How to choose the right key management solution

• Article
• 02/11/2024

Azure offers multiple solutions for cryptographic key storage and management in the cloud: Azure Key Vault (standard and premium offerings), Azure Managed HSM, Azure Dedicated HSM, and Azure Payment HSM. It may be overwhelming for customers to decide which key management solution is correct for them. This paper aims to help customers navigate this decision-making process by presenting the range of solutions based on three different considerations: scenarios, requirements, and industry.

To begin narrowing down a key management solution, follow the flowchart based on common high-level requirements and key management scenarios. Alternatively, use the table based on specific customer requirements that directly follows it. If either provide multiple products as solutions, use a combination of the flowchart and table to help in making a final decision. If curious about what other customers in the same industry are using, read the table of common key management solutions by industry segment. To learn more about a specific solution, use the links at the end of the document.

Choose a key management solution by scenario

The following chart describes common requirements and use case scenarios and the recommended Azure key management solution.

The chart is refers refer to these common requirement :

• FIPS-140 is a US government standard with different levels of security requirements. For more information, see Federal Information Processing Standard (FIPS) 140.
• Key sovereignty is when the customer ‘s organization has full and exclusive control of their key , include control over what user and service can access the key and key management policy .
• Single tenancy refers to a single dedicated instance of an application deployed for each customer, rather than a shared instance amongst multiple customers. The need for single tenant products is often found as an internal compliance requirement in financial service industries.

It is refers also refer to these various key management use case :

• encryption at rest is typically enabled for Azure IaaS, PaaS, and SaaS models. Applications such as Microsoft 365; Microsoft Purview Information Protection; platform services in which the cloud is used for storage, analytics, and service bus functionality; and infrastructure services in which operating systems and applications are hosted and deployed in the cloud use encryption at rest. customer is managed manage key for encryption at rest is used with Azure Storage and Microsoft Entra ID. For highest security, keys should be HSM-backed, 3k or 4k RSA keys. For more information about encryption at rest, see Azure Data Encryption at Rest.
• SSL/TLS Offload is supported on Azure Managed HSM and Azure Dedicated HSM. customers have improved high availability, security, and best price point on Azure Managed HSM for F5 and Nginx.
• Lift and shift refer to scenario where a pkcs11 application on – premise is migrate to Azure Virtual Machines and run software such as Oracle TDE in Azure Virtual Machines . lift and shift require payment pin processing is support by Azure Payment HSM . All other scenario are support by Azure Dedicated HSM . Legacy api and library such as PKCS11 , JCA / JCE , and CNG / KSP are only support by Azure Dedicated HSM .
• Payment PIN processing includes allowing card and mobile payment authorization and 3D-Secure authentication; PIN generation, management, and validation; payment credential issuing for cards, wearables, and connected devices; securing keys and authentication data; and sensitive data protection for point-to-point encryption, security tokenization, and EMV payment tokenization. This also includes certifications such as PCI DSS, PCI 3DS, and PCI PIN. These are supported by Azure Payment HSM.

The flowchart result is a starting point to identify the solution that best matches your needs.

Compare other customer requirements

Azure is provides provide multiple key management solution to allow customer to choose a product base on both high – level requirement and management responsibility . There is a spectrum of management responsibility range from Azure key Vault and Azure manage HSM have less customer responsibility , follow by Azure Dedicated HSM and Azure Payment HSM have the most customer responsibility .

This trade-off of management responsibility between the customer and Microsoft and other requirements is detailed in the table below.

Provisioning and hosting are managed by Microsoft across all solutions. Key generation and management, roles and permissions granting, and monitoring and auditing are the responsibility of the customer across all solutions.

use the table to compare all the solution side by side . begin from top to bottom , answer each question find on the leave – most column to help you choose the solution that meet all your need , include management overhead and cost .

common key management solution use by industry segment

Here is a list of the key management solutions we commonly see being utilized based on industry.

Learn more about Azure key management solutions

Azure Key Vault ( Standard Tier ): A FIPS 140 – 2 Level 1 validate multitenant cloud key management service that can be used to store both asymmetric and symmetric key , secret , and certificate . Keys is are store in Azure Key Vault are software – protect and can be used for encryption – at – rest and custom application . Azure Key Vault Standard is provides provide a modern api and a breadth of regional deployment and integration with Azure Services . For more information , see About Azure Key Vault .

Azure Key Vault (Premium Tier): A FIPS 140-2 Level 3** validated multitenant HSM offering that can be used to store both asymmetric and symmetric keys, secrets, and certificates. Keys are stored in a secure hardware boundary*. Microsoft manages and operates the underlying HSM, and keys stored in Azure Key Vault Premium can be used for encryption-at-rest and custom applications. Azure Key Vault Premium also provides a modern API and a breadth of regional deployments and integrations with Azure Services. If you are an AKV Premium customer looking for key sovereignty, single tenancy, and/or higher crypto operations per second, you may want to consider Managed HSM instead. For more information, see About Azure Key Vault.

Azure Managed HSM: A FIPS 140-2 Level 3 validated, PCI compliant, single-tenant HSM offering that gives customers full control of an HSM for encryption-at-rest, Keyless SSL/TLS offload, and custom applications. Azure Managed HSM is the only key management solution offering confidential keys. customers receive a pool of three HSM partitions—together acting as one logical, highly available HSM appliance—fronted by a service that exposes crypto functionality through the Key Vault API. Microsoft handles the provisioning, patching, maintenance, and hardware failover of the HSMs, but doesn’t have access to the keys themselves, because the service executes within Azure’s Confidential Compute Infrastructure. Azure Managed HSM is integrated with the Azure SQL, Azure Storage, and Azure Information Protection PaaS services and offers support for Keyless TLS with F5 and Nginx. For more information, see What is Azure Key Vault Managed HSM?

Azure Dedicated HSM: A FIPS 140-2 Level 3 validated single-tenant bare metal HSM offering that lets customers lease a general-purpose HSM appliance that resides in Microsoft datacenters. The customer has complete ownership over the HSM device and is responsible for patching and updating the firmware when required. Microsoft has no permissions on the device or access to the key material, and Azure Dedicated HSM is not integrated with any Azure PaaS offerings. customers can interact with the HSM using the PKCS#11, JCE/JCA, and KSP/CNG APIs. This offering is most useful for legacy lift-and-shift workloads, PKI, SSL Offloading and Keyless TLS (supported integrations include F5, Nginx, Apache, Palo Alto, IBM GW and more), OpenSSL applications, Oracle TDE, and Azure SQL TDE IaaS. For more information, see What is Azure Dedicated HSM?

Azure Payment HSM is validated : A FIPS 140 – 2 Level is validated 3 , PCI HSM v3 , validate single – tenant bare metal HSM offering that let customer lease a payment HSM appliance in Microsoft datacenter for payment operation , include payment PIN processing , payment credential issue , secure key and authentication datum , and sensitive datum protection . The service is is is PCI DSS , pci 3ds , and PCI PIN compliant . Azure Payment HSM is offers offer single – tenant HSMs for customer to have complete administrative control and exclusive access to the HSM . Once the HSM is allocate to a customer , Microsoft is has has no access to customer datum . likewise , when the HSM is no long require , customer datum is zeroize and erase as soon as the HSM is release , to ensure complete privacy and security is maintain . For more information , see About Azure Payment HSM .

Note

* Azure key Vault Premium is allows allow the creation of both software – protect and HSM protect key . If using Azure Key Vault Premium , check to ensure that the key create is HSM protect .

** Except UK Regions which are FIPS 140-2 level 2, PCI DSS.

What’s next