Windows Server 2003: Hardware-Based Security Page 2

Luna CA3’s and nShield’s high degree of security is evident in the products’ compliance with with Federal Information Processing Standard 140-2 (FIPS 140-2), which is considered to be one of the most reliable industry recognized benchmarks defining security requirements for cryptographic modules. FIPS ratings are assigned after stringent testing in independent, accredited laboratories). FIPS 140-2 is the current standard (superceding FIPS 140-1) assigned through Cryptographic Module Validation Program and offered jointly by two government organizations: National Institute of Standards and Technology (NIST) and Communications Security Establishment (CSE).

FIPS is significant because its specifications define requirements sanctioned by federal agencies in both the United States and Canada, which practically guarantees a sufficient level of protection in any security-critical environment. FIPS 140-2 consists of four levels of assurance (with Level 4 the highest). Details and specifications of FIPS certification are posted on the NIST Web site. Note that all Cryptographic Service Providers included in Windows 2000 and Windows 2003 Server Certification Authorities are Level 1 FIPS compliant. When combined with products from Rainbow-Chrysalis or nCipher, their validation increases to Level 3.

In the past, HSM architectures have allocated one module for every system that requires encryption. This negatively affected capital cost as well as complicated administration and maintenance. Although this design is still viable for critical applications (where dedicated cryptography modules might be required), savings can be realized by employing a network-attached hardware security module (such as from nCipher’s netHSM or Chrysalis’ Luna SA), which can be shared across a number of systems. While the products are similar in many aspects, there are also some significant differences between them. In both cases, communication between shared HSMs and clients takes place over the network and is limited to systems registered manually with the device’s management utilities. In addition, HSM device clients must have appropriate Cryptography Service Providers software installed on them.

Luna SA is an Ethernet-attached, 2U (19″) rack-mountable appliance. It is capable of storing Windows 2000 and Windows 2003 Certificate Authority keys as well as SSL acceleration (for Web and ISA servers), handling up to 1200 SSL connections per server, and servicing up to 10 servers (with a combined capacity of up to 3600 transactions per second) using RSA 1024-bit keys.

netHSM is also an Ethernet-attached appliance. It boasts a slimmer (1U) rack-mountable form factor. The 1600 model offers up to 1600 transactions per second using RSA 1024-bit keys. netHSM, like nShield, implements Security World, which greatly simplifies the remote administration of multiple (both dedicated and shared) nCipher hardware security modules. This makes it easier to integrate netHSM into an environment containing other nCipher HSMs, as investments are protected and a unified management approach is accommodated. Security World also facilitates secure and unattended backups of all key materials. Another advantage of a netHSM-based infrastructure is its resiliency. By installing multiple network-shared devices, load balancing and failover capabilities can be implemented.

Although Security World is nCipher’s proprietary technology, Luna SA offers several features described in the previous paragraph, albeit in a different manner. High availability (including failover and load balancing) is accomplished through implementation of its Ultimate Trust Security Platform (UTSP) solution. Luna SA devices are limited to 80 key objects, and Rainbow-Chrysalis offers External Identity Management, which grants stored keys additional layers of encryption protection in an external database (equivalent to capabilities of nCipher products). Luna SA can be managed remotely using Secure Command Line Interface over a network or via a local console port. However, without an additional backup key protection system, backups are performed manually, using tokens. In some cases, multiple tokens might be required to back up all key material on a single device.

As of press time, only netHSM had obtained FIPS 140 certification (i.e., Level 3); Chrisalis-ITS product’s validation is pending. One possible security issue might result from the fact that although netHSM uses a hardened and cryptographically protected operating system with a strictly controlled user interface, without root-level access, Luna SA uses a standard Linux operating system. It is thus vulnerable to rogue software installations (via root account).

One final consideration is pricing. The advantages of netHSM are reflected in its base and connection license prices. However, when considering the actual operational cost of the Luna SA solution, the difference may turn out to be less significant. For more detailed information, refer to the appropriate sections of Rainbow-Chrysalis’ and nCypher’s Web sites.