All Products
Search
Document Center

Key Management Service:Specifications and performance of dedicated HSM

Last Updated:Apr 30, 2025

This topic describes the interface specifications, encryption algorithms, and performance references for a dedicated Hardware Security Module (HSM).

Thales HSM

A Thales Hardware Security Module (HSM) is a physical device launched by Thales, a global digital security solutions company, designed to protect sensitive data and software applications. By offering robust encryption functions and access control, it ensures data security during storage, processing, and transmission. It is widely used across various industries, including finance, government, healthcare, and manufacturing.

Features

Description

Standards

A Thales HSM complies with PCI DSS and FIPS 140-2 Level 3 standards, and also meets the requirements of domestic cryptographic certification and PCI PIN standards, ensuring the high level of security needed for device and key management.

Local Master Key (LMK)

An LMK is a master key that is generated and stored within the local environment, and used for securing other keys or sensitive information. The Thales HSM allows for the expansion of the LMK quota through licensing. The supported quota ranges from 1 to 20.

Calls Per Second (CPS)

CPS indicates the HSM's maximum capacity for processing commands calls each second. The Thales HSM's CPS quota can be enhanced through a license upgrade. The supported quota ranges from 25 to 10,000.

Note

This performance parameter provides approximate performance data for key block-related commands (such as PIN translation commands) in secure communication scenarios. Different commands may have various maximum calls per second. Some time-consuming commands, such as RSA key generation or message authentication code, hash, encryption, and decryption calculations for large amounts of data, are not covered by the CPS.

TASS Crypto Engine HSM

A TASS Crypto Engine HSM is a secure hardware device featuring robust physical security measures. It delivers cryptographic services at the application layer for business systems through a dedicated key management system and an integrated encryption process flow. The TASS Crypto Engine HSM supports key management, message authentication, data encryption and data decryption, along with signature generation and verification, ensuring the security, effectiveness, integrity, and non-repudiation of data from creation to transmission, reception, and processing.

Beyond FIPS 140-2 Level 3 compliance, the TASS Crypto Engine HSM also supports Chinese cryptographic algorithms, aligning with national cryptography law and providing users with the flexibility to select suitable algorithms for their deployment needs.

Features

Description

Interface specifications

  • GM/T 0018-2012 Cryptographic device application interface specifications.

  • PKCS#11 interface specifications.

  • SunJCE interface specifications.

Encryption algorithms

  • Symmetric encryption algorithms: Supports SM4, DES, 3DES, and AES (with 128-bit and 256-bit keys).

  • Asymmetric encryption algorithms: Supports SM2, RSA (with key lengths from 2,048 bits to 4,096 bits), and ECC (including NIST P256, BRAINPOOLP256, FRP256, and more).

  • Hash algorithms: Supports SM3, SHA1, SHA256, SHA384, and SHA512.

Performance references

Data communication protocol: TCP/IP.

Maximum concurrent connections: 2,048.

For test data of 32 bytes, the performance is as follows:

  • AES128 computing performance: 100,000 queries per second (QPS). Response time: 0.007 seconds.

  • AES256 computing performance: 100,000 QPS. Response time: 0.007 seconds.

  • RSA2048 key generation performance: 40 pairs per second. Response time: 1.003 seconds.

  • RSA2048 public key computing performance: 40,000 QPS. Response time: 0.008 seconds.

  • RSA2048 private key computing performance: 4,000 QPS. Response time: 0.018 seconds.

  • SM3 hashing performance: 100,000 QPS. Response time: 0.007 seconds.

  • SM4 encryption performance: 100,000 QPS. Response time: 0.009 seconds.

  • SM2 key generation performance: 45,000 QPS. Response time: 0.004 seconds.

  • SM2 signing performance: 45,000 QPS. Response time: 0.003 seconds.

  • SM2 signature verification performance: 20,000 QPS. Response time: 0.006 seconds.