As far as HSMs go the Yubico YubiHSM 2 is the cheapest and most approachable one I've found. [0] I don't have a good feeling for how it compares to some of the other products out there but it is also the only one that has a list price you don't have to call a sales person to get a quote on.
I've used both Thales nShield and Bull Proteccio models at my previous work.
Both are priced in the five figure euros/dollars range for any reasonable operational setup.
(In the sense that you need at least a production HSM and an additional machine to be able to react quickly to incidents and experiment with).
The YubiHSM v2 seems very promising to me too, but the thing you have to understand with HSMs is that their certifications are often as important, or even more important, than their actual security.
(Usually you use HSMs because you legally have to and not just for fun)
In that regard, both the nShield and the Proteccio are qualified at Level 3 of FIPS 140-2. This is a very expensive qualification to pass and the investment is reflected back in the price of those products.
Yubico does not advertise any qualification level for the YubiHSM 2, therefore I infer they did not pass any certification process. Hence I feel they will target a different market than Thales and Bull.
(People wanting more security but without needing certifications)
A 650$ FIPS level 3, eIDAS qualified HSM would be groundbreaking. As certification processes are quite political, I'm not even sure it would be possible as it would basically decimate current HSMs vendors.
Let's hope the YubiHSM v3 could be that though ? :)
Yes, if you want FIPS 140-2 you are going to pay the big bucks. Yubico's Yubikey 4 has a FIPS certified version so they have been through the process with other products but you are right that their HSM is not certified. If you care about FIPS certification you can look up if a product is certified or not in NIST's database. [0]
Some HSMs allow you to run custom code (usually a co-processor within the HSM’s security boundary but distinct from where the keys are loaded / raw crypto primitives happen).
Other HSMs don’t have this ability.
Finally some vendors will tell you that their hardware is extensible by them implementing custom logic/algorithms.
If you want to play around with HSMs (or any enterprise-grade hardware) I would recommend looking for used stuff on eBay or talking nicely to sales rep who might lend you a demo/eval unit.
Edit: literally any text data storage medium that can be powered down and locked in a safe will work perfectly well for any of this. It doesn't matter if it's a flash drive, floppy disk, CD ROM, piece of paper, or sheet of gold with characters scratched into it. Literally anything will work. You do not have to buy these $50 glorified flash drives to store your bitcoin.
That takes care of offline key storage, but you'll need a lot more than just a piece of paper (and a safe) to actually use the key securely: a secure offline computer, for a start, and a process for transferring the key and transaction data into that computer, signing the transaction, and getting the signed transaction back to a connected system for upload. At which point you've basically re-invented an ad-hoc, inefficient, and quite likely insecure hardware wallet / HSM.
Or were you just planning to scan the private key QR code with your (compromised) smartphone?
HSMs are a lot more than "glorified flash drives". The most important difference is that they keep the key data securely stored on the HSM and only allow it to be used in specific ways, such as signing individual transactions. Depending on the HSM you may even be able to program it to only sign transactions which meet specific requirements, such as transfers from cold storage to known hot wallet addresses.
