About This Guide | Utimaco Integration Guides

This guide is part of the information and support provided by Utimaco. Additional documentation produced to support your Utimaco u.trust GP HSM or Quantum Protect products can be found in the document directory of the u.trust GP HSM product bundle or Quantum Protect download, respectively. All u.trust GP HSM product documentation is available from Utimaco's website at https://utimaco.com/.

This guide provides an integration explanation, explaining how to integrate a u.trust GP HSM with a Quantum Protect module and OpenSSL.

Target Audience

This guide is intended for administrators of OpenSSL and of Utimaco HSMs.

Purpose of the Integration

The integration of OpenSSL with Quantum Protect is designed to bridge the gap between the growing demand for post-quantum security and the practical needs of Linux-based applications that rely on OpenSSL as their cryptographic backbone.

With version 3.5, OpenSSL introduced support for the Post-Quantum algorithms standardized by NIST. This milestone is significant because OpenSSL is the most widely used cryptographic library in Linux environments, serving as the foundation for countless applications and services. Incorporating post-quantum cryptography (PQC) into OpenSSL allows these applications to adopt next-generation algorithms without requiring extensive redesign or migration efforts.

However, OpenSSL does not natively integrate with Hardware Security Modules (HSMs) or other secure key storage mechanisms. Instead, it relies on external providers, such as the PKCS#11 provider, to enable secure hardware-backed key management. This limitation makes it necessary to combine OpenSSL’s cryptographic capabilities with solutions like Quantum Protect, which extend the u.trust GP HSM to support PQC.

This integration combines the strengths of OpenSSL’s new quantum-ready capabilities with the security of u.trust GP HSM. It enables Linux applications to use post-quantum cryptographic keys seamlessly and securely, ensuring long-term resilience against emerging quantum threats.

Abbreviations

The following abbreviations are used in this guide:

Abbreviation	Meaning
CA	Certificate Authority
CAT	CryptoServer Administration Tool
CD	Compact Disc
CSR	Certificate Signing Request
GUI	Graphical User Interface
HSM	Hardware Security Module
IP	Internet Protocol
LAN	Local Area Network
PCIe	PCI Express Interface
PKCS#11	Public-Key Cryptography Standard #11
RSA	Rivest-Shamir-Adleman
SO	Security Officer
SSL	Secure Socket Layer
TLS	Transport Layer Security
URL	Uniform Resource Locator

List of abbreviations

Document Conventions

The following conventions are used in this guide:

Convention	Use	Example
Bold	Items of the Graphical User Interface (GUI), e.g., menu options	Press the OK button.
`Monospaced`	File names, folder and directory names, commands, file outputs, programming code samples	You will find the file `example.conf` in the `/exmp/demo/` directory.
Italic	References and important terms	See Chapter 3, "Sample Chapter", in the u.trust Anchor - csadm Manual or [CSