Basic HSM for the mass generation of ethereum keys

Question

I'm looking to generate a lot of public / private key pairs (i.e. in the order of +100,000s). I would like to be able to do this on a budget HSM. The assets owned by the keys are effectively value-less but there would be potentially some reputational impact if they were stolen / hacked etc.

The device that generates the key pairs could be air-gapped and a transfer of the public keys sent over "by hand" into a queue that would then be used to populate when required and then topped up on a regular basis (daily / weekly etc).

What's a relatively straight forward way of doing this ? Is a hardware HSM a suitable solution ? Budget is definitely under 1k !

Answer 1

HSMs are good way to generate and store trusted keys. Even though they are very secure, they have some limitations especially on the memory/storage side. Since it's limited with storage, some use them to store master encryption/decryption key of a bunch of data. It depends on the model you want to use but it may not be possible to work with 5 blockchain networks with 500.000 key pairs. On the other hand, they usually dont let you to export private keys which means that you have limited actions on private keys. So they are hardwares not easy to deal with. And as far as I know hardware HSMs are not cheap devices (thales protect server is about 17k euros).

Long story short, you can generate and keep every single keys in HSM if it lets you to. Also another way, you can generate and keep your master seed in the HSM and keep your addresses and their paths outside. Whenever you need to sign a transaction, you can easily generate related private key with the master seed and path and sign the transaction. But I'm not sure if it is possible under 1k budget.

ps. Don't forget to spend some time to think on disaster recovery scenario if you plan to use hardware HSM. It's important to be able to re-generate all your addresses and private keys at a specific point with another hardware. So I suggest you to check the ways how to generate your master seed's mnemnonics from a device doesn't let your key to go out which is a bit challenging.

hope this helps. cheers.