HSM

In high security environments, at least one Hardware Security Module [HSM] should be present. The following HSM devices are approved to work with Digi-CA™ [1]:

• ARX PrivateServer™ HSM [2] - FIPS 140-2 Level 3 network HSM

• CryptoSec PCI card HSM [3] - FIPS 140-2 Level 3 & CC EAL4+ for installation inside a server

• CryptoSec Network HSM [4] - FIPS 140-2 Level 3 & CC EAL4+ high speed network HSM

Although not officially approved, or supplied by Digi-Sign, these HSMs also work with Digi-CA™ [1], however, selecting these HSMs will attract additional integration costs:

• Thales/nCipher netHSM - suitable for installation on a network

• Keyper Network HSM [5] - FIPS 140-2 Level 4, network HSM

• SafeNet Luna HSM - suitable for installation on a network

• No additional integration cost

• Direct support from Digi-CAST™ [6]

• Single supplier for your CA & HSMs

There are three main criteria to consider when selecting your HSM, namely:

• For fail over/load balancing and networking, a network HSM [2] is needed

• otherwise choose the either a CryptoSec PCI card HSM [3] or the ARX Network HSM [2]

• In high volume [4] situations, speed will be important

• Specified certification level (e.g. FIPS 140-2 Level 3 or Level 4 [5])