My last talk on #Ethereum, Decentralisation: Original dream vs. shaping reality So long, and thanks for all the fish! 🐣

TIL that Ed25519 digital signatures have 2 modes: pure-ed25519 and ed25519ph. The former operates on a raw message, the latter on a pre-hashed message. The purpose of ed25519ph is to run on HSMs. The YubiHSM does not support it... so for $800, it can only sign 2019 bytes max. 🥲

Spent the weekend automatic my firmware signing workflow 🥰 Signers are selected automatically based on what's plugged in, binaries and signatures come and go straight out of GitHub releases. Need to hook in my Cloudflare R2 publisher code too and then it's 🥳🔥🤯

Got fed up with trying to remember which YubiThingy to plug in; which CLI flags to specify; and what signing call to make. So I made a signer registry to define all the keys available across different hardware. Then it returns whatever is plugged in for the operations I need. 😍

Ahahahaha, #YubiKey code quality: yubico-piv-tool --sign If the key is RSA, it hashes the input data itself. If the key is Ed25519, you must hash the input yourself. Because fuck you, that's why.

Sigh. I've been integrating #YubiKey now for develop stuff. ykman: can operate on many keys, cannot sign yubico-piv-tool: can sign, uses the first key it finds I'm really having second thoughts about @Yubico here, why is everything half-assed?!

Fuck my life, a #YubiHSM can: - Attest asymmetric keys - Generate asymmetric wrap keys - CANNOT attest asymmetric wrap keys I.e. when you're trying to back up your HSM to another HSM, it's cryptographically impossible to prove that it will be encrypted to the HSM you intend to.

Q: How many YubiKeys do you have? A: Yes.

If anyone wants to grab a coffee in Zug on the 31st, ping me :) Or a drink on the 30th during the #Ethereum bday party by @AKASHAorg.

Having played with a #YubiHSM for about 4 full days, I'm kind of happy with the choice! 😁 That said, it also falls short on a number of places, so your mileage may vary (also some places where I needed it not to fall short). 🧵