Ok, so: "Use Argon2id to derive a key-encryption key from the PIN." gives little to no security, because of a very low entropy of the pin, unless argon2 params are excessive beyond this world. The whole security is being held by the hardware vault.
HSMs, in this case the vault, provided by the system, do not protect data cryptographically, those are more like "safes" and protect data physically. There are known attacks using laser and/or noise, emf, undervoltage and other stuff to pull keys from HSMs. Also there are CPU bugs which can allow to grab the keys.
In general this type of security is "good enough" for simple data, but it's nowhere near a long password with high entropy (long is above 30 chars and/or 9 words).
To protect data cryptographically, the key material has to have high entropy, there is no escape from that. Password stretchers like Argon2 help, but to an extent.
An HSM can store that entropy for us at the cost of the possibility of being cracked.
Sugestor Ultra
npub10n…6spqj
2026-09-16 02:28:53 UTC
in reply to nevent1q…n7d3
Author Public Key
npub10nev22800j2q5ncjcpynyqakyrhsg49y046ucyzlx3jj5mns7mmsv6spqjPublished at
2026-09-16 02:28:53 UTCEvent JSON
{
"id": "000000184329b3fd0f6f7fc38a6c3f110f112654560fc83905618abdfc90b2d0",
"pubkey": "7cf2c528ef7c940a4f12c0493203b620ef0454a47d75cc105f34652a6e70f6f7",
"created_at": 1789525733,
"kind": 1,
"tags": [
[
"e",
"69773adf1c352845a92bc95f5ab161da9b1c3177e6bfbeffb7f39fd4a9616452",
"wss://relay.primal.net/",
"root",
"20e17dd0ec1bb0832688e739ad89709d047deb23ed5146822efdd2d22ae504d7"
],
[
"e",
"000000449e9611d0fba90f441ee0ab23f2529a068f5129b2289ea7fb950d07bf",
"wss://nostr.bitcoiner.social/",
"",
"7cf2c528ef7c940a4f12c0493203b620ef0454a47d75cc105f34652a6e70f6f7"
],
[
"e",
"56c925d6cadc53c4f67d123043340c6e9c1de16119f503314866fe26d67d3696",
"wss://relay.snort.social/",
"reply",
"20e17dd0ec1bb0832688e739ad89709d047deb23ed5146822efdd2d22ae504d7"
],
[
"p",
"7cf2c528ef7c940a4f12c0493203b620ef0454a47d75cc105f34652a6e70f6f7",
"wss://nostr.mom/"
],
[
"p",
"20e17dd0ec1bb0832688e739ad89709d047deb23ed5146822efdd2d22ae504d7",
"wss://bitcoiner.social/"
],
[
"client",
"Amethyst"
],
[
"nonce",
"201a0b",
"25"
]
],
"content": "Ok, so: \"Use Argon2id to derive a key-encryption key from the PIN.\" gives little to no security, because of a very low entropy of the pin, unless argon2 params are excessive beyond this world. The whole security is being held by the hardware vault.\n\nHSMs, in this case the vault, provided by the system, do not protect data cryptographically, those are more like \"safes\" and protect data physically. There are known attacks using laser and/or noise, emf, undervoltage and other stuff to pull keys from HSMs. Also there are CPU bugs which can allow to grab the keys.\nIn general this type of security is \"good enough\" for simple data, but it's nowhere near a long password with high entropy (long is above 30 chars and/or 9 words).\n\nTo protect data cryptographically, the key material has to have high entropy, there is no escape from that. Password stretchers like Argon2 help, but to an extent.\nAn HSM can store that entropy for us at the cost of the possibility of being cracked.",
"sig": "99802d85cbe51f440e3699125482ddbdddf5205c2e2a06d33d9297a1798370b3e6526c75ed2776b34b93bccdfad27d86371516da5f8ddef6a1f54299e8346339"
}