My frequent visits to whisky distilleries around Scotland have drummed into me that the clear spirit once distilled and casked must be left to mature for a minimum of three years before it can be legally sold. It reminds me of the adage that “good things take time.” The same can be said for the nShield 5 family of HSMs, which I have the pleasure to announce have now achieved FIPS 140-3 certification after years of innovation and experience in the field of cryptography and security. This is a major milestone for Entrust and our customers, as it demonstrates our commitment to delivering the highest standards of quality and assurance for our products.
FIPS 140-3 Validated, Certificate #4745
At Entrust we have been certifying hardware security modules (HSMs) to the FIPS 140 standard for over 25 years. Interestingly, it’s not a widely known fact that Entrust achieved the first ever FIPS 140 certificate #1 back in 1995. NIST FIPS 140-3 certification is the latest benchmark for validating the effectiveness of cryptographic hardware, but to fully appreciate the context of this milestone, we need to take a step back.
A Little History
FIPS 140-3 probably came onto my radar three or four years ago during one of my regular conversations over a coffee with my good colleague Ignacio Dieguez, Senior Principal Security Engineering at Entrust, discussing the changes from the incumbent 140-2 certification standard and the challenges that we’d need to unpack and resolve as we moved forward with the development of our next generation of HSMs.
The older FIPS 140-2 standard had been in play for as long as I can remember, certainly since the early 2000s. And then, from April 1, 2022, FIPS PUB 140-3 Security Requirements for Cryptographic Modules superseded FIPS 140-2 for new submissions. For HSM vendors like Entrust this was a significant change.
Building Solutions for the Future
Not only was it a new certification standard that we had to fully understand and interpret but we were also creating a brand-new hardware design and a new architecture to boot – one leveraging a field-programmable gate array (FPGA) security processor.
Ignacio and the Security Engineering team were not only thinking about FIPS 140-3 Level 3; they were also mindful of the incoming post-quantum threat. The secret sauce of FPGAs is their ability to be reprogrammed, even in the field once deployed (via firmware update). So, a unique feature of nShield 5 – unlike other HSMs – is that alongside in-field performance upgrades, the security processor can be reprogrammed with quantum-safe algorithms or other security updates in the future without a hardware swap-out. In business terms this means customers’ investment in the nShield 5 family is secure, knowing future updates such as addressing the quantum threat can be done without a costly refresh.
Just like the whisky maturing in those oak barrels, the FIPS submission has gone through much preparation by the Entrust Engineering team, then analysis, testing, and certification work by an independent third-party laboratory, including the validation of the hardware random number generator with the recent Entropy Source Validation (ESV) program (Cert. #E38), before being submitted to the Cryptographic Module Validation Program (CMVP) for final review and issuing of the certificate.
Those who regularly follow Entrust blog posts should already be aware that the nShield 5 family successfully received Common Criteria EAL4+ certification in recent months. So, with FIPS 140-3, Common Criteria, and certification to the latest random number generator entropy source, nShield 5 is well-placed for customers with stringent compliance mandates. Add to that the crypto-agility capability (via the FPGA) and multi-tenant capable architecture, with performance and field upgradability, and nShield 5 is well-positioned for future security requirements while meeting the business needs of those looking for a solid total cost of ownership (TCO).
Finally, it is well-understood that a solution seldom just requires an HSM. Typically, there is an application that interoperates with the HSM root of trust. In the Entrust portfolio, nShield 5 seamlessly integrates with KeyControl, our key management platform that supports an extensive range of use cases.
As you can see, Entrust nShield 5 HSMs are more than just a piece of hardware. They are the result of a long and careful process of design, development, and testing, guided by our vision of providing the best possible security solutions for our customers.
On hearing the news of the FIPS 140-3 certification, I dropped Ignacio an email to congratulate him and his engineering colleagues on this achievement. I wasn't surprised to get an out-of-office, on-vacation reply. I can only imagine he is sitting in the shade in some beach bar, raising a glass to celebrate the nShield FIPS 140-3 certification. Indeed, good things take time.
Just like a whisky connoisseur appreciates the nuances and flavors of a well-aged dram, we hope your organization will enjoy the benefits and features of our FIPS 140-3 certified HSMs. Cheers!
