nShield Solo HSMs are low-profile, embedded PCI-Express cards that provide cryptographic services to one or more applications hosted on a single server or appliance. These hardened, tamper-resistant FIPS 140-2 certified PCI-Express cards perform encryption, digital signing and key generation on behalf of an extensive range of commercial and custom-built applications, including certificate authorities, code signing and more.
The nShield Solo series includes the new high-performance nShield Solo XC High, which offers superior asymmetric and symmetric performance and best-in-class elliptic curve cryptography (ECC) transaction rates.
Features
- Highly flexible architecture. All nShield HSMs integrate with the unique Security World architecture from Thales. With this proven technology, you can combine different nShield HSM models to build a unified ecosystem that delivers scalability, seamless failover and load balancing.
- Process more data faster. nShield Solo HSMs support some of the highest cryptographic transaction rates in the industry, making them ideal for enterprise retail, IoT and other environments where throughput is critical. The nShield Solo XC offers our highest transaction performance rates and features host-side virtualization support.
- Protect your proprietary applications and data. nShield Solo HSMs don’t just protect your sensitive keys and data; they also provide a secure environment for running sensitive applications. The CodeSafe option lets you execute code within nShield boundaries, protecting your applications and the data they process.
Specifications
Supported cryptographic algorithms
- Asymmetric algorithms: RSA, Diffie-Hellman, ECMQV, DSA, El-Gamal, KCDSA, ECDSA, ECDH, Edwards (X25519, Ed25519ph)
- Symmetric algorithms: AES, Arcfour, ARIA, Camellia, CAST, MD5 HMAC, RIPEMD160 HMAC, SEED, SHA-1 HMAC, SHA-224 HMAC, SHA-256 HMAC, SHA-384 HMAC, SHA-512 HMAC,Tiger HMAC, 3DES
- Hash/message digest: MD5, SHA-1, SHA-2 (224, 256, 384, 512 bit), HAS-160, RIPEMD160
- Full Suite B implementation with fully licensed ECC, including Brainpool and custom curves
- Elliptic Curve Key Agreement (ECKA) available via Java API and nCore APIs Elliptic Curve Integrated Encryption Scheme (ECIES) available via Java API, PKCS#11 and nCore APIs
Supported platforms
- Windows and Linux operating systems including distributions from RedHat, SUSE and major cloud service providers running as virtual
machines or in containers - Solo XC virtual environments supported including VMware ESX, Microsoft Hyper-V, Linux KVM & Citrix XenServer
Application programming interfaces (APIs)
- PKCS#11,
- OpenSSL,
- Java (JCE),
- Microsoft CAPI and CNG,
- nCore,
- Web Services (requires nShield Web
- Services Option Pack)
Host connectivity
- PCI Express Version 2.0; Solo XC connector: 4 lane
Security compliance
- FIPS 140-2 Level 2 and Level 3 certified
- Solo XC recognized as a Qualified Signature Creation Device
- Solo XC: eIDAS and Common Criteria EAL4 + AVA_VAN.5 and ALC_ FLR.2 certification against EN 419 221-5 Protection Profile, under the Dutch NSCIB scheme
- Solo XC: BSI AIS 20/31 compliant
Safety and environmental standards compliance
• RoHS2, WEEE, REACH
Management and monitoring
- nShield Remote Administration and nShield Monitor
- Secure audit logging
- Syslog diagnostics support and Windows performance monitoring
- SNMP monitoring agent
AVAILABLE MODELS AND PERFORMANCE
nShield Connect models
XC Base
XC Mid
XC High
RSA signing performance (tps) for NIST recommended key lengths
RSA 2048 bit
430
3,500
8,600
RSA 4096 bit
100
850
2,025
ECC prime curve signing performance (tps) for NIST recommended key lengths
256 bit
680
7,515
14,400
Symmetric encryption (KB/sec) 1024 byte plain text
3DES 168bit
685
5,140
5,500
AES 128 bit
825
7,700
11,300
Key generation with ECC activation (keys/sec)
RSA 2048 bit
6.0
6.2
7.3
ECDSA P-192 bit
110
650
1,050
ECDSA P-256 bit
100
630
1,050
ECDSA P-521 bit
65
480
710