Introduction

This guide describes how to:

  • Install and configure Entrust Cryptographic Security Platform Key Management Vault

  • Integrate Entrust Cryptographic Security Platform Key Management Vault and Entrust nShield HSM to establish a hardware root of trust for all encryption keys

  • Protect the Cryptographic Security Platform Key Management Vault Admin Key in the HSM

When all of these procedures are performed, the combined solution facilitates regulatory compliance with a FIPS 140 Level 3 and Common Criteria EAL4+ root of trust.

  • Entrust recommends that you allow only unprivileged connections unless you are performing administrative tasks.

  • Until and including v13.4.5 firmware, all nShield HSMs require specific activation to utilize the elliptic curve features. See the nShield Security World documentation at nShield Product Documentation website.

Product configuration

Entrust has successfully tested nShield HSM integration with Key Management Vault in the following configurations:

Vendor Product Version

Entrust

Cryptographic Security Platform

1.4

Entrust

Key Management Vault

10.5.3

Entrust

Compliance Manager

10.5.3

Entrust

nShield Security World

13.9.0

Entrust

nShield HSM hardware

Connect XC, nShield 5c

Supported features

Entrust has successfully tested nShield HSM integration with the following features:

Feature Support

Softcards

Yes

Module-only key

Not Supported

OCS cards

For FIPS Authorization Only

nSaaS

Not tested

Supported nShield hardware and software versions

Entrust has successfully tested with the following nShield hardware and software versions:

HSM Security World Software Firmware Image Cryptographic Security Platform Version Tested

Connect XC

13.9.0

13.8.3 (Post-quantum Supported Firmware)

13.9.5

1.3, 1.4

nShield 5c

13.9.0

13.8.4 (Post-quantum Supported Firmware)

13.9.5

1.3, 1.4

Connect XC

13.9.0

12.72.4 (FIPS 140-3 certified)

13.6.14

1.3*

nShield 5c

13.9.0

13.4.5 (FIPS 140-3 certified)

13.6.14

1.3*

Connect XC

13.9.0

12.60.15 (Common Criteria certified)

13.6.14

1.3*

nShield 5c

13.9.0

13.5.1 (Common Criteria certified)

13.6.14

1.3*

Cryptographic Security Platform 1.4 was only tested using post-quantum supported HSM firmware.