Site map

Getting started

Getting started with IBM Cloud Hyper Protect Crypto Services

• Before you begin

• Step 1: Initialize your service instance

• Step 2 (Standard Plan only): Create keys

• Step 2 (Unified Key Orchestrator Plan only): Manage your encryption keys

• Step 3: Encrypt your data with cloud HSM

Understanding Hyper Protect Crypto Services Standard Plan

Overview - Standard Plan

• Why IBM Cloud Hyper Protect Crypto Services?

• How does Hyper Protect Crypto Services work?

• Key features

• What's next

Service architecture - Standard Plan

• Hyper Protect Crypto Services architecture

• Hyper Protect Crypto Services workload isolation

• Service dependencies

Use cases - Standard Plan

• Pervasively protecting data at rest in the cloud

• Using Hyper Protect Crypto Services as a cloud HSM

• What's next

Components and concepts - Standard Plan

• Key management service

• Cloud hardware security module

Understanding Hyper Protect Crypto Services with Unified Key Orchestrator Plan

Overview - Unified Key Orchestrator Plan

• Why IBM Cloud Hyper Protect Crypto Services?

• Why Unified Key Orchestrator?

• Key features

• What's next

Service architecture - Unified Key Orchestrator Plan

• Hyper Protect Crypto Services architecture

• Hyper Protect Crypto Services workload isolation

• Service dependencies

Use cases - Unified Key Orchestrator Plan

• Pervasively protecting data at rest in the cloud

• Using Unified Key Orchestrator for multicloud key orchestration

• Using Hyper Protect Crypto Services as a cloud HSM

• What's next

Components and concepts

• Key management service

• Cloud hardware security module

• Unified Key Orchestrator

Managing regulated workloads with Hyper Protect Crypto Services

Managing regulated workloads with Hyper Protect Crypto Services

• Encrypting your regulated workloads with Hyper Protect Crypto Services

• Regulated workloads use cases

• Getting started to manage your regulated workloads with Hyper Protect Crypto Services

• Reference

Integrating IBM Cloud services with Hyper Protect Crypto Services

Integrating IBM Cloud services with Hyper Protect Crypto Services

• Storage service integrations

• Database service integrations

• Compute service integrations

• Container service integrations

• Ingestion service integrations

• Security service integrations

• Developer tools service integrations

• Understanding your integration

• What's next

Security and compliance

Security and compliance

• Security readiness

• Compliance readiness

Release notes

Release notes

• 18 July 2024

  • Updated: Transition to VPC data centers in Dallas, Washington D.C, and Frankfurt

• 15 July 2024

  • Updated: New API endpoints in Frankfurt

• 2 July 2024

  • Updated: New API endpoints in Madrid

• 19 June 2024

  • Updated: New API endpoints in Tokyo

• 5 June 2024

  • Updated: New API endpoints in London

• 29 May 2024

  • Updated: New API endpoints in Toronto

• 15 May 2024

  • Updated: New API endpoints in São-Paulo

• 8 May 2024

  • Updated: New API endpoints in Dallas

• 12 April 2024

  • Updated: New API endpoints in Washington DC

• 29 February 2024

  • Added: New key state pending destruction

  • Added: Connecting to Azure Key Vault through private endpoint

• 18 January 2024

  • Added: Azure software-protected key support for IBM Cloud

• 09 November 2023

  • Added: Hyper Protect Crypto Services adds support for Bring Your Own HSM (BYOHSM)

• 26 October 2023

  • Deprecated: IBM Cloud Hyper Protect Crypto Services in Sydney

• 22 Sept 2023

  • Added: Hyper Protect Crypto Services expands into the Madrid region

• 3 August 2023

  • Added: Key template support for Unified Key Orchestrator

• 1 June 2023

  • Updated: Pricing plan for Unified Key Orchestrator

• 24 May 2023

  • Updated: Master key rotation support for all regions

• 24 March 2023

  • Added: Master key rotation for Unified Key Orchestrator

  • Added: Master key rotation for EP11 keystores

• 1 Feb 2023

  • Added: Hyper Protect Crypto Services key management functions

  • Added: Activity Tracker event names

• 19 December 2022

  • Added: Managed key rotation support for Unified Key Orchestrator

• 21 November 2022

  • Added: Management Utilities support for Red Hat Enterprise Linux 9.0 and Ubuntu 22.04.1 LTS

