Difference- HSM protected keys in Vaults (VS) HSM-protected keys in Managed HSM

Question

While creating Azure VMs, we can keep the SSE encryption keys using Customer Managed Keys. We have 2 options when storing these CMK keys in HSM namely ( i know azure keyvault software based also supports CMK, but that is not my question . Mine is related to only HSM)

1. HSM-protected keys in vaults (Premium SKU)
2. HSM-protected keys in Managed HSM
3. Azure Dedicated HSM What is the difference between 1 ,2 and 3.

i thought both option 1 and option 2 are same and related to Azure Key vault Premium SKU. what is difference ?

What is the difference between options (1), (2) and (3)

Answer 1

@MS Techie see above.

Answer 2

Hi MS Techie ,
I noticed that you listed three separate products in your written description from what you listed in your screenshot, so I'll go through the first list first. Here are the differences between the first three that you listed:

1. HSM-protected keys in vaults (Premium SKU) has a compliance of FIPS 140-2 Level 2 (lower security compliance than Managed HSM), and stores the cryptographic keys in vaults. Vaults support software-protected and HSM-protected keys, whereas Managed HSMs only support HSM-protected keys. Vaults are low-cost, easy to deploy, zone-resilient, highly available, and multi-tenant, whereas Managed HSMs are single-tenant, zone-resilient (where available), highly available, and useful for applications that have stringent security requirements.
2. HSM-protected keys in Managed HSM has a compliance of FIPS 140-2 Level 3 (higher security compliance than vaults). Managed HSMs store the cryptographic keys in managed HSMs. Managed HSMs and only support HSM-protected keys. Managed HSMs are single-tenant, zone-resilient (where available), highly available, and useful for applications that have stringent security requirements, whereas vaults are low-cost, easy to deploy, zone-resilient, highly available, and multi-tenant.
3. Azure Dedicated HSM is a product offering that provides cryptographic key storage in Azure. With Azure Dedicated HSM, you manage who in your organization can access your HSMs and the scope and assignment of their roles. It meets the most stringent security and compliance requirements and is essentially an HSM for lease service.

You can read more details about the first two options here. Note that according to FIPS compliance standards, "FIPS 140-2 is a standard which handles cryptographic modules and the ones that organizations use to encrypt data-at-rest and data-in-motion. FIPS 140-2 has 4 levels of security, with level 1 being the least secure, and level 4 being the most secure.

As for your screenshot from the pricing page, I believe that the difference between Hardware Security Module Protected Keys (Premium only) and Advanced Hardware Security Module Protected Keys (Premium only) is only the key type that you are using. Judging by the other pricing pages, this appears to be referring to the difference between Advanced key types and RSA 2048-bit keys, since these have different costs. Based on the table below this seems to be the case:

That said, I shared your screenshot with the product team since I agree that the wording is confusing, and I'll update this post if I'm wrong or missing any details about this. (EDIT: Confirmed that this is the case) It is also free to reach out to the sales/billing team for clarification on the pricing and offerings.

Regarding Managed HSM Pools, these are meant to provide highly available and zone resilient clusters to protect against hardware failure. The term "Managed HSM instance" is synonymous with "Managed HSM pool". Each Managed HSM pool/instance consists of a cluster of multiple HSM partitions. They support only HSM-backed keys and use FIPS 140-2 Level 3 validated HSMs. Let me know if this helps and if I addressed all of your questions.

If the information helped you, please Accept the answer. This will help us as well as others in the community who might be researching similar information.

Answer 3

@MS Techie I know it may be confusing to understand from the pricing page, but if you see the image below you may notice the difference:

In the HSM-protected keys category we have the following: RSA-HSM 2048 bits, RSA-HSM 3072 bits, RSA-HSM 4096 bits and ECC Keys.

The former is considered HSM-protected and the rest are Advanced HSM-protected. In sum up, 3K/4K RSA-HSM keys and ECC keys are considered advanced, where only 2K RSA-HSM key is 'not advanced'.

Above applies to AKV HSM-protected keys (Available only in Premium SKU) and answers #1 & #2 from your image.

The #3 in your image is for Managed HSM where we don't charge per key as Managed HSM does not use transactional payment model such as AKV. For Managed HSM the cost will be $3.20 per hourly usage.

About Azure Dedicated HSM (ADHSM) that's nothing our team (AKV) support, that's a different product and the screenshot from the pricing page you shared has nothing to do with ADHSM, it looks like you might have mixed the products, but the screenshot you shared applies to AKV and Managed HSM as explained above.

Answer 4

Hi All, I want to use AKV managed HSM for snowflake tri-secret secure encryption. Is it possible?