An enterprise-class key management system

Key management is the cryptographic process of creating, distributing, storing, and destroying encryption keys. The process is carried out with cryptographic technology such as hardware security modules (HSMs) and key management servers.

An encryption key is a string of bits created by a key generation algorithm. The algorithm is processed in hardware within the physically secure boundary of an HSM. The HSM circuit board features a hardware-based, independent random number generator (RNG) that randomizes the bits in the key. After the key is created, it can be used in an encryption algorithm to encrypt data, making it unreadable to unauthorized parties.

A key management server is cryptographic hardware designed to handle every aspect and use case related to key management. That includes creating encryption keys, storing them, managing the policies that determine key rotation and deletion, encrypting the keys, and digitally signing them. Beyond dealing with individual keys, Futurex key management servers can easily establish a certificate authority (CA), a logical entity which creates and issues digital certificates. Certificates can be used to create trust throughout entire networks by providing a secure way to authenticate users, devices, and documents. The key management server also establishes policies to help manage CAs, creating public key infrastructure (PKI) on an enterprise level.

As a crucial cryptographic operation, key management functions are usually performed within the physically secure boundaries of HSMs. As such, some HSMs can fulfill key management use cases. Futurex key management servers are cryptographic hardware dedicated to key management. This means they have the same level of physical and logical security as HSMs, but their architecture is specially designed to fulfill every key management use case an enterprise might need.

Step one: talk to a trusted vendor. Step two: look for a centralized solution. For example, Futurex’s KMES Series 3 was designed to give our customers exactly what they wanted in a key management solution: a one-stop-shop for all key management use cases. From PKI and CA to automatic key rotation and digital signing, the KMES can not only deploy any key management functionality, it can scale to manage keys on an enterprise level. All from a single, central platform deployed on-premises or in the cloud.

Pardon our slang, but the KMES Series 3 is a beast when it comes to functionality. It supports every major encryption algorithm, whether symmetric, asymmetric, hashing, elliptic curve, or what have you. Thanks to its flexible code base, it can be quickly configured to support new and emerging algorithms as well. Bit length is easily configurable, whether we’re talking AES 256 or RSA 8192-bit. In fewer words, the KMES Series 3 does it all.

There’s a big difference between running a key management software application on your computer, and integrating a key management server with your IT infrastructure. With a hardware-backed solution like an HSM or key management server, dedicated components on the circuit board perform encryption functions, taking the processing load away from the CPU. Encryption keys are also stored within dedicated hardware components. All of these components are protected by a physically secure, tamper-resistant boundary.

On the other hand, software-based key management is implemented through software applications running on the host’s CPU. The software application uses the CPU to execute encryption algorithms. With software, encryption keys are stored in the computer’s memory or storage device, posing a major security risk (among others).