How realistic is it to keep these master keys secret? Can't the CIA just blackmail a foreign employee into handing over the keys? The keys must be sitting on literally thousands of boxes that do SSL termination. How many employees could access these keys?
Surely just hacking a load balancer or front end server is the preferred first option. I only know of 3 companies who actually use HSMs for their front end SSL for general purpose stuff.
Grabbing them in a virtualized environment is even easier.
It's just expensive. Generally there's OpenSSL support.
The HSM market makes me really sad. I'm kind of considering doing an "open source HSM" -- something using COTS components, ideally a few generations old, with everything totally verifiable by the user/assembler, and a key loadable at manufacture time -- the idea being companies could assemble and certify their own, or a third party or industry association could certify them for their regulees. Goal would be to price a low end version around $100-200, and a high-end (x86-64 performance) in the low thousands, unlike the rape that is Thales or SafeNet ($20k+ for mediocre performance). Plus, if you're at all "interesting", there's no way you'd trust a European defense contractor or a US defense-affiliated company with a "black box for keys, trust us".
Not sure if this would be a good business, though. Would need to raise actual VC for it, and while I know some awesome HW people, including in the tamper-resistance space, I've never done volume production of any hardware myself.
YubiHSM[1] seems much more reasonable at $500, but it's still not "cheap."
A COTS implementation would be interesting. Securing SSL keys would require very quick public key crypto and probably a PCI-E interface to talk to the server, the PCI-E interface making it much more expensive (FPGAs with PCI-E hard blocks have gone down in price, but are by no means cheap, not to mention the increased cost of the PCB). Prototypes probably wouldn't need VC for a proof of concept, but after that you typically need to put up a bit of money for any manufacturing.
I'd be interested in a way to securely generate and store a Root CA certificate and sign other keys with it. Ideally using something like secret sharing so that no single person can access the Root CA as well without having n out of m people.
Sadly, YubiHSM is a pretty useless single-purpose device only really useful for OATH. It doesn't do public key crypto at all, and more importantly, doesn't let you run real code on it (which only nCipher (now Thales) and IBM 4758/4764 ever really did). that is what will make HSMs super awesome.
Proof of concept can be done with a regular dev board or even a cellphone; it's volume production which requires VC.