• 31 October 2022

  • Added: Google Cloud KMS support

• 20 October 2022

  • Added: EP11 activity tracker events

• 24 June 2022

  • Added: Go SDK and Terraform support for Unified Key Orchestrator

• 8 June 2022

  • Added: Post-quantum cryptography support

• 3 June 2022

  • Added: Hyper Protect Crypto Services Unified Key Orchestrator CLI plug-in

• 1 April 2022

  • Updated: Pricing model of the Hyper Protect Crypto Services standard plan

  • Updated: Process of ordering smart cards and smart card readers

• 25 March 2022

  • Added: Hyper Protect Crypto Services expands into the Toronto region

• 22 March 2022

  • General availability: Using Unified Key Orchestrator to manage and orchestrate keys in a multicloud environment

• 28 February 2022

  • Limited availability: Using Unified Key Orchestrator to manage and orchestrate keys in a multicloud environment

• 23 February 2022

  • Added: Using IBM Cloud Monitoring to measure Hyper Protect Crypto Services metrics

• 15 February 2022

  • Added: Hyper Protect Crypto Services expands into the São-Paulo region

• 21 January 2022

  • Updated: Hyper Protect Crypto Services key management functions

• 30 July 2021

  • Added: Exclusive control on the execution of cryptographic operations

  • Added: Hyper Protect Crypto Services expands into the Tokyo region

  • Added: Using Terraform to initialize the Hyper Protect Crypto Services instance

  • Added: Using a signing service to manage signature keys for instance initialization

• 30 June 2021

  • Added: Authenticated PKCS #11 keystore

  • Added: Enabling cross-region recovery with failover crypto units

  • Added: Hyper Protect Crypto Services expands into the London region

• 30 April 2021

  • Added: Rotating your master key by using smart cards and the Management Utilities

  • Updated: Restore key API and UI

• 31 March 2021

  • Added: Grouping keys by using key rings

  • Added: Initializing the service instance by using recovery crypto units

  • Added: Managing EP11 keystores and keys with the UI

  • Added: Managing key aliases for a key

  • Added: Synchronizing protected resources associated with root keys

  • Added: Using Virtual Private Endpoints for VPC

  • Updated: The cryptography algorithm that is used to generate signature keys

• 28 February 2021

  • Added: Key verification by using the PKCS #11 API

  • Added: Support for the Schnorr algorithm

• 31 January 2021

  • Added: Support for a single-tenant KMIP adapter

• 31 December 2020

  • Added: Managing the key create and import access policy

  • Added: Provisioning and managing service instances with the private-only network

  • Added: ReencryptSingle function in GREP11 API

  • Added: Support for accessing service instances through the Virtual Private Endpoint

  • Added: Support for the SLIP10 mechanism and Edwards-curve algorithm

  • Added: Using Terraform to manage Hyper Protect Crypto Services instances and resources

  • Updated: key management service API

• 30 November 2020

  • Added: Support for the BIP32 mechanism

  • Added: TKE activity tracker events

• 30 September 2020

  • Added: Master key rotation

  • Added: Support for performing cryptographic operations with the standard PKCS #11 API

• 31 August 2020

  • Added: Support for import tokens to securely upload encryption keys

• 31 July 2020

  • Added: Hyper Protect Crypto Services aligns the key management functions with Key Protect

  • Added: Hyper Protect Crypto Services expands into the Washington DC region

• 30 June 2020

  • Added: Support for quorum authentication

• 30 April 2020

  • Added: Hyper Protect Crypto Services adds support for EP11 private endpoints

  • Added: Hyper Protect Crypto Services adds support for the Management Utilities

  • Updated: IBM Cloud service integration

• 31 August 2019

  • Added: Hyper Protect Crypto Services adds support for private endpoints

  • Added: Hyper Protect Crypto Services Cloud HSM now supports EP11 cryptographic operations over gRPC

