nShield PQC Option Pack v1.4.1 Installation and User Guide

This guide describes how to install the nShield Post-Quantum Cryptography (PQC) Option Pack library, also known as PQCOP, with your Security World software. This allows you to use your existing keys and algorithms alongside post-quantum algorithms.

The nShield PQC Option Pack enables Security World Software users to generate and use keys with public-key cryptographic algorithms selected by NIST as part of the Post-Quantum Cryptography standardization process.

Product configurations

Entrust has successfully tested the nShield PQC Option Pack on Ubuntu 22.04 and Windows Server 2022 in the following configurations:

PQCOP CodeSafe Security World HSM Firmware Netimage FIPS Level 3

1.4.1

13.9.3

13.9.3

nShield Connect XC

13.8.3

13.9.3

No

1.4.1

13.9.3

13.9.3

nShield 5c

13.8.4

13.9.3

No

Requirements

Ensure that you have supported versions of all products as described in Product configurations.

To perform the integration tasks, you must have:

  • root access on the operating system.
    This is required to install Security World. You can obtain root access through sudo.

  • Access to an account in the nfast group.

sudo is used in some commands; however, it is not necessary if the user has nfast group access.

Before starting the integration process, familiarize yourself with the documentation and setup processes for:

  • The HSM documentation. This guide assumes that your HSM is already set up.

  • CodeSafe running on the nShield Connect XC

  • CodeSafe 5 running on the nShield 5c

  • The nShield PQC Option Pack

Before using the nShield software, you need to know the number and quorum of cards in the Administrator Card Set (ACS) and Operator Card Set (OCS), and the policy for managing these cards.

Entrust recommends that you allow only unprivileged connections unless you are performing administrative tasks.

For more information, see the documentation for the HSM.

ML-DSA is now supported in firmware. Entrust recomends using it through the main product line rather than through the nShield PQC Option Pack. LMS will be the default algorithm in nShield PQC Option Pack releases after version 1.4.1.

More information

For more information about OS support, contact Entrust nShield Support at https://nshieldsupport.entrust.com.

Access to the Entrust nShield Support Portal is available to customers under maintenance. To request an account, contact nshield.support@entrust.com.