Nitrokey HSM et Shamir Secret Sharing pour PKIaaS

Hardware Security:
- Infineon SLE78 secure chip
- Hardware random number generator
- Physical tamper resistance
- PIN/PUK authentication (up to 15 characters)
- RSA key generation up to 4096 bits
- ECC support (P-256, P-384, P-521)
- 3DES, AES encryption support

Performance:
- RSA 2048 signature: ~1.2 seconds
- RSA 4096 signature: ~4.8 seconds
- Key generation: 30-60 seconds
- Storage: Up to 38 RSA-2048 keypairs

Connectivity:
- USB 2.0 interface
- PKCS#11 standard interface
- OpenSC middleware support
- Cross-platform compatibility

Algorithme : Shamir Secret Sharing (1979)
Base mathématique : Interpolation polynomiale sur corps fini
Sécurité : Information-theoretically secure

Exemple 3-of-5 :
- Secret S divisé en 5 parts (s1, s2, s3, s4, s5)
- Toute combinaison de 3 parts reconstitue S
- 2 parts ou moins = aucune information sur S

class ShamirSecretSharing
{
    /**
     * Generate CA private key and split using Shamir Secret Sharing
     */
    public function generateDistributedCAKey(
        int $threshold,      // N (minimum shares needed)
        int $totalShares,    // M (total shares created)
        int $keySize = 4096  // CA key size
    ): array {
        // 1. Generate master CA private key
        $masterKey = $this->generateCAPrivateKey($keySize);

        // 2. Convert key to polynomial coefficients
        $polynomial = $this->keyToPolynomial($masterKey, $threshold);

        // 3. Generate shares for each Nitrokey
        $shares = [];
        for ($i = 1; $i <= $totalShares; $i++) {
            $shares[$i] = [
                'x' => $i,  // X coordinate
                'y' => $this->evaluatePolynomial($polynomial, $i)  // Y coordinate
            ];
        }

        // 4. Distribute shares to Nitrokey HSMs
        foreach ($shares as $index => $share) {
            $this->deployToNitrokey($index, $share);
        }

        // 5. Securely destroy master key
        sodium_memzero($masterKey);

        return [
            'threshold' => $threshold,
            'total_shares' => $totalShares,
            'key_id' => $this->generateKeyId(),
            'nitrokey_ids' => array_keys($shares)
        ];
    }
}

class DistributedSigningService
{
    /**
     * Sign certificate using threshold signature with Nitrokeys
     */
    public function signCertificate(
        string $certificateData,
        array $availableNitrokeys,  // Available Nitrokey IDs
        int $threshold
    ): string {
        // 1. Verify sufficient Nitrokeys available
        if (count($availableNitrokeys) < $threshold) {
            throw new InsufficientNitrokeysException();
        }

        // 2. Select required number of Nitrokeys
        $selectedNitrokeys = array_slice($availableNitrokeys, 0, $threshold);

        // 3. Retrieve shares from selected Nitrokeys
        $shares = [];
        foreach ($selectedNitrokeys as $nitroyId) {
            $shares[] = $this->retrieveShareFromNitrokey($nitroyId);
        }

        // 4. Reconstruct private key temporarily
        $privateKey = $this->reconstructPrivateKey($shares, $threshold);

        // 5. Sign certificate
        $signature = $this->signWithPrivateKey($certificateData, $privateKey);

        // 6. Immediately destroy reconstructed key
        sodium_memzero($privateKey);

        // 7. Log signing operation
        $this->logSigningOperation($selectedNitrokeys, $certificateData);

        return $signature;
    }
}

class NitrokeyManager
{
    /**
     * Initialize Nitrokey with share and configuration
     */
    public function initializeNitrokey(
        string $nitrokeyId,
        array $share,
        string $pin,
        string $soPin
    ): bool {
        // 1. Connect to Nitrokey via PKCS#11
        $session = $this->connectToNitrokey($nitrokeyId);

        // 2. Authenticate with SO PIN
        $this->authenticateSOPin($session, $soPin);

        // 3. Store share securely on Nitrokey
        $this->storeShare($session, $share);

        // 4. Set user PIN
        $this->setUserPin($session, $pin);

        // 5. Configure access policies
        $this->configureAccessPolicies($session);

        // 6. Generate unique Nitrokey certificate for identification
        $this->generateNitroykeyCertificate($session, $nitrokeyId);

        return true;
    }

    /**
     * Health check for Nitrokey availability
     */
    public function checkNitrokeyHealth(string $nitrokeyId): array
    {
        try {
            $session = $this->connectToNitrokey($nitrokeyId);
            $info = $this->getNitrokeyInfo($session);

            return [
                'status' => 'healthy',
                'serial' => $info['serial'],
                'firmware' => $info['firmware_version'],
                'storage_used' => $info['storage_usage'],
                'last_access' => $info['last_access_time']
            ];
        } catch (NitrokeyException $e) {
            return [
                'status' => 'unhealthy',
                'error' => $e->getMessage()
            ];
        }
    }
}

