Hermann Bauer | Director Business Development, EMEA
Thales Luna Hardware Security Module (HSM) v.7.7.0, our flagship product, is certified in accordance with Common Criteria (CC) at EAL4+ level against the electronic IDentification, Authentication and Trust Services (eIDAS) Protection Profile (PP) EN 419 221-5. Next to the CC certification, Luna HSM 7 has also received eIDAS certification as both a Qualified Signature and Qualified Seal Creation Device (QSCD). Note that the Luna HSM (generation 6 and 7) has already achieved multiple certifications as a standalone QSCD, or as part of a composite QSCD with various remote signing solution vendors, from the conformity assessment bodies (CAB) in Austria, Italy and Spain (in accordance with Article 30.3.b (Alternative Processes)).These certifications provide Thales customers and partners within and outside Europe with the highest levels of assurance and conformity for seamless cross border electronic identification and trust services.
Qualified Trust Service Providers (QTSP)s as well as public or private companies who issue digital certificates and provide local or remote digital signatures and seals (advanced and qualified), timestamp, electronic delivery and website authentication services, can now use Luna HSM 7 as a part of their eIDAS-compliant solution. QTSPs can also issue qualified certificates for customers using on-premises Luna HSM 7 for eIDAS QSCD purposes.
This latest achievement represents the fifth CC EAL4+ certification of the Luna HSM family over four product generations (Luna CA3, Luna 4, Luna 5/6 and now Luna 7). This latest Luna HSM release comes with features useful for high-volume eIDAS operations such as best-in-class performance, per-key authorization (PKA) and scalable key storage (SKS).
Common Criteria Certificate and additional Protection Profiles
The requirement for QSCD certification is highlighted in both the CC and eIDAS regulation.
Thales Trust Service Providers (TSP) customers and technology partners are able to certify their remote signing solutions with CC PP EN 419 241-2 (Protection Profile for QSCD for Server Signing), or in the case of an existing eIDAS certification (Article 30.3.b, Alternative Processes), expand their certification list with the new CC-based one.
The CC PP EN 419 221-5 “Cryptographic Modules for Trust Services” can be used either as a standalone certification or as the basis for the CC certification against the PP EN 419 241-2 certification for remote signing and sealing services. PP EN 419 241-2 mandates that a cryptographic module, such as an HSM, that is intended to be suitable for use by TSPs supporting electronic signature and electronic sealing operations, to be certified to PP EN 419 221-5.
In addition, articles 30 and 31 of the eIDAS regulation dictate that “Conformity of qualified electronic signature creation devices with [EU] requirements […] shall be certified by appropriate public or private bodies designated by Member States”. Luna HSM 7 is published on the eIDAS Article 31 list, promoting its use as a Certified QSCD.
The benefits of using HSMs for eIDAS compliance
Either using a cloud-based or on-premises HSM solution is a great way to meet eIDAS compliance and comes with many benefits, but the HSM has to be certified as a QSCD device, and as mentioned above, is the basis for an eIDAS certified remote signing solution.
In remote working environments there is the need to access digital signature keys whenever and wherever. HSMs are used to manage and protect the private signing keys of signatories, without the signatory being in possession of the key (as is the case when smartcards are used). As such, HSMs facilitate the creation of mutually binding legal documents across all EU/EEA member states.
These keys are maintained in the TSP environment (yet controlled by the HSM), which is certified by an accredited national body. For the secure execution of their operations and services, TSPs deploy and maintain the required HSMs to be used as qualified devices for electronic signature creation. Essentially, these HSMs act as a root of trust.
What you need in an HSM
Electronic signatures, electronic seals, high-volume code signing and other sensitive cryptographic operations require high-throughput performance. Furthermore, the protection of the sensitive key material for its entire lifecycle within the safe confines of an HSM, regardless of the environment, is key. Lastly, a broad partner ecosystem enables organizations to secure many mainstream and specialized applications.
Luna HSMs
In addition to the eIDAS HSM requirements previously mentioned, as eIDAS certified devices, Luna Network and PCIe card HSMs provide the strong performance, high-assurance key protection, and centralized administration/monitoring of crypto operations required for eIDAS compliant electronic signatures, seals and other trust services. As the market leader, Luna HSM is the foundation of trust for enterprise and government organizations worldwide.
For more information, please read about Luna HSM 7 and eIDAS compliance.