Build code signing and crypto PKI tooling
summary
NVIDIA builds a company-wide code-signing service on AWS using AWS CloudHSM, handling over 60,000 signing events per day and more than 1 million assets signed in two years. The service (3S) uses CloudHSM crypto isolation with crypto users plus a ShareKey owner/user split, enforces M-of-N quorum authentication for admin actions, implements application-level multi-party approvals, and supports high-volume direct-to-HSM signing with a telemetry pipeline (Kinesis, Glue, Athena, QuickSight). The system runs at scale with daily HSM backups and SOC monitoring.
AI-written summary · about
chapters (15)
- 0:00Intro
- 3:29NVIDIA's wide software portfolio
- 8:54Code signing primer (2)
- 11:07Code signing security (2)
- 16:4335: Simple Signing Service (2)
- 22:19Leveraging AWS CloudHSM for code signing
- 22:50Isolate projects using crypto users
- 25:17Prevent key loss with crypto user sharing
- 27:44Securing administrative access via quorum
- 32:10Multiparty approval for signing operations
- 39:55Large-volume signing
- 43:22Direct2HSM architecture
- 44:50Direct2HSM telemetry
- 46:21Direct2HSM-QuickSight metrics
- 47:59Closing thoughts
related talks
15mSupply chain security: AWS Signer for build attribution
35mHardware Cryptographic Modules
45mLet's Encrypt Everything, Really Everything
32mSigning distribution artifacts with Signstar
29mNotary Project: The Key To Secure Software Supply Chain
23mHSMs in Plain Envelopes: A Code Signing Story
24mHSM Advances Supporting quantum-safe PKI Automation
17mVerifiable Build Environments in the Cloud: Powered by Sigstore and Enclaves