How do we prove to Security Auditors that Microsoft is using "FIPS 140-2 Level 2 validated HSMs" for Azure Key Vault (Premium)

Question

How do we prove to Security Auditors that Microsoft is using "FIPS 140-2 Level 2 validated HSMs" for Azure Key Vault (Premium)

M Kumar 10

Hello Support, Could you please clarify the following:

How do we prove to Security Auditors that Microsoft is actually using "FIPS 140-2 Level 2 validated HSMs" for storing keys in Azure Key Vault (PREMIUM) service? How do we prove that private keys are safe and never leave Key Vault ?
Please provide the manufacturer and model details of the actual HSM modules being used for storing keys in Azure Key Vault (Premium) service.
We are looking for CMVP (Cryptographic Module Validation Program) NIST certificate like the certificate issued for AWS Key Management Service HSM modules (https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4177). Could you provide NIST CMVP certificate details for Azure Key Vault (Premium) service?

Thank you,
Kumar Marisetti

Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-02-26T09:09:38.89+00:00

@M Kumar Thank you for reaching out to us, till the time i get more details on your above ask, you can refer to the below mentioned docs https://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose https://learn.microsoft.com/en-us/azure/key-vault/general/overview#:~:text=Securely%20store%20secrets%20and%20keys For further details, let me check with my team and revert back.
Kumar Marisetti 5 Reputation points

2024-02-26T10:23:30.09+00:00

@Givary-MSFT Thanks for your response. I appreciate you checking with your team and reverting back as soon as possible.
Srinivas Thodupunuri 0 Reputation points

2024-03-11T07:26:33.88+00:00

Hello Support,
I, too, have a similar question, and I am eagerly awaiting the response.
Kumar Marisetti 5 Reputation points

2024-03-12T10:57:27.19+00:00

@Givary-MSFT

We are waiting for your response. Could you please follow-up with your internal team and respond on priority ? Appreciate your quick response. Thanks.

1 answer

Your answer

Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-02-26T09:09:38.89+00:00

@M Kumar Thank you for reaching out to us, till the time i get more details on your above ask, you can refer to the below mentioned docs https://learn.microsoft.com/en-us/azure/security/fundamentals/key-management-choose https://learn.microsoft.com/en-us/azure/key-vault/general/overview#:~:text=Securely%20store%20secrets%20and%20keys For further details, let me check with my team and revert back.
Kumar Marisetti 5 Reputation points

2024-02-26T10:23:30.09+00:00

@Givary-MSFT Thanks for your response. I appreciate you checking with your team and reverting back as soon as possible.
Srinivas Thodupunuri 0 Reputation points

2024-03-11T07:26:33.88+00:00

Hello Support,
I, too, have a similar question, and I am eagerly awaiting the response.
Kumar Marisetti 5 Reputation points

2024-03-12T10:57:27.19+00:00

@Givary-MSFT

We are waiting for your response. Could you please follow-up with your internal team and respond on priority ? Appreciate your quick response. Thanks.

Answer 1

@Kumar Marisetti

How do we prove to Security Auditors that Microsoft is actually using "FIPS 140-2 Level 2 validated HSMs" for storing keys in Azure Key Vault (PREMIUM) service? How do we prove that private keys are safe and never leave Key Vault ?

ANSWER:
If your premium HSM keys have hsmPlatform 1, they are FIPFS 140-2 level 2 compliant, while if they have hsmPlatform 2, the keys will be FIPS 140-2 level 3 compliant following our recent announcement: General availability: Improvements in Azure Key Vault | Azure updates | Microsoft AzureThe way you may prove the above mentioned is because the premium HSM keys in KV are identified with a '-HSM' at the end of their KeyType, which means the key is HSM-protected. For instance, if you look on the portal at the key details, the Key Type should be RSA-HSM or EC-HSM, not RSA or EC because the latter denotes the keys are Software-protected. You may also get info about the KeyType via Azure PowerShell, CLI, API, etc.

Now, the way you prove keys aren’t exportable is because if you try to download the key from the GUI or any other interface, it will let you download the public key only, but you will never have the whole keypair as the private key never leaves the service. The only exception is when you are using: Secure Key Release with Azure Key Vault and Azure Confidential Computing | Microsoft Learn

External audits such as FedRAMP and PCI validate our use of HSMs and their CMVP certificates.

Please provide the manufacturer and model details of the actual HSM modules being used for storing keys in Azure Key Vault (Premium) service. We are looking for CMVP (Cryptographic Module Validation Program) NIST certificate like the certificate issued for AWS Key Management Service HSM modules (https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4177).

Could you provide NIST CMVP certificate details for Azure Key Vault (Premium) service?

ANSWER:
hsmPlatform 1: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/2643 - these are nCipher nShield models.
hsmPlatform 2: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3718 - these are Marvell models.

Kumar Marisetti 5 Reputation points

2024-03-14T07:02:40.8533333+00:00

Thank you.
Kumar Marisetti 5 Reputation points

2024-03-14T07:07:39.3666667+00:00

Hello @Fabian Gonzalez

Thanks for your detailed response. Due to hyperlink duplication the links provided in your response are not working.

Following are the corrected links (removed duplicated hyperlink text) :

hsmPlatform 1: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Certificate/2643 - these are nCipher nShield models.

hsmPlatform 2: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/3718 - these are Marvell models.

Secure Key Release with Azure Key Vault and Azure Confidential Computing | Microsoft Learn: https://learn.microsoft.com/en-us/azure/confidential-computing/concept-skr-attestation

Improvements in Azure Key Vault: https://azure.microsoft.com/en-us/updates/general-availability-improvements-in-azure-key-vault

NIST certificate like the certificate issued for Key Management Service HSM modules: https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4177

-Thank you
Fabian Gonzalez 501 Reputation points Microsoft Employee

2024-03-18T22:33:44.5566667+00:00

Thank you for pointing it out. I have corrected the URLs :)
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2024-04-01T16:29:10.9833333+00:00

@M Kumar Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Share via

How do we prove to Security Auditors that Microsoft is using "FIPS 140-2 Level 2 validated HSMs" for Azure Key Vault (Premium)

1 answer

Your answer