4

I am pretty new to HSMs, and I need an HSM that supports a large number of keys (around few hundred thousand at least).

Is there a limit in a number of keys an HSM support? I can't seem to find this information anywhere, I get the performance data (measured in transactions per second which is usually between 1 and 1000 for the 1024 RSA keys).

However, I am unable to find the key storage capacity. What should I search for? Are there any data for certain HSM telling how many keys it supports?

Improve this question
5
  • 1
    Can you specify the kind of HSM you're talking about? USB key type things vs hardware rack-mount network appliances vs cloud HSMs that come with AWS or Azure?
    – Mike Ounsworth
    Dec 13, 2017 at 1:26
  • 1
    I'm looking for medium to high cost rack-mount network HSM
    – user3362334
    Dec 13, 2017 at 3:22
  • I'll ask around at work tomorrow. I'm floored this is not published in the spec sheets! (but if their target market is typically certificate authorities and the like for storing the one root key on, then maybe it's not a metric that customers care about).
    – Mike Ounsworth
    Dec 13, 2017 at 3:26
  • Out of curiosity, what are you doing that you need hundreds of thousands of keys on an HSM? (feel free to not answer)
    – Mike Ounsworth
    Dec 13, 2017 at 3:27
  • 1
    If you're really considering buying a high-end HSM, I'm sure if you discuss your plans with the vendors you're considering, they'll be happy to explain their options for you and the capabilities of each. Six-figure appliances tend to come with loads of sales support.
    – Xander
    Dec 14, 2017 at 20:37

2 Answers 2

Reset to default
3

I talked to our HSM expert in house. His answer was:

Errhmm, that's not what HSMs are designed for.

The use-case that engineers had in mind when designing them is like a root certificate authority key, or high triffic web server TLS key; something where a single key needs to do a large number of signature operations.

HSMs will have a finite number of "slots", and each slot can have a finite number of "objects" (ie keys). On really big HSMs you might get up to 5,000 slots with up to 100 objects each.

Because this is a software limitation, not a hardware one, it would be possible to get one big slot with an unlimited number of keys in it, but you may need to place a custom order with one of the big HSM manufacturers to get customized software.

Improve this answer
0

There has to be a limit as they need to be stored somewhere. However, most HSM spec sheets seem pretty shy about telling you that.

One I did find is the YubiHSM which mentions:

Stores up to 127 rsa2048, 93 rsa3072, 68 rsa4096 or 255 of any elliptic curve type, assuming only one authentication key is present

Other (and more "traditional") vendors apparently don't want to tell you about it but given the cost of those, I would expect you to do a bit more research first.

The buyer's guide mentions 20 RSA key pairs for the low-cost (sub $100) options. Your guess is as good as mine for mid/high tier solutions.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .