Nitrokey is a German hardware provider specialized in open source security, and an established boutique in the European security community.

According to Nitrokey's website, they research and develop IT security hardware, and operate in critical sectors, including banking, military applications, and software development, covering most of the sectors that require a Public Key Infrastructure.

In the following post, we will go through the commercial analysis of Nitrokey's activity as a company, its business model and commercial perspectives; before diving in the product itself, where we will briefly assess the usage of the technology they provide, and share the results of the tests done on the Nitrokey USB devices.

Company

Nitrokey develops IT security hardware for data encryption, key management and user authentication.

The company addresses customers operating in several sectors, where they are required to maintain critical infrastructure, need to guarantee the integrity of their data/infrastructure, or require to be certified for Risk and Compliance purposes.

Through its online store described below, Nitrokey also provides hardware for the regular users, or the security professionals alike, who wish to secure their "digital life" on-the-go.

History

Nitrokey GmbH has been founded in Berlin, Germany in 2015. Its story dates back to 2008, when the founder, Mr Jan Suhr and two of his friends had the idea to create an open source USB key called “Crypto Stick”.

In August 2008, the non-profit open source project Crypto Stick was established, and version 1.0 of the first model of the USB device was released on December 27, 2009. In late 2014, after some years of producing the Crypto Stick, Nitrokey founders decided to establish the hardware concept as a for-profit company, and Nitrokey GmbH was founded in 2015.

Management

Headed by its founder and CEO, Mr Jan Suhr, Nitrokey provides a great level of transparency in regards to their activity, and the technology they use.

It is possible to know more about the company on their official Youtube channel, their twitter feed , or dive deeper in their technology stack on their github profile.

The products are well-documented across the online store, in the dedicated documentation website, and the Support Forum is available for established users, and potential customers.

Community

As an open source project, Nitrokey enjoys the support of a fairly prolific community of contributors, at different stages of product development, equally in software development, or in hardware research and development.

Nitrokey also counts international partners of different sizes, like the Linux Foundation business case described below, or most notably their collaboration with the secure hardware provider Purism, with whom they built the Librem Key.

Business

Product lines

According to their "About us" section on their website, Nitrokey develops "physical "latch keys” to comprehensively secure your digital life. Their goal is explicit: "We aim to provide the best open source security key on the market."

Nitrokey USB

Nitrokey's portfolio of products and services offers several options to secure data and infrastructure, for businesses and individuals. However, despite this generous product offering, there might be an overlap between the products, especially when we focus on the Nitrokey USB devices.

In this regard, the difference for the users, like myself, might seem minor in order to choose between an appropriate Nitrokey device, and I would recommend to focus on the key products in this product line, i.e. the Nitrokey HSM line, the Nitrokey Pro line (including the Nitrokey Storage which is a Nitrokey Pro with storage and other capabilities), and the Nitrokey FIDO line.

We have tested on-hands the Nitrokey devices, and you will find a review of their usage in the Technology section of this analysis.

NitroPad

Besides the Nitrokey USB line, the company provides the NitroPad product line, which is a line of secure computers that are built and shipped with consideration to strict privacy requirements.

For now, the Nitropads are only available with the model NitroPad X230 based on the Lenovo thinkPad X230, shipped with either Ubuntu or QubesOS. Maybe in the future Nitrokey will consider high-end machines, with the same security features, i.e. Coreboot, Heads and the Nitrokey Pro (or Nitrokey Storage) that is shipped with it.

NextBox

NextBox is an ready-to-deploy, and relatively secure, hardware NAS built Nexcloud Hub 19. It can be used by individuals or enterprise for backups, and any use-case of on-premise cloud hosting.

NetHSM

The NetHSM product line is the last product developed by Nitrokey, and even though I am not familiar with the device itself, it has very promising specs including the MirageOS unikernel implementation, and the formally verified Microkernel.

Here is what Nitrokey's website says about the usage of Mirage OS:

NetHSM is based on a so-called “unikernel” (MirageOS). Unikernels combine the operating system and application functionality into a specially tailored firmware that contains no unnecessary code. For example, NetHSM doesn't even contain a terminal shell and can't display to a screen. This way we achieve a very small overall system size (<10 MB) resulting in a minimal attack vector.

And about Micro Kernel verification:

To ensure additional security the formally verified micro kernel separates functional blocks from one another. This applies to device drivers, REST API, cryptographic operations, and key storage. For example if an attacker manages to compromise the network driver, he won‘t be able to access the cryptographic keys.

As a bonus, the device seems to be shipped with a physical smart card.

Business model

Online Store

Nitrokey's online shop is available at [https://shop.nitrokey.com/shop], and it provides a Business to Customer income stream to the company's overall revenue. It is possible to review the commercial back-end solution on the dedicated github repository.

