Entrust nShield 5s: Hardware Security for the Post-Quantum Era
Deliver high-assurance cryptographic key services with a dedicated PCIe HSM designed for crypto-agility, native hardware-accelerated post-quantum algorithm support, and long-term cryptographic resilience.
Entrust nShield 5s is a PCIe hardware security module that delivers highly scalable cryptographic services, hardware-backed key protection, and crypto-agile security for applications hosted on individual servers and appliances.
nShield 5s HSMs protect sensitive information with cryptographic key services while delivering crypto-agile security and hardware-accelerated post-quantum readiness.
More than 100,000 Entrust nShield HSMs are deployed globally across government, financial services, and technology organizations, supported by more than 150 partner integrations.
Protect sensitive cryptographic keys
Scale encryption, signing, and authentication
Prepare for post-quantum cryptography
Product Highlights:
Future-Proof Your Cryptographic Infrastructure
Build a foundation for long-term security with crypto-agile protection and hardware-accelerated support for emerging post-quantum cryptographic standards.
Strengthen Hardware-Rooted Trust
Protect sensitive keys and cryptographic operations with a dedicated PCIe HSM that delivers high-assurance security directly within your server infrastructure.
Deliver Security at Enterprise Scale
Enable high-performance encryption, signing, and authentication services across critical applications while maintaining the flexibility to adapt to changing cryptographic requirements.
Entrust nShield 5s HSMs
nShield 5s HSMs are PCIe cards that perform encryption, digital signing, and key generation for an extensive range of commercial and custom-built applications, including certificate authorities, code signing, and more. With their comprehensive capabilities and quantum crypto-agility, they are 100% compatible with existing nShield HSM deployments and APIs, and they are highly secure, with FIPS 140-3 Level 3 certification*.
*FIPS 140-3 Validated, Certificate #4745
Models
The nShield 5s HSM series includes the new high-performance nShield 5s High, which offers superior asymmetric and symmetric performance and best-in-class elliptic curve cryptography (ECC) transaction rates.
nShield 5s Benefits
Powerful Architecture
Our Security World architecture integrates nShield HSMs into a unified ecosystem, delivering scalability, load balancing, and more.
Post-Quantum Ready
Prepare for quantum-era threats with native firmware support for hardware-accelerated, NIST-standardized post-quantum algorithms.
Protection of Sensitive Business and Application Logic
Execute code within nShield boundaries, protecting your applications and the data they process.
Scale Cryptographic Services More Efficiently
With nShield Multi-Tenancy for nShield 5s, you can support multiple tenants on shared HSM infrastructure while maintaining an independent root of trust with separate Security Worlds and strong cryptographic separation.
The result is a more flexible way to support different application, business unit, and compliance needs while making more efficient use of HSM resources.
Tech Specs
Certified Hardware Solutions
Entrust has earned a broad set of certifications for nShield HSM products. These certifications help our customers to demonstrate compliance while also helping to give them the assurance that their nShield HSMs meet stringent industry standards.
