HSMs in Plain Envelopes: A Code Signing Story

on YouTube ↗23m

" summary

Project needs immediate Windows trust for a public open source release so code signing certificate choice and hardware tokens matter. Certificate arrives on a USB token in a plain envelope, vendor names (SafeNet/Gemalto/Thales) and CA docs mismatch, and signing requires Windows signtool or workarounds. Practical fixes: use OpenSC and PKCS#11 to talk to tokens, fix timestamp server calls, prefer YubiKey attestation or cloud HSMs for distributed signing, and favor regular code‑sign certs after the June FIPS mandate.

AI-written summary · about

" chapters (8)

1. 0:00Start
2. 1:05Foreword
3. 2:52Code Signing Journey
4. 3:40Obtain a Code Signing Certificate
5. 9:56Talking to the Token
6. 11:41Sign With the Token (code sign certificate)
7. 14:54Code Signing Ecosystem
8. 17:44Requests and Wishes

" related talks

• 24mHSM Advances Supporting quantum-safe PKI AutomationOlivier Couillard · Post-Quantum Cryptography Conference 2025
• 33mDemystify Modern Signing: Keys, Certs, and EnvelopesJohn Kjell · CloudNativeSecurityCon North America 2024
• 49mEverything about code signing and how not to use itRaimund Andree · PowerShell + DevOps Global Summit 2025
• 50mBuild code signing and crypto PKI toolingKarthik Jayaraman, Daniel Major, Dmitry Kovalev · AWS re:Inforce 2023
• 27mNo Keys? No Problem: Why You Can Trust Sigstore SignaturesFredrik Skogman, Joshua Lock, Asra Ali · SigstoreCon North America 2022
• 27mSecurity++: Hide Your Secrets via a Distributed Hardware Security Mod...Malini Bhandaru, Iris Ding · CloudNativeSecurityCon North America 2023
• 37mSecuring Data in the Quantum Era: From the Root of Trust to Protecting EcosystemsNils Gerhardt · Post-Quantum Cryptography Conference Austin 2025
• 43mShhh - Stop Sharing Secrets, a Secure Mindset for Embedded DevelopmentRicardo Salveti, Andy Doan · Embedded Linux Conference @ Open Source Summit North America 2022