Chapter 4. Supported platforms

While the Common Criteria evaluation tested using this Entrust HSM, any HSM is considered equivalent when it is at least FIPS 140-2 validated, provides PKCS#11 3.0 cryptographic services or higher, hardware protection for keys and supports the required algorithms. Some tokens that do not follow the PKCS #11 3.0 semantics will fail. For instance, some tokens do not properly support CKA_ID, which is a requirement for RHCS certificate and key provisioning of the token.

Limited support for Thales Luna: Red Hat was not able to confirm that the Thales HSM unit supports AES key wrapping/unwrapping via OAEP. Please be aware that those features requiring support of this algorithm will not function without such support. These features include:

It is, however, observed that workarounds may be employed for some of these features, but at the cost of degraded security level or operational inconvenience.

Another example is that a certain Safenet Luna model supports PKI private key extraction in its CKE - Key Export model, and only in non-FIPS mode. The Luna Cloning model and the CKE model in FIPS mode do not support PKI private key extraction.