Subject: Re: [Cfrg] Elliptic Curves - signature scheme (ends on April 22nd)

From: Peter Gutmann <[email-masked]>
Date: Sun, 12 Apr 2015 07:13:42 +0000

Erwann Abalea <[email-masked]> writes:

>If there's no HSM to work with keys under these curves and these signature
>schemes, CAs won't be able to use such keys and schemes to sign certificates
>with.

There's always a FIPS 140 level 3 compliant hardware device that'll work with
anything.  As CNNIC's sub-CA MCS recently pointed out, there's the usual list
of routers and firewalls, but also lots and lots of disk drives (HDD and SSD),
digital cinema projectors, franking machines, and a whole array of USB keys,
alongside more unusual items like satellite modems, a medication monitor (like
the firewall used by MCS, it's mostly level 3 but only level 2 overall), a
barcode reader (as above), Java cards, a handful of tape drives, and, most
interestingly, a family of ARM CPUs targeted at smart phones, tablets, and
thin clients, including among other things the OLPC XO-3.  So as long as you
can get an USB key, hard disk, franking machine, or OLPC, to store your key
on, you're compliant.

Peter.