Does anyone know of software available to make an old PC into something like a hardware security module. OpenHSM.org looks like what I want, but the site says they're still in the design phase, and the last update was in 2004.
I can't stand the thought of storing my private key on my main computer. I use my main computer for things like web browsing and email, which I think puts its security in serious jeopardy. I think a separate computer which has only a single function, would be a valuable increase in security. I've been considering getting an OpenPGP Card, but there are three reasons I'm reluctant to. The main one is that I want something that will only do one signature or decryption at a time. That way if my machine is compromised, I'll only suffer one hit before I'll notice something's wrong. Can the OpenPGP Card be set to do one operation per pin entry when used with a card reader that has a keypad? This seems like such a useful feature to me that I'm surprised smart card manufacturers don't embed little buttons near the edge of the smart card. The second reason is that I generally prefer open source security software. It seems the OpenPGP Card relies on the proprietary BasicCard operating system. Finally, it looks like the OpenPGP Card costs about 26.4 Euros (about $36) shipped from Europe. That's a little high for me right now. There are two other minor issues. I'd prefer my keys be encrypted when not in use, so that if my device falls into the wrong hands, I won't have to worry too much. Does the OpenPGP Card encrypt the keys while stored on the card? Also, the OpenPGP Card appears to be from a german organization, like the one that developed the Java Anonymous Proxy, and was forced by the german government to back door the software. Does the german government still consider it legal to force programmers to back door their software? I heard they were appealing it, but I never heard how that all turned out. With governments accusing each other of stealing proprietary info and such, I think I'd like to just keep my private key private. Does anyone know if any other democratic governments consider it legal to force programmers to incorporate back doors? Thanks, Casey _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
