Release Notes

KeySafe 5 1.0 provides a centralized means to securely manage a distributed nShield HSM estate. This includes managing and creating Security Worlds and associated resources (Softcards and Card Sets).

The KeySafe 5 Installation Guide provides details of how to install and use the new platform. Read this document before installing the platform.

KeySafe 5 is a system to allow the management of an estate of HSMs through an intuitive web-based UI. The system also contains a RESTful API which can be used directly if required to provide custom management of the estate.

KeySafe 5 consists of a web API back end that uses MongoDB, a web UI front end, and the API gateway Istio, that handles authentication.

The main central management platform of KeySafe 5 is deployed as a Kubernetes application. For each nShield client machine that you want to manage using this platform, you must install a KeySafe 5 agent alongside the existing nShield hardserver.

The KeySafe 5 agent is installed on computers attached to HSMs and running the hardserver. The KeySafe 5 agent ensures that all key management data, with the exception of keys, is synchronised between the nShield client machine and the central (MongoDB) database. Communications between the agent and the back end are handled through the RabbitMQ message broker.

An HSM Pool is a collection of HSMs that are managed together. For example, loading a Security World on an HSM Pool will result in that Security World being loaded onto all the HSMs in the pool. In the current version an HSM Pool will be the collection of HSMs communicating with a single hardserver and a single KeySafe 5 agent.

The KeySafe 5 agent synchronises the state of the HSM Pool with the back end, and performs actions on its behalf. If you create a new card set or softcard, either through KeySafe 5 or manually, it will be synchronised to all the HSM Pools in the same Security World. If you make a deletion through KeySafe 5, such as deleting a softcard, that deletion will be applied by the agent to all KeySafe 5 HSM Pools in the same Security World. However if you delete a softcard without going through KeySafe 5, that deletion will not be applied to other HSM Pools in the same Security World.

Unless network-connected, an HSM can only be in one pool at any one time, but may be moved between machines in the usual manner, and KeySafe 5 will reflect this change. An HSM may have the HSM Pool’s Security World loaded.

A Security World may be loaded on multiple HSM Pools.

When performing an operation on the command-line, like creating a Security World, specifying all the parameters, and then inserting all the cards and typing their passphrases has to be done in one step. With KeySafe 5 this is separated into two steps: creating an operation, and then authorising it. When creating an operation all the parameters for that operation are requested, and then it is listed in the Outstanding Operations list against the Security World to which it belongs.

Whenever a user is required to present a card or a passphrase to complete an operation, an authorization is created. For example:

If there is a specific order that the authorizations must be provided then a subset of the authorizations may initially be in 'Blocked' state.

Example One:

In a FIPS-140-2-level-3 Security World, operations such as OCS or softcard creation require an initial FIPS authorization (presentation of an Administrator or Operator card from the Security World) to authorize the operation. In this case a 'FIPS' authorization is created that must be completed before any other authorization types.

Example Two:

Creating a Security World with a quorum of 2/4 cards in the ACS on a pool with 2 HSMs results in 6 authorization requests. The first 4 will be to create the Administrator Card Set on one HSM, and the subsequent 2 will be to load the Security World onto the other HSM.

KeySafe 5 v1.0 provides the following HSM Management operations:

KeySafe 5 v1.0 provides the following Security World management operations:

This release has been tested on the following Kubernetes versions:

This release has been tested using the following Istio versions:

This release has been tested using the following external service versions:

This release targets deployments with any combination of the following nShield HSMs:

This release has been tested for compatibility with the following operating systems:

See the nShield 12.80 and 13.2 Security World Software release notes for further details on supported hardware and platform combinations.

This release is compatible with the following nShield Security World software installations:

Firmware versions supported by the 12.80 and 13.2 release are also supported by KeySafe 5 v1.0. For additional details on Security World and firmware support, refer to the nShield 12.80 and 13.2 Security World software release notes.