  • Added: Hyper Protect Crypto Services expands into the Frankfurt region

  • Added: IBM Cloud service integration

• 30 June 2019

  • Added: Hyper Protect Crypto Services expands into Sydney region

• 31 March 2019

  • Hyper Protect Crypto Services is generally available

  • High availability and disaster recovery

  • Scalability

• 28 February 2019

  • Hyper Protect Crypto Services Beta is available

• 31 December 2018

  • Added: Integration of Key Protect API

  • Added: Support for HSM management with Keep Your own Key

  • Deprecated: Function of accessing Hyper Protect Crypto Services through Advanced Cryptography Service Provider

Tutorials on key management service

Creating and importing encryption keys

• Objectives

• Task flow

• Before you begin

• Create an import token

• Retrieve the import token

• Create an encryption key

• Set the encryption key as an environment variable

• Encrypt the nonce with the encryption key

• Encrypt the created encryption key

• Import the encrypted key

• Clean up

• Next steps

Configuring KMIP for key management and distribution in Hyper Protect Crypto Services Standard Plan

• Objectives

• Before you begin

• Task flow

• Grant the service-to-service authorization in IAM

• Configure KMIP for VMWare with Hyper Protect Crypto Services instance

• Configure a trusted connection between the vCenter Server and KMIP adapter

• What's next

Tutorials on cloud hardware security module

Using Hyper Protect Crypto Services PKCS #11 for Oracle Transparent Database Encryption

• Objectives

• Before you begin

• Task flow

• Initialize your Hyper Protect Crypto Services instance

• Set up the Hyper Protect Crypto Services PKCS #11 library in your Oracle Database environment

• Set up Oracle Database TDE and encrypt your data

• Next steps

Using Hyper Protect Crypto Services PKCS #11 for IBM Db2 native encryption

• Objectives

• Before you begin

• Task flow

• Initialize your Hyper Protect Crypto Services instance

• Set up the Hyper Protect Crypto Services PKCS #11 library

• Set up Db2 native encryption

• Next steps

Tutorials on Unified Key Orchestrator

Using Hyper Protect Crypto Services with Unified Key Orchestrator to manage keys in Key Protect on Satellite

• Objectives

• Before you begin

• Task flow

• Deploy Key Protect on Satellite

• Connect Unified Key Orchestrator to Key Protect on Satellite

• Manage Key Protect keys through Unified Key Orchestrator

• Next steps

Tutorials on Bring Your Own HSM

Managing your keys with BYOHSM in IBM Cloud Hyper Protect Crypto Services

• Objectives

• Before you begin

• Task flow

• Purchase and set up your on-premises HSMs

• Configure and deploy your HSMs to work with Hyper Protect Crypto Services

• Contact IBM to get the required information

• Provision a Hyper Protect Crypto Services instance with BYOHSM

• Use your Hyper Protect Crypto Services instance with BYOHSM

• What's next

Provisioning service instances

Provisioning service instances

• Before you begin

• Provisioning an instance of Hyper Protect Crypto Services Standard Plan

• Provisioning an instance of Hyper Protect Crypto Services with Unified Key Orchestrator

• What's next

Initializing service instances

Before you begin

• What's next

Retrieving an access token

Retrieving an access token

• Retrieving an access token with the CLI

• Retrieving an access token with the API

Retrieving your instance ID

Retrieving your instance ID

• Viewing your instance ID with the UI

• Retrieving an instance ID with the CLI

• Retrieving an instance ID with the API

Setting up API calls

Managing your keys with the key management service API

• Retrieving your IBM Cloud credentials

• Forming your key management service API request

• What's next

Setting up Unified Key Orchestrator API calls - Unified Key Orchestrator Plan

• Retrieving your IBM Cloud credentials

• Forming your Unified Key Orchestrator API request

• What's next

Performing cryptographic operations with the PKCS #11 API

• Prerequisites

• Step 1: Set up the PKCS #11 library

• Step 2: (Optional) Verify the integrity and authenticity of the PKCS #11 library

• Step 3: Set up the PKCS #11 configuration file

• Step 4: Use the PKCS #11 library to make PKCS #11 API calls

• What's next

Performing cryptographic operations with the GREP11 API

• Retrieving your IBM Cloud credentials

• Generating a GREP11 API request

• What's next

Enabling the second layer of authentication for EP11 connections - Standard Plan only