9 Nitrokeys au total :
- 3 Nitrokeys : Site principal (datacenter)
- 3 Nitrokeys : Site de backup géographiquement distant
- 2 Nitrokeys : Coffre-fort banque (cold storage)
- 1 Nitrokey : Dirigeant/RSSI (mobile)

Seuil : 5 Nitrokeys minimum pour signature
Tolérance : Perte de 4 Nitrokeys sans impact

5 Nitrokeys au total :
- 2 Nitrokeys : Équipe infrastructure (datacenter)
- 2 Nitrokeys : Équipe sécurité (bureau sécurisé)
- 1 Nitrokey : Management (coffre-fort)

Seuil : 3 Nitrokeys minimum pour signature
Tolérance : Perte de 2 Nitrokeys sans impact

3 Nitrokeys au total :
- 2 Nitrokeys : Équipe développement
- 1 Nitrokey : Tech lead/Architect

Seuil : 2 Nitrokeys minimum pour signature
Tolérance : Perte de 1 Nitrokey sans impact

# 1. Vérifier la disponibilité des Nitrokeys
php artisan nitrokey:health-check --required=3

# 2. Valider la demande de signature
php artisan ca:validate-request --csr=/path/to/request.csr

# 3. Préparer l'environnement de signature sécurisé
php artisan signing:prepare-session --threshold=3

# Opérateur 1 : Insérer premier Nitrokey
php artisan signing:add-nitrokey --id=NK001 --pin=****

# Opérateur 2 : Insérer deuxième Nitrokey
php artisan signing:add-nitrokey --id=NK002 --pin=****

# Opérateur 3 : Insérer troisième Nitrokey
php artisan signing:add-nitrokey --id=NK003 --pin=****

# Système : Vérifier seuil atteint et signer
php artisan signing:execute --csr=/path/to/request.csr

# Nettoyer session de signature
php artisan signing:cleanup-session

# Générer rapport d'audit
php artisan audit:generate-report --operation=certificate-signing

# Archiver logs sécurisés
php artisan audit:archive-logs --sign-with-timestamp

# 1. Vérifier nombre de Nitrokeys restantes
php artisan nitrokey:count-available

# 2. Si seuil encore atteignable, continuer l'opération
# Si seuil non atteignable, procédure de récupération :

# 3. Reconstituer clé avec Nitrokeys disponibles
php artisan recovery:reconstruct-key --emergency-mode

# 4. Générer nouvelles parts pour remplacer Nitrokeys perdues
php artisan recovery:generate-new-shares --replace=NK007,NK008

# 5. Mettre à jour configuration
php artisan recovery:update-configuration

Coût total HSM traditionnel : 1.2M€ - 1.6M€
Coût solution Nitrokey :
- 9 × Nitrokey HSM 2 : 3,600€
- Développement integration : 150K€
- Documentation/certification : 50K€
- TOTAL : ~200K€

ÉCONOMIE : 1M€ - 1.4M€ (85-90% de réduction)

1. ShamirSecretSharingService (3-4 semaines)
   - Génération et reconstruction de secrets
   - Interface avec Nitrokeys via PKCS#11
   - Gestion des polynômes et corps finis

2. DistributedSigningService (4-5 semaines)
   - Orchestration signature multi-parties
   - Session management sécurisée
   - Recovery et fallback procedures

3. NitrokeyManager (2-3 semaines)
   - Détection et configuration Nitrokeys
   - Health monitoring et diagnostics
   - PIN management et authentification

4. AuditLogger (1-2 semaines)
   - Logs de signature distribués
   - Compliance reporting
   - Event correlation et forensics

Effort total : ~3-4 développeurs × 3 mois = 180K€-240K€

// Modification CryptoService existant
class CryptoService
{
    private DistributedSigningService $distributedSigning;

    public function signCertificate(string $csr, CertificateAuthority $ca): Certificate
    {
        // Détection type de CA
        if ($ca->isDistributed()) {
            // Signature distribuée avec Nitrokeys
            return $this->distributedSigning->signCertificate($csr, $ca);
        } else {
            // Signature classique (backward compatibility)
            return $this->classicSigning->signCertificate($csr, $ca);
        }
    }
}

Production : 3-of-5 Nitrokeys (2,000€)
Development : 2-of-3 Nitrokeys (1,200€)
Disaster Recovery : 5-of-9 Nitrokeys (3,600€)

Total hardware : 6,800€
Total projet : 310K€
ROI vs HSM traditionnel : 1,200K€ économisés