Ressources & Documentations
YubiHSM 2
Le YubiHSM 2 est un module de sécurité materiel à la portée de toutes les organisations. Il fournit une cryptographie avancée, incluant le hachage, la cryptographie à clés symetriques et asymetriques, afin de protéger les opérations de chiffrement qui sécurisent les applications sensibles, les idendités, les données sensibles de l’entreprise certifiée, les bases de données, la signature de code et plus encore…
Spécifications techniques
Interfaces cryptographiques
– PKCS#11 API version 2.40
– Yubico Key Storage Provider (KSP) pour l’accès à Microsoft CNG. Le KSP est fournit pour les versions de DLL 64-bit and 32-bit
– Accès total aux capacités via les YubiHSM Core Libraries (C, Python) de Yubico
– Yubico Key Storage Provider (KSP) pour l’accès à Microsoft CNG. Le KSP est fournit pour les versions de DLL 64-bit and 32-bit
– Accès total aux capacités via les YubiHSM Core Libraries (C, Python) de Yubico
RSA
– clés 2048, 3072, and 4096 bits (avec e=65537)
– Signature en utilisant PKCS#1v1.5 and PSS
– Déchiffrement en utilisant PKCS#1v1.5 et OAEP
– Signature en utilisant PKCS#1v1.5 and PSS
– Déchiffrement en utilisant PKCS#1v1.5 et OAEP
Cryptographie sur courbes elliptiques
– Courbes: secp224r1, secp256r1, secp256k1, secp384r1, secp521r, bp256r1, bp384r1, bp512r1, Ed25519
– Signature: ECDSA (tous sauf Ed25519), EdDSA (seulement Ed25519)
– Derivation: ECDH (tous sauf Ed25519)
– Signature: ECDSA (tous sauf Ed25519), EdDSA (seulement Ed25519)
– Derivation: ECDH (tous sauf Ed25519)
Fonctions de Hachage
– SHA-1, SHA-256, SHA-384, SHA-512
Key Wrap
Import and export using NIST-approved AES-CCM Wrap with 128, 196, and 256 bit keys
Nombres aléatoires
On-chip True Random Number Generator (TRNG) used to seed NIST SP 800-90A Rev.1 AES-256 CTR_DRBG
Attestation
Asymmetric key pairs generated on-device may be attested using a device-specific Yubico attestation key and certificate, or using your own keys and certificates imported into the HSM.
Management
– Mutual authentication and secure channel between applications and the YubiHSM 2
– M of N unwrap key restore via YubiHSM Setup Tool
– M of N unwrap key restore via YubiHSM Setup Tool
Performances
Performance varies depending on usage. The accompanying Software Development Kit includes performance tools that can be used for additional measurements. Example metrics from an otherwise unoccupied YubiHSM 2:
RSA-2048-PKCS1-SHA256: ~139ms
RSA-3072-PKCS1-SHA384: ~504ms
RSA-4096-PKCS1-SHA512: ~852ms
ECDSA-P224-SHA1: ~64ms
ECDSA-P256-SHA256: ~73ms
ECDSA-P384-SHA384: ~120ms
ECDSA-P521-SHA512: ~210ms
EdDSA-25519-32Bytes: ~105ms
EdDSA-25519-64Bytes: ~121ms
EdDSA-25519-128Bytes: ~137ms
EdDSA-25519-256Bytes: ~168ms
EdDSA-25519-512Bytes: ~229ms
EdDSA-25519-1024Bytes: ~353ms
AES-(128|192|256)-CCM-Wrap: ~10ms
HMAC-SHA-(1|256): ~4ms
HMAC-SHA-(384|512): ~243ms
RSA-2048-PKCS1-SHA256: ~139ms
RSA-3072-PKCS1-SHA384: ~504ms
RSA-4096-PKCS1-SHA512: ~852ms
ECDSA-P224-SHA1: ~64ms
ECDSA-P256-SHA256: ~73ms
ECDSA-P384-SHA384: ~120ms
ECDSA-P521-SHA512: ~210ms
EdDSA-25519-32Bytes: ~105ms
EdDSA-25519-64Bytes: ~121ms
EdDSA-25519-128Bytes: ~137ms
EdDSA-25519-256Bytes: ~168ms
EdDSA-25519-512Bytes: ~229ms
EdDSA-25519-1024Bytes: ~353ms
AES-(128|192|256)-CCM-Wrap: ~10ms
HMAC-SHA-(1|256): ~4ms
HMAC-SHA-(384|512): ~243ms
Capacité de stockage
All data stored as objects. 256 object slots, 126KB max total
Stores up to 127 rsa2048 or 93 rsa3072 or 68 rsa4096 or 255 of any elliptic curve type, assuming only one authentication key is present
Object Types: Authentication keys (used to establish sessions); Asymmetric private keys; Opaque binary data objects (e.g. x509 certificates); Wrap keys; HMAC keys
Stores up to 127 rsa2048 or 93 rsa3072 or 68 rsa4096 or 255 of any elliptic curve type, assuming only one authentication key is present
Object Types: Authentication keys (used to establish sessions); Asymmetric private keys; Opaque binary data objects (e.g. x509 certificates); Wrap keys; HMAC keys
Spécifications physiques
Facteur de forme:
Connecteur: USB-A Nano
Dimensions: 12mm x 13mm x 3.1mm
Poids: 1g
Températures:
Seuils en fonctionnement: 0 °C à 40 °C
Seuils en stockage: -20 °C à 85 °C
Systèmes d'exploitation supportés
Windows, Linux, macOS
| OS | Version | Architecture |
| Linux | CentOS 6 CentOS 7 Debian 8 Debian 9 Fedora 25 Ubuntu 1404 Ubuntu 1604 | amd64 |
| Windows | Windows 10 Windows Server 2012 Windows Server 2016 | amd64 |
| macOS | 10.12 Sierra 10.13 High Sierra | amd64 |