• Security and availability best practices for enabling mutual TLS authentication

• Before you begin

• Step 1: Configure the administrator signature key

• Step 2: Set up the client CA certificate for authentication

• Step 3: Establish mutual TLS connections for EP11 applications

• (Optional) Disabling mutual TLS connections

• What's next

Performing key management operations with the CLI - Standard Plan only

Performing key management operations with the CLI - Standard Plan only

• What's next

Setting up Terraform

Setting up Terraform for Hyper Protect Crypto Services Standard Plan

• Example: Provisioning and initializing service instances by using Terraform

• What's next?

Setting up Terraform for Hyper Protect Crypto Services with Unified Key Orchestrator

• Example: Provisioning and initializing service instances by using Terraform

• What's next?

Setting up BYOHSM

Setting up BYOHSM

• Before you begin

• Creating partitions

• Creating keys

• Network connectivity best practice

• Preparing information for HSM connection

• What's next

Managing keys, keystores, and KMIP adapters - Standard Plan

Managing keys and keystores - Unified Key Orchestrator Plan

Managing master keys

Rotating master keys by using smart cards and the Management Utilities

• Before you begin

• Rotating master keys using smart cards and the Management Utilities

• What's next

Rotating master keys by using recovery crypto units

• Rotating master keys

• What's next

Rotating master keys by using key part files

• Before you begin

• Rotating master keys by using key part files

• What's next

Recovering a master key from a recovery crypto unit

• Before you begin

• Recovering master keys

• What's next

Enabling crypto mechanisms

Enabling crypto mechanisms

• Enabling BIP32 deterministic wallets

• Enabling Edwards-curve Digital Signature Algorithm

• Enabling the Schnorr algorithm

• What's next

Adding or removing crypto units

Adding or removing crypto units

• Adding crypto units to an existing service instance

• Removing crypto units from an existing service instance

• What's next

Enabling or adding failover crypto units after you provision a service instance

Enabling or adding failover crypto units after you provision a service instance

• Step 1: Add failover crypto units

• Step 2: Raise a support ticket

• What's next

Deleting service instances

Deleting service instances

• Before you begin

• Step 1: Delete keys

• Step 2: Select the crypto units to be deleted

• Step 3: Zeroize crypto units

• Step 4: Optional - Uninstall the Hyper Protect Crypto Services utilities

• Step 5: Delete your service instance

Restoring your data from another region

Restoring your data from another region

• Restoring your data by using failover crypto units

• Restoring your data by opening an IBM support ticket

• What's next

Enhancing security - Standard Plan

Managing user access

• Roles and permissions

• Managing access to multiple instances

• What's next

Granting access to keys

• Granting access to all keys in an instance

• Granting access to a single key in an instance

• Granting access to key rings in an instance

Enhancing security - Unified Key Orchestrator Plan

Managing user access

• Roles and permissions

• Assigning access to Hyper Protect Crypto Services in the UI

• Assigning access to Hyper Protect Crypto Services in the CLI

• Assigning access to Hyper Protect Crypto Services by using the API

• Assigning access to Hyper Protect Crypto Services by using Terraform

• Managing access to multiple instances

• What's next

Granting access to vaults

• Step 1. Retrieve the vault ID

• Step 2. Grant access to vaults from the UI

• What's next

Setting up custom roles for Unified Key Orchestrator

• Step 1: Create custom IAM roles

• Step 2: Assign IAM roles to users

• What's next

Auditing events for Hyper Protect Crypto Services with Unified Key Orchestrator

• Supported events

• Viewing events

• Analyzing successful events

• Analyzing failed events

• Event severity

Logging and monitoring

Managing metrics

• Managing metrics settings

• What's next

Monitoring operational metrics

• What metrics are available for Hyper Protect Crypto Services?

