MULTI-PARTY CRYPTO SOLUTION

MPCM HSM
The first hardware security module (HSM) with the proven achievements of secure multi-party computation.
PRODUCT BRIEF
CHECK IT OUT

LONG STORY SHORT

about MPCM HSM

MPCM Single Server picture

The Multi-party Crypto Module HSM system can generate signing and encryption RSA key pairs in a truly revolutionary and distributed manner. When configured for the most secure mode, no appliance will ever see a secret key as a whole, as they generate, store and use merely parts of the secret. When configured for using the faster (called the trusted dealer) method, one of the appliances generates the secrets, splits them and securely distributes the parts to the other appliances before securely erasing the generated key.

The signature or decryption functions are executed on all or – if configured that way – on n-out-of-k appliances separately, as the appliances taking part in the process use only the parts of the secrets they store and protect. The result of this unique procedure will always be a standard RSA signing or decrypting operation.

MPCM FEATURES
i2p_logo_white
The Multi-party Crypto Module HSM 
is developed by I2P Ltd.
OUR COMPANY

WANT TO KNOW MORE?

FEATURES

High availability architecture
Due to its distributed architecture, the MPCM meets the most demanding availability and load balance requirements. If deployed in geographically dispersed datacenters it is as disaster tolerant as any IT service can be. If placed close to each other together they achieve the highest speed. Regardless of the chosen architecture, the system provides service as one. Any of the appliances is capable of communicating with the outside world so extremely high availability and load balance can be achieved.

MPCM deploys simply into existing TCP/IP network infrastructures and communicates with other network devices smoothly.

The HSM crypto functionality can be utilized using the industry standard PKCS#11 library, OpenSSL and the proprietary CMAPI interface of the HSM.
CC evaluation underway
MPCM is in the process of Common Criteria EAL 4+ certification (Evaluation Assurance Level EAL 4 augmented by AVA_VAN.5 and ALC_FLR.3 based on ISO/IEC 18045:2008) claiming to meet the requirements of both the Protection Profile for Cryptographic Module for Trust Services (EN 419221-5) and the Protection Profile for QSCD for Server Signing (EN 419241-2) with strict conformance.

After its successful certification due in Q4 of 2018 the MPCM will be a Qualified Signature (and Seal) Creation Device (QSCD) under European Union Regulation 910/2014 on Electronic Identification and Trust Services (eIDAS). Thus, the MPCM enables Trust Providers to offer both Qualified and non-Qualified Remote Electronic Signature and Remote Electronic Seal services in the most secure way a user of trust services of this kind can require.
Multi-factor authentication
MPCM enables both local and remote users to use multi-factor authentication. Besides passwords, the Time-based One-Time Password (TOTP) mechanism according the RFC 6238 can be enabled for any administrators and users. The necessary TOTP codes can be generated using any standard application, such as the Google Authenticator running on a smartphone.
Easy integration
MPCM deploys simply into existing TCP/IP network infrastructures and communicates with other network devices smoothly. The HSM crypto functionality can be utilized using the industry standard PKCS#11 library, JCA/JCE, Microsoft CSP and KSP, OpenSSL and the proprietary CMAPI interface of the HSM. MPCM can also communicate directly with security access modules (eg. MIFARE SAM AV2) to enable quick and secure integration into ticketing ecosystems.
Upload local applications
MPCM’s integrated Tamper Detection Module with multiple sensors that monitor the environment for maximal security even when the appliance is not powered. The sensitivity of the TDM sensors can be configured to fit to the unique operating environment of the appliance. Also, MPCM allows local client applications (LCAs) to be installed into its protected environment. LCAs run in protected containers to ensure that they are isolated from other LCAs and from the HSM core. LCAs are created using the industry standard Linux Container Framework.
eIDAS compatibility
After its successful certification due in Q4 of 2018 the MPCM will be a Qualified Signature (and Seal) Creation Device (QSCD) under European Union Regulation 910/2014 on Electronic Identification and Trust Services (eIDAS). Thus, the MPCM enables Trust Providers to offer both Qualified and non-Qualified Remote Electronic Signature and Remote Electronic Seal services in the most secure way a user of trust services of this kind can require.

TECHNICAL SPECIFICATIONS

API, CERTIFICATION, INTERFACES

Cryptographic APIs

  • PKCS#11, JCA/JCE, CSP/KSP
  • OpenSSL
  • CMAPI (proprietary)

Host Interface

  • Triple gigabit Ethernet port
  • Dual USB port
  • Display port

Certifications

  • CC EAL4+ (due in Q4 2018)
  • eIDAS listing (due in Q1 2019)

Cryptography

  • Multi-party asymmetric: RSA, ECC (due in Q1 2019)
  • Non-distributed asymmetric: RSA, ECC
  • Multi-party symmetric: AES (due in Q1 2019)
  • Non-distributed symmetric (AES, TDES), hash (SHA1, SHA256, SHA384, SHA512), message authentication (HMAC, AES-GMC)
  • Encryption/decryption scheme: PKCS#1 (RSAES-PKCS1- v1_5)
  • Random Number Generation: hybrid deterministic seeded with TRNG Physical Characteristics (per appliance)

Physical

  • Format: Standard 1.5U 19” rack mount chassis
  • Dimensions: 19” x 21” x 2.58” (482.6mm x 533.4mm x 65.7mm)
  • Weight: 19lb (8.5kg)
  • Input Voltage: 24V DC (PSU 100–240V, 50–60Hz)
  • Power Consumption: 120W maximum, 50W typical