Business Subscription

For enterprise customers Interested in rolling out Nitrokey, the Business Subscription is the commercial solutions that would fit best. The customer will be able to pay a fixed rate per user on a monthly or annual basis.

This offer covers the Nitrokey USB product range, with the possibility of upgrading to the newest products without extra costs.

Business fulfillment

For this particular business case, Nitrokey provides a clear Case Study: The Linux Foundation

"The Linux Foundation equips all Linux kernel developers with Nitrokey Start devices to enable source code signing. This protects against malicious modification of the Linux kernel during its development.

Nitrokey provides a dedicated checkout portal where kernel developers are authenticated and then submit their shipping address and choose between offered models and quantities. Subsequently, Nitrokey ships the ordered devices directly to the developer. The invoicing is handled between The Linux Foundation and Nitrokey without distracting the developers.

The Linux Foundation doesn't need to deal with the shipping and fulfillment. And besides, Nitrokey is happy to contribute to the security of the crucial Linux kernel."

Consulting

Besides Nitrokey's hardware products, they offer services and consulting. This includes customer-specific system customization of Nitrokey products, and their integration on customers' environment.

Competitive landscape

In order to position Nitrokey on the global market of hardware security, we must first mention that they are the only German player, having their products made in Germany.

In regards to the hardware production, Nitrokey places itself at a similar sector as Yubikey with the Nitrokey USB line, and as Purism with the NitroPad line, both companies located in the US. If we include the Hardware Security Modules and consulting business line, Nitrokey is in competition with companies similar to nCipher Security, formerly owned by the Thales Group.

Business perspectives

Given the diversification of the hardware products and their wide and deep product lines, Nitrokey seems to not leave place for chance, in regards to security hardware sales.

If they reduced the number of their USB products, and consolidated their mixed business model hardware sales and consulting, they can potentially generate higher revenue per unit.

Commercially they seem to evolve towards the production and shipment of Hardware Security Modules, as Nitrokey seems to focus more on the enterprise customer segment, which is arguably a commercially viable approach, knowing that security devices will be more-and-more in-demand across companies, if we assume that compliant markets are expanding.

In addition to their hardware product lines, and their business models, we would like to contribute to the expansion of Nitrokey's markets, by proposing the product to our stakeholders located in the MENA region, specifically Tunisia, and North Africa.

Technology

Product

We have received a set of Nitrokey USB devices to work-on, and understand their specifics. Personally, this is the most "fun" part of this analysis. I would like to take this opportunity to thank Mr Jan Suhr, since he accepted to support this work, and provided the required hardware.

It is planned to write a more technical write-up covering the technical specs of the keys, especially the smart card framework, and in the meanwhile you are invited to consult this excellent documents provided on the Nitrokey Documentation website.

Hoping that one day the Vink-io team will be able to test the NetHSM, since it covers the stack that we have discussed in a previous posting on this blog, so far we could work with the whole product line of Nitrokey devices, i.e The Nitrokey Pro 2, the Nitrokey Pro Storage 2 (2nd personal favorite), the Nitrokey HSM2 (1st personal favorite), and the Nitrokey FIDO 2.

In the following section we will cover the different use-cases as we previously documented them.

Usage

The Nitrokey USB devices have specific architectures and firmwares according to their target use-case.

The most interesting use-case for me personally was the Nitrokey HSM 2, as cold storage for bitcoin keys, even though it is not covered in this analysis.

Additionally to get a better idea of the usage of several Nitrokey devices, I have contributed and published on the official documentation website on this regard, with the validation of the Nitrokey team.

We used a mix of Nitrokey HSM and Nitrokey Pro to build a Certificate Authority, self-sign certificates, and authenticate to the OpenVPN server. This test was challenging, and we bumped into some technical issues, but the combination provides a very rigid security process for the advanced users.

In addition to Linux machines, we tested the OpenVPN authentication on Windows with Viscosity.

We also used the Nitrokey Pro for Hard Disk Encryption, and for full-disk encryption with cryptsetup and LUKS. The same set of devices was tested for automatic screen lock at removal of the device.

Finally with the Nitrokey FIDO 2, we tested several configurations with PAM and Linux.

Of course there are more use-cases covered, and we will document any further work.

Conclusion

The purpose of this analysis is to address our business stakeholders, in order to support our work, and build a closer relationship with the Nitrokey team, as official re-sellers in the MENA region.

So far, this article's goal is to sum up the collaboration we had during the last months with the Nitrokey team, and I hope our business audience found in this analysis some informative and explanatory material.

If you would like to support our work and contribute to the expansion of great technology, please do not hesitate to contact us at: contact [at] vink [dash] io [com].