search

square / subzero

Block's Bitcoin Cold Storage solution.
Apache License 2.0
683 stars 95 forks source link

Document compatible HSM hardware models #177

Closed bosswissam closed 4 years ago

bosswissam commented 4 years ago

Hi Team

Would be great if information about the HSM spec that is more detailed than "Thales nCipher Solo XC low" is added to the documentation. Searching for "Thales nCipher Solo XC low" does not yield an exact match (there's "Thales nShield" but without knowing the specs it's hard to compare).

Does not have to be an exact model number, just which HSM devices this code is compatible with or if there is a way to test for compatibility without having to purchase the HSM would be great.

Thanks!

alokmenghrajani commented 4 years ago

We have been using Thales nCipher Solo XC low (sometimes referred to as base?). The difference between low/mid/high is speed & pricing. There is no functional differences. Our development environment is high, so we are 100% confident the code also works with the high model.

Keep in mind that the CodeSafe license is required and typically billed separately. The firmware version we currently use is 12.50.11 and we try to use the vendor's latest firmware/software except when we run into technical issues and rollback.

To the best of my knowledge, Thales' other nCipher products are supposed to only differ in form factor. Therefore, the code should work out of the box with an Edge or a Connect. We can however not guarantee this since we don't own the other form factors.

nShield was the old name for the nCipher, and seems to be resurfacing? I tend to use nShield/nCipher interchangeably. Also, these devices are now manufactured by a spin off called nCipher Security.

I'll update the documentation to reflect all this and make sure we are consistent on the naming side of things.

bosswissam commented 4 years ago

Thanks @alokmenghrajani

Yes I think the names might have changed which is what has been confusing for me - I am looking at this product page for them and it seems the closest naming-wise

In their own press-release about subzero, they called the model "nCipher nShield Solo XC hardware security module".

I'm contacting their sales team as well just to see what exact models they have - their product page mentions a "series" but does not seem to list all options, at least not the base/low/mid/high that you mention.

alokmenghrajani commented 4 years ago

Their marketing material refers to the device as nShield but their software calls it nCipher. We are going to continue calling it nCipher since that's what shows up in things like Java import statements.

On https://www.ncipher.com/products/general-purpose-hsms/nshield-solo, click on Specifications. You'll see the XC Base, XC Mid and XC High in there.

alokmenghrajani commented 4 years ago

I updated https://subzero.readthedocs.io/en/master/physical_components/. Closing this ticket, but feel free to reopen if you have any other questions related to picking the right device.