
 Proposals in 2024 for a hybrid approach with a [[TPM]] (or SE) in the user's [[Smartphone]] and an HSM in the cloud are core to the EUDIW or [[eIDAS 2.0]] proposals.
 ==References==

@@ Line 4: / Line 4: @@
 [https://csrc.nist.gov/publications/detail/nistir/8320d/draft NIST Interagency Report 8320D on Hardware-Enabled Security]<blockquote>Organizations employ a growing volume of machine identities, often numbering in the thousands or millions per organization. Machine identities, such as secret cryptographic keys, can be used to identify which policies need to be enforced for each machine. Centralized management of machine identities helps streamline policy implementation across devices, workloads, and environments. However, the lack of protection for sensitive data in use (e.g., machine identities in memory) puts it at risk. This report presents an effective approach for overcoming security challenges associated with creating, managing, and protecting machine identities throughout their lifecycle. It describes a proof-of-concept implementation, a prototype, that addresses those challenges by using hardware-based confidential computing. The report is intended to be a blueprint or template that the general security community can use to validate and utilize the described implementation.</blockquote>
 ==Hybrid==
-Proposals in 2024 for a hybrid approach with a [[TPM]] (or SE) in the user's [[Smartphone]] and an HSM in the cloud are core to the EUDIW or [[eIDSA 2.0]] proposals.
+Proposals in 2024 for a hybrid approach with a [[TPM]] (or SE) in the user's [[Smartphone]] and an HSM in the cloud are core to the EUDIW or [[eIDAS 2.0]] proposals.
 ==References==

@@ Line 2: / Line 2: @@
 [[Hardware-Enabled Security]] originated as a government category that includes a variety of implementations like TPM, Secure Enclave, [[Trusted Execution Environment]] and many others.
 ==Context==
-[https://csrc.nist.gov/publications/detail/nistir/8320d/draft Nist Interagency Report on Hardware-Enabled Security]
+[https://csrc.nist.gov/publications/detail/nistir/8320d/draft NIST Interagency Report 8320D on Hardware-Enabled Security]<blockquote>Organizations employ a growing volume of machine identities, often numbering in the thousands or millions per organization. Machine identities, such as secret cryptographic keys, can be used to identify which policies need to be enforced for each machine. Centralized management of machine identities helps streamline policy implementation across devices, workloads, and environments. However, the lack of protection for sensitive data in use (e.g., machine identities in memory) puts it at risk. This report presents an effective approach for overcoming security challenges associated with creating, managing, and protecting machine identities throughout their lifecycle. It describes a proof-of-concept implementation, a prototype, that addresses those challenges by using hardware-based confidential computing. The report is intended to be a blueprint or template that the general security community can use to validate and utilize the described implementation.</blockquote>
 ==References==