• Before you begin

• Connecting Monitoring with Hyper Protect Crypto Services

• Hyper Protect Crypto Services Metrics Details

• Latency

• Attributes for Segmentation

• Default Dashboards

• Setting Alerts

API reference

CLI reference

Hyper Protect Crypto Services CLI change log

• IBM Cloud TKE CLI plug-in

• IBM Cloud Hyper Protect Crypto Services certificate manager CLI plug-in

• IBM Cloud Hyper Protect Crypto Services Unified Key Orchestrator CLI plug-in

IBM Cloud Hyper Protect Crypto Services CLI

• Hyper Protect Crypto Services key management CLI plug-in

• Hyper Protect Crypto Services Trusted Key Entry CLI plug-in

• Hyper Protect Crypto Services certificate manager CLI plug-in

• Hyper Protect Crypto Services Unified Key Orchestrator CLI plug-in

Terraform reference

Provisioning and initializing service instances with Terraform

Managing keys with Terraform - Key management service

Managing keys with Terraform - Unified Key Orchestrator

Regions and locations

Regions and locations

• Available regions

• Connectivity options

• Service endpoints

Hyper Protect Crypto Services cloud TKE procedures

Hyper Protect Crypto Services cloud TKE procedures

Security considerations for initializing a service instance

Security considerations for initializing a service instance

• Considerations for storing signature keys and master key parts

• Considerations for defining the Management Utilities security policy

• Considerations for defining the file security policy

Understanding your responsibilities when using IBM Cloud Hyper Protect Crypto Services

Understanding your responsibilities when using IBM Cloud Hyper Protect Crypto Services

• Incident and operations management

• Change management

• Identity and access management

• Security and regulation compliance

• Disaster recovery

High availability and disaster recovery

High availability and disaster recovery

• Locations, tenancy, and availability

• In-region data redundancy and failover

• Cross-region disaster recovery

Open-source licenses

Open-source licenses

• Hyper Protect Crypto Services notices and information

• Hosting appliance notices and information

Resource links

Resource links

• Videos

• blogs

FAQs

General FAQs

• What's IBM Cloud Hyper Protect Crypto Services?

• What is Unified Key Orchestrator?

• What is a key management service?

• What is Hardware Security Module?

• What is a cloud HSM?

• How does Hyper Protect Crypto Services provide a single-tenant cloud service?

• What are the responsibilities of users and IBM Cloud for Hyper Protect Crypto Services?

• How is this service different from IBM Cloud HSM?

• How is Hyper Protect Crypto Services different from Key Protect?

• How is Keep Your Own Key different from Bring Your Own Key?

• What can I do with IBM Cloud Hyper Protect Crypto Services?

• How do I know whether Hyper Protect Crypto Services is right for my company?

• How does Hyper Protect Crypto Services work?

• What crypto card does Hyper Protect Crypto Services use?

• Which IBM regions are Hyper Protect Crypto Services available in?

• I have workloads in a data center where Hyper Protect Crypto Services is not available. Can I still subscribe to this service?

FAQs: Pricing

• How am I charged for my use of Hyper Protect Crypto Services standard plan?

• How am I charged for my use of Hyper Protect Crypto Services with Unified Key Orchestrator?

• Is there a free trial for Hyper Protect Crypto Services?

FAQs: Provisioning and operations

• Are there any prerequisites for using Hyper Protect Crypto Services?

• How to initialize Hyper Protect Crypto Services service instances?

• Can I initialize my service instance through the TKE CLI plug-in by using a proxy?

• Are there any recommendations on how to set up smart cards?

• How can I procure smart cards and smart card readers?

• How many crypto units shall I set up in my service instance?

• Can I use Hyper Protect Crypto Services along with other IBM Cloud services?

• How does my application connect to a Hyper Protect Crypto Services service instance?

• Can I generate master key on-premises and store the master key parts in the smart cards?

• Can I import root keys from an on-premises HSM?

• Can I use Hyper Protect Crypto Services only for cryptographic operations, but use other IBM Cloud services such as Key Protect for key management?

• Can I use Hyper Protect Crypto Services for applications hosted in other cloud service providers such as AWS, Azure, and GCP?

• How can I know whether the IBM Cloud services that I adopt can integrate with Hyper Protect Crypto Services for key encryption?

FAQs: Hyper Protect Crypto Services Standard Plan

• How many keys can be stored in a Standard Plan instance of Hyper Protect Crypto Services?