Safety and Environmental Standards Compliance
- UL, CE, FCC, Canada ICES, KC, VCCI, RCM, UKCA RoHS, WEEE, REACH
Security Compliance
- FIPS 140-3 Level 3 eIDAS and Common Criteria EAL4 + AVA_VAN.5 and ALC_FLR.2 certification against EN 419 221-5 Protection Profile, under the Dutch NSCIB scheme
- Can form the basis of an EN 419 241-2 certified remote signing system for eIDAS
- Compliant with BSI AIS 31 for true and deterministic random number generation
- Validated progress toward quantum-safe cryptography: Entrust nShield HSM implementations of ML-DSA, ML-KEM, and SLH-DSA have achieved validation through NIST’s Cryptographic Algorithm Validation Program
Supported APIs
- PKCS#11, OpenSSL, Java (JCE), Microsoft CAPI and CNG, nCore, and Web Services
Supported Cryptographic Algorithms
- Post-quantum cryptography: Native firmware support for NIST-standardized post-quantum algorithms, including ML-DSA, ML-KEM, and SLH-DSA, with a crypto-agile architecture designed to support future algorithm updates through firmware
- Full NIST Suite B implementation
- Asymmetric algorithms: RSA, Diffie-Hellman, ECMQV, DSA, El- Gamal, KCDSA, ECDSA (including NIST, Brainpool & secp256k1 curves), ECDH, Edwards (Ed25519, Ed25519ph)
- Symmetric algorithms: AES, AES-GCM, Arcfour, ARIA, Camellia, MD5 HMAC, RIPEMD160 HMAC, SEED, SHA-1 HMAC, SHA-224 HMAC, SHA-256 HMAC, SHA-384 HMAC, SHA-512 HMAC, Tiger HMAC, 3DES
- Hash/message digest: MD5, SHA-1, SHA-2 (224, 256, 384, 512 bit), HAS-160, RIPEMD160, SHA-3 (224, 256, 384, 512 bit)
- Elliptic Curve Key Agreement (ECKA) available via Java API and nCore APIs
- Elliptic Curve Integrated Encryption Scheme (ECIES) available via Java API, PKCS#11 and nCore APIs
- TUAK & MILENAGE algorithm support for mutual authentication and key generation (3GPP)
Supported Platforms
Windows and Linux operating systems including distributions from Red Hat and SUSE.
Reliability
Calculated at 25°C operating temperature using Telcordia SR-332 “Reliability Prediction Procedure for Electronic Equipment" MTBF Standard
- nShield 5s HSM: 1,702,841 hours
| Available Models and Performance | |||
|---|---|---|---|
| nShield 5s models | Base | Mid | High |
| ML-DSA signing performance (tps) for NIST standardized PQC schemes | |||
| ML-DSA-44 | 380 | 890 | 3,070 |
| ML-DSA-65 | 270 | 620 | 2,130 |
| ML-DSA-87 | 230 | 520 | 1,740 |
| ML-KEM decapsulation performance (tps) for NIST standardized PQC schemes | |||
| ML-KEM-512 decapsulation | 3,540 | 4,090 | 5,780 |
| ML-KEM-768 decapsulation | 2,700 | 3,190 | 4,580 |
| ML-KEM-1024 decapsulation | 2,140 | 2,720 | 3,470 |
| ML-KEM encapsulation performance (tps) for NIST standardized PQC schemes | |||
| ML-KEM-512 encapsulation | 4,180 | 4,670 | 7,050 |
| ML-KEM-768 encapsulation | 3,140 | 4,100 | 5,800 |
| ML-KEM-1024 encapsulation | 2,450 | 3,590 | 4,630 |
| RSA signing performance (tps) for NIST recommended key lengths | |||
| 2048 bit | 580 | 3,470 | 12,310 |
| 4096 bit | 110 | 690 | 2,060 |
| 8192 bit | 15 | 95 | 310 |
| ECC prime curve signing performance (tps) for NIST recommended key lengths | |||
| 256 bit | 2,080 | 7,540 | 26,160 |
| 512 bit | 850 | 5,060 | 14,560 |
| Key generation (key/sec) | |||
| RSA 2048 bit | 10 | 50 | 70 |
| ECDSA P-256 bit | 2,070 | 2,070 | 5,350 |
| ECDSA P-521 bit | 850 | 4,410 | 4,210 |
| Key agreement performance (transactions/sec) | |||
| ECDH P-256 bit | 2,080 | 7,540 | 26,370 |
PQC algorithm note: Post-quantum cryptographic performance results are indicative and based on testing with firmware version 13.8.6 in Hybrid Hardware Accelerated Mode under lab conditions.
Classical algorithm note: Traditional cryptographic performance results are indicative and based on testing with firmware version 13.5.6 under lab conditions.
Performance in customer environments may vary.
