Nitrokey NetHSM – sieciowy sprzętowy moduł bezpieczeństwa HSM

Nitrokey NetHSM – Network Hardware Security Module (HSM)

Nitrokey NetHSM is a professional network HSM (Hardware Security Module) designed for securely generating, storing, and using cryptographic keys in corporate, server, and PKI environments.

The device enables the separation of private keys from servers and applications, ensuring keys remain protected even in the event of a system compromise. NetHSM can be used to protect TLS keys, PKI infrastructures, CAs, DNSSEC, and other systems using cryptographic operations.

NetHSM is distinguished by its open-source architecture. The solution's source code is publicly available, enabling independent analysis and auditing and reducing organizations' dependence on proprietary technologies from a single vendor. The system utilizes a unikernel architecture based on MirageOS, and the core components are written in the OCaml language, which ensures type and memory security. NetHSM also uses the formally verified Muen microkernel.

The device's primary communication interface is a REST API. Support for the PKCS#11 standard is also available, allowing NetHSM to be integrated with existing applications and cryptographic systems. The manufacturer confirms integration with Apache, EJBCA, Knot DNS, Nginx, OpenBao, OpenDNSSEC, OpenSSL, and SSH, among others.

Key Applications

Secure storage of cryptographic keys,
Key generation directly within the HSM environment,
PKI (Public Key Infrastructure),
Certificate Authority (CA),
Protection of TLS keys used by web servers,
DNSSEC,
Digital signatures,
Data encryption and decryption,
Blockchain infrastructure using protected cryptographic keys,
Application integration via REST API,
System integration using the PKCS#11 standard,
Building highly available HSM environments by clustering devices.

Security

Cryptographic keys are stored in encrypted form,
Use of a hardware TPM 2.0,
Hardware TRNG random number generator,
Open source architecture enabling independent auditing,
The core system is developed in the memory-safe and type-safe OCaml language,
Unikernel architecture based on MirageOS,
System size under 50 MB to reduce the attack surface,
Formally verified Muen microkernel,
Functional separation of platform drivers, network interface, and application logic,
NetHSM clustering capability for high availability and performance scalability,
Architecture ready for the later addition of post-quantum cryptography algorithms such as ML-KEM and ML-DSA via software updates.

Software Required for Operation

NetHSM is a standalone network device, and the manufacturer does not specify a single, mandatory, proprietary client program required for its use. Management and integration can be achieved in several ways:

nitropy / pynitrokey – a CLI (Command Line Interface) tool recommended by Nitrokey for managing NetHSM,
REST API – the basic NetHSM communication interface; it allows for installation, administration, and execution of operations,
curl – can be used for direct communication with the REST API,
NetHSM PKCS#11 Module – required for application integration via the PKCS#11 standard,
libraries and SDKs available for many programming languages ​​– depending on how the application is integrated with the REST API.

The nitropy tool is available as part of the pynitrokey package. The Nitrokey documentation describes its installation on Linux, macOS, and Windows systems, among others. The manufacturer currently describes nitropy support for Windows as experimental.

Examples of software for which the manufacturer confirms compatibility with NetHSM:
Apache,
EJBCA,
Knot DNS,
Nginx,
OpenBao,
OpenDNSSEC,
OpenSSL,
SSH.

Manufacturer: Nitrokey GmbH
Production: Germany
Nitrokey NetHSM 2
Device type: Network HSM – Hardware Security Module
Cryptographic algorithms: AES-128, AES-192, AES-256, ECC, RSA 1024–8192 bit
Supported ECC curves: NIST P-256, P-384, P-521, Curve25519, Koblitz secp256k1, Brainpool P256r1, P384r1, P512r1
Encryption: AES-CBC
Decryption: AES-CBC, RSA Raw, RSA PKCS#1, RSA OAEP with MD5, SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512
Signatures: RSA PKCS#1, RSA-PSS with MD5/SHA-1/SHA-224/SHA-256/SHA-384/SHA-512, EdDSA, ECDSA, and Schnorr BIP-340,
Capacity: over 1,000,000 keys,
TRNG hardware random number generator: PTG.3 quality according to AIS 20/31,
Secure Element: TPM 2.0,
Processor: 14th Generation Intel Core,
Intel Management Engine: Disabled,
RAM: 32 GB DDR5 5600 MHz,
ECC error-correcting RAM,
Storage: 480 GB NVMe,
Storage protection: Power Loss Data Protection,
Network interface: 2.5 Gb/s Ethernet,
Case size: 19" rackmount,
Case height: 2U,
Width: approx. 43 cm,
Depth: approx. 35 cm,
Height: approx. 9 cm,
Weight: approx. 10 kg,
Power supply: 2 × redundant 550 W power supplies,
Input voltage: 100–240 V,
Typical power consumption at idle: approx. 135 W,
Typical power consumption under load: approx. 145 W,
Startup power consumption: approx. 220 W,
Includes: Secured NetHSM and 2 power cables,
Device shipped in individually sealed packaging.

Performance

NIST P-256: approx. 6800 operations/s,
NIST P-384: approx. 3500 operations/s,
NIST P-521: approx. 4100 operations/s,
RSA-1024: approx. 5700 ops/s,
RSA-2048: approx. 1700 ops/s,
RSA-3072: approx. 700 ops/s,
RSA-4096: approx. 300 ops/s,
Ed25519: approx. 9100 ops/s,
secp256k1: approx. 6900 ops/s,
secp256k1 + Schnorr BIP-340: approx. 5800 ops/s,
Brainpool P256r1: approx. 6600 ops/s,
Brainpool P384r1: approx. 3400 ops/s,
Brainpool P512r1: approx. 1800 ops/s,
AES-256-CBC: approx. 14,300 ops/s,
ECC key generation: approx. 500 keys/s,
RSA-2048 generation: approximately 70 keys/s,
RSA-3072 generation: approximately 20 keys/s,
RSA-4096 generation: approximately 7 keys/s,
Random number generator: approximately 6.77 MB/s.

The measurements provided by Nitrokey include network communication and were performed end-to-end using multiple parallel, persistent connections.