NIST certificate(s) for HSMs used with Key Vault Managed HSM

Question

NIST certificate(s) for HSMs used with Key Vault Managed HSM

Harry, Christopher 20

Per the article here: https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview Managed HSM is using FIPS 140-2 Level 3 HSMs for security. Is it possible to get the NIST certificates for those HSMs? We are in the midst of a project and for audit purposes we need to provide a copy of those certificates stating the hardware is certified for Level 3. Thanks. -Chris

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2024-02-26T22:04:01.11+00:00

@Harry, Christopher
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

2 answers

Your answer

JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2024-02-26T22:04:01.11+00:00

@Harry, Christopher
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Dillon Silzer 57,831 Volunteer Moderator

Hello Chris,

I'd recommend to contact fips@microsoft.com with questions.

Windows FIPS 140 validation

https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/fips-140-validation#contact

If this is helpful please accept answer.

Answer 2

Shweta Mathur 30,301 Microsoft Employee Moderator

Hi @Harry, Christopher , Thanks for reaching out. You can use certificate https://csrc.nist.gov/projects/cryptographic-module-validation-program/Certificate/3718 FIPS 140 Level 3 validated HSMs for safeguarding cryptographic keys for security. Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Harry, Christopher 20 Reputation points

2024-02-19T21:58:53.7266667+00:00

Thank you for the link to the certificate. Do you have any documentation that links the Key Vault Managed HSM to that certificate? The only reference to HSMs in the KV documentation are Marvell Liquid Security, but the certificate linked is for Nitrox. Is the Key Vault Managed HSM currently using Nitrox HSMs? Thanks.
Shweta Mathur 30,301 Reputation points Microsoft Employee Moderator

2024-02-26T10:17:25.43+00:00
Harry, Christopher

Apologies for delay in response.

Marvel acquired Nitrox so both now are the same. Certs are not documented as they may change from time to time. Key Vault service uses a mix of Thales nShield F2 6000+ and Marvell LiquidSecurity HSM cards in the backend for HSM functionality. They are FIPS 140-2 Level 2 or greater validated. The relevant NIST certificates are here (Cryptographic Module Validation Program | CSRC (nist.gov)) and here (Cryptographic Module Validation Program | CSRC (nist.gov))

If an auditor needs the FIPS certificates for AKV, we give them both as either could be on the back end.

if you are using FIPS 140-2 Level 3, then you must use Managed HSM to get that promise.

if you are looking for wants Marvell HSM, then you must use Managed HSM. We make no promises about which HSMs are used as both meet the AKV HSM promises.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator

2024-02-28T17:39:05.1566667+00:00

@Harry, Christopher

I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Share via

NIST certificate(s) for HSMs used with Key Vault Managed HSM

2 answers

Your answer