blog.robur.coop

The Robur cooperative blog.
Back to index

NetHSM: a security module using MirageOS and Muen

2018-06-01

From 2018 until 2023 we worked on NetHSM, a commercial project from Nitrokey.

Nitrokey (client) wants to develop an innovative Hardware Security Module (HSM). This should be able to securely store a large number of cryptographic keys, have a high computing performance and offer common key management functions. The NitroHSM comes as a server and offers a REST-based API for consumers.

Components of the NitroHSM within the scope to be delivered as part of this engagement include:

  • core functionality (business logic), implemented in OCaml and based on the MirageOS framework,
  • integration with the formally-verified Muen Separation Kernel, including any customizations for board support and implementation of missing functionality required for the system,
  • development of a custom "Linux distribution" for Linux-based Muen Subjects,
  • integration with platform Firmware ("stock BIOS" or Coreboot),
  • secure software updates.

These components are described in detail in the NitroHSM System Design and RAML API specification documents, already delivered separately by Robur to the client. These documents will be updated on an on-going, iterative basis during development.

The main purpose of such a HSM is to securely store cryptographic keys, and never leak them to the outside world. The security is designed to be minimal (the network card driver is a minimal Linux kernel with only network card driver, not even a full TCP/IP stack). Extensions included verified boot and elliptic curve cryptography.

We invoiced in total 134_000€. Involved were Stefanie Schirmer, Martin Lucina, and Hannes Mehnert.

Our system design, and the current vendor documentation. Please note that this project has moved on, and taken various decisions that are not aligned with our system design.

An initial version of mirage-crypto-ec, elliptic curve cryptography for OCaml, has been part of this project. There is a git repository - even with a history branch where our contributions are visible.