CODEWITHSUNDEEP
javaamazon-web-servicesjcesunpkcs11amazon-cloudhsm
Ooooof
Ooooof

Reputation: 23

Is the Sunpkcs11 provider compatible with the AWS CloudHSM?

I am trying to work with an HSM (hardware security module) to store keys and to do cryptographic operations. I want to operate the HSM inside a java application. For this I need to use a compatible java JCE provider as a mapping layer between the application and the standardized PKCS#11 interface of the HSM. I have played around with the Utimaco Cryptoserver Simulator in combination with the Sunpkcs11 provider in order to get a first understanding. It worked out fine!

But now I'd like to replace the Utimaco Cryptoserver Simulator with the AWS CloudHSM, but I'm a little confused about that. The FAQs states that the AWS CloudHSM provides a JCE (com.cavium.provider.caviumprovider). But I would like to use Sunpkcs11 provider for this.

  1. Is it possible to use the Sunpkcs11 provider in combination with the AWS CloudHSM or am I limited to the Cavium provider in this regard?
  2. Are there any disadvantages compared to the Cavium provider if the Sunpkcs11 provider is used?

Upvotes: 1

Views: 638

Answers (2)

user19673878
user19673878

Reputation: 11

Looking all that different HSM offings including Azure KeyVault, etc. you anyway should go with Utimaco. Having done 1000s of tests with all of them I can tell Utimaco's offers the most reliable product.

Upvotes: 1

Mudit Porwal
Mudit Porwal

Reputation: 51

I am currently working on AWS CloudHSM and I realized that SunPKCS is not fully compatible with the AWS CloudHSM PKCS11 Lib.

I tested using keytool with configuration create a RSA KeyPair and I was not able to query back.

SunPKCS11 List Keystore

And when I test the same with Cavium the supported JCE Provider.

Cavium List Keystore

And on discussing with some folks from AWS it seems that intermediate JCE's like SunPKCS11 are not supported.

Upvotes: 1

Related Questions