Password Safe Thales Luna Hardware Security Module Integration Guide

This guide describes integrating Password Safe with a Thales Luna Hardware Security Module (HSM) device and Luna Cloud HSM Service.

An HSM appliance is a hardware device that safeguards and manages digital cryptography keys for strong authentication and provides cryptographic processing functionality. A cloud-based HSM service provides cost-effective, on-demand key management services using a graphical user interface. Password Safe can use HSMs to manage encryption keys for stored credentials. The HSM takes over the key management, encryption, and decryption functionality for the stored credentials.

Password Safe communicates with HSMs using a commonly supported API called PKCS#11. HSMs include a PKCS#11 driver with their client software installation. This allows applications to use the device without requiring specific knowledge of the make, model, or configuration of the HSM.

The Password Safe integration with an HSM treats the HSM as an external API that only requires credentials. Advanced configurations and features, such as high-availability implementations, are typically transparent in Password Safe. For example, the client software might allow a group of multiple HSMs to be presented as a single token in a single slot. In this case, Password Safe accesses the group the same way it accesses a single HSM. Configuring the group and synchronizing key data is outside the scope of the Password Safe software and must be performed according to the guidelines for the specific hardware. If necessary, seek assistance from the HSM vendor.

Password Safe HSM Credential Usage

  • Password Safe uses only one set of HSM credentials to encrypt any stored credential at a given time.
  • Password Safe always encrypts new or edited credentials using the latest stored set of HSM credentials.
  • Password Safe supports legacy HSM credentials. Credentials that were encrypted using an older set of HSM credentials are still accessible if the HSM credential used to encrypt them has not been deleted manually.
  • Archived HSM credentials remain in the Password Safe database until they are manually deleted.

Supported Product Configurations

Operating System / Software / Hardware Version
Database Microsoft SQL Server 2019
Password Safe 21.3 and later releases
Luna HSM Luna HSM or Luna Cloud HSM
LunaSA Firmware 7.4.x or later versions
Luna Client 10.x or later versions