• How many key rings can be created for a Hyper Protect Crypto Services service instance?

• Can I add or remove crypto units after I provision a service instance?

• Is there a Service Level Agreement (SLA) specifically for Hyper Protect Crypto Services?

FAQs: Hyper Protect Crypto Services with Unified Key Orchestrator

• How many keys can be stored in a Hyper Protect Crypto Services with Unified Key Orchestrator instance?

• What is the difference between key management, key orchestration, and key governance?

• Does Hyper Protect Crypto Services with Unified Key Orchestrator provide key management, governance, and orchestration at the same time?

• Is Unified Key Orchestrator a separate offering?

• How is Hyper Protect Crypto Services with Unified Key Orchestrator different from the Hyper Protect Crypto Services Standard Plan?

• What type of HSM is used for Hyper Protect Crypto Services with Unified Key Orchestrator?

• Which cloud vendors or providers are supported by Hyper Protect Crypto Services with Unified Key Orchestrator as connected external keystores?

• How is Unified Key Orchestrator different from EKMF Web?

• What multizone regions is Hyper Protect Crypto Services with Unified Key Orchestrator available in?

• Can I still use Hyper Protect Crypto Services with Unified Key Orchestrator for key management even if Hyper Protect Crypto Services is not available in the IBM Cloud region that my service resides in?

• How many keystores can be created for an instance of Hyper Protect Crypto Services with Unified Key Orchestrator?

FAQs: Security and compliance

• How can I manage user access to my service instances? Does IBM have access to my instances?

• How does IBM offer a unique and secure process for service initialization (key ceremony)?

• What is a 140-2 FIPS Level 4 Certification and how can I validate it?

• What is the difference between FIPS 140-2 Level 1, 2, 3, and Level 4?

• How to understand the key hierarchy for Hyper Protect Crypto Services KYOK?

• How does EP11 differ from PKCS #11?

• What EP11 mechanisms are supported by the GREP11 functions?

• What compliance standards does Hyper Protect Crypto Services meet?

• Can I monitor my service instance?

FAQs: High availability and disaster recovery

• How do I set up a high availability configuration?

• Can I back up my service instance manually?

• What happens if my service instance fails?

• How can I restore the content from backups?

• What happens if I delete my service instances?

• Can I back up the keys before I delete a service instance?

• What happens when I delete a key?

• What happens if I lose the signature key or the master key parts?

FAQs: Support and maintenance

• How is routine maintenance performed on Hyper Protect Crypto Services?

• How do I get support for Hyper Protect Crypto Services?

• After the service initialization is done, are there any best practices for managing smart cards or key part files?

Troubleshooting key management service

Why am I not authorized to make key management service API request?

Why am I receiving a CKR_IBM_WK_NOT_INITIALIZED error when I use CLI or API?

Why can't I create a standard key after I load another master key?

Why can't I create or import keys?

Why can't I delete an initialized service instance?

Why can't I delete keys?

Why can't I perform any actions by using the UI?

Why can't I rotate root keys?

Why can't I view or list keys?

Why can't I view or list specific keys?

Troubleshooting master key rotation

Why can't I rotate master keys by using key part files?

Why can't I rotate master keys by using recovery crypto units?

Why can't I rotate master keys by using smart cards?

Why do I fail to load the new master key during the master key rotation process?

Troubleshooting smart cards and the Management Utilities

Why am I not authorized when I start the Trusted Key Entry application?

Why am I receiving a blocked PIN on EP11 smart card error?

Why am I receiving a no smart card readers found error when I use the Management Utilities?

Troubleshooting Trusted Key Entry

Why am I not authorized when running TKE CLI plug-in commands?

Why can't I change signature thresholds?

Why can't I list crypto units?

Troubleshooting Unified Key Orchestrator

Why can't I distribute keys to Azure Key Vault?

Why can't I create internal keystores?

Why can't I create vaults?

Why can't I delete vaults?

Why can't I delete internal keystores?

Why do I fail to see the changes to my key in Azure Key Vault?

Getting help and support for Hyper Protect Crypto Services

Getting help and support for Hyper Protect Crypto Services

• Providing support case details