Each nShield 5s HSM is supplied with an external smart card reader for local use.
| Supported Cryptographic Algorithms | Supported Cryptographic Algorithms | Application Programming Interfaces (APIs) |
|---|---|---|
|
|
|
| Host Connectivity | Security Compliance | Safety and environmental compliance | Management and Monitoring | Physical Characteristics |
|---|---|---|---|---|
|
|
|
|
|
1: Calculated at 25 degrees centigrade operating temperature using Telcordia SR-332
“Reliability Prediction Procedure for Electronic Equipment” MTBF Standard
Options and Accessories
Performance Ratings and Options
We have a variety of nShield 5s models to meet your performance needs. You can select among the performance models shown in the Tech Specs tab and can also purchase in-field upgrades from lower nShield 5s performance models to higher performance models.
Software Options packs
Entrust offers a range of software option packs that can be used in conjunction with your nShield HSMs.
nShield Monitoring
The nShield HSM monitoring platform enables operations teams to gain 24/7 visibility into the status of all their nShield HSMs, including those residing across distributed data centers. With this solution, security teams can efficiently inspect HSMs and find out immediately if any potential security, configuration, or utilization issue may compromise their mission-critical infrastructure.
Remote Administration Kits
nShield Remote Administration lets operators manage distributed nShield HSMs – including adding applications, upgrading firmware, checking status, re-booting and more – from their office locations, reducing travel and saving money. Remote Administration Kits contain the hardware and software needed to set up and use the tool.
CodeSafe
CodeSafe is a powerful, secure environment that lets you execute applications within the secure boundaries of nShield HSMs. Sample applications include digital meters, authentication agents, digital signature agents and custom encryption processes. CodeSafe is available with FIPS Level 3 certified network attached and PCIe nShield HSMs
CipherTools
CipherTools is a set of tutorials, reference documentation, sample programs and additional libraries. With this toolkit, developers can take full advantage of the advanced integration capabilities of nShield HSMs. In addition to offering support for standard APIs, the toolkit enables you to run custom applications with nShield HSMs. CipherTools is included free of charge in the standard Security World software ISO/DVD.
KCDSA Activation
With the KCDSA activation license, you can use the Korean Certificate-based Digital Signature Algorithm (KCSDA) as well as HAS-160, SEED, and ARIA algorithms on nShield HSMs.
Smart Card Reader Rackmount
For organizations deploying one or more nShield 5s modules in a 19" rack, the optional nShield smart card reader rackmount provides a practical and clean solution for attaching card readers in the data center. The rackmount is 1U in height and can be equipped with up to four smart card readers, which come standard with nShield 5s cards. Each unit is packaged with three blanking plates to cover any unused slots.
Frequently Asked Questions
What is a PCIe HSM?
An HSM device is a physical appliance used to manage cryptographic keys and perform encryption operations securely. PCIe refers to the device’s connection interface, Peripheral Component Interconnect Express — a high-speed method of connecting HSMs to the motherboard of a computer or application server.
Why Use a PCIe HSM?
An HSM device with a PCIe interface offers several advantageous capabilities. Key features include:
- Secure key storage: Stores cryptographic keys in tamper-resistant hardware
- High performance: Speeds up cryptographic operations compared to software-based solutions
- Compliance: Helps organizations meet regulatory standards like FIPS 140-2 3 and PCI DSS
What is the nShield 5s HSM?
The nShield 5s HSM (Hardware Security Module) is a high-performance, certified cryptographic device designed to protect sensitive data, keys, and cryptographic operations. It ensures compliance with regulatory standards, supports secure integration with various systems, and offers flexible deployment options, including cloud, hybrid, and on-premises environments.
Each model provides robust cryptographic operations to support essential security functions like encryption, digital signing, and key generation. Between Base, Mid, and High, organizations can choose the nShield 5s that aligns best with their operational requirements. This flexibility allows them to scale and upgrade their cryptographic functions as security needs evolve.
How Can I Use an HSM?
nShield HSMs deliver high-assurance data security and cryptographic protection for a broad range of use cases, including:
- Cloud computing and container security
- Key management
- Digital signing
- Code signing
- Public key infrastructure and certificate management
- Identity authentication
- Payment security
- Encryption, database security, and tokenization
- Privileged access and secrets management
Related Products
Related Resources
Learn how a PCIe HSM like the Entrust nShield 5s can help you protect sensitive information and perform cryptographic operations at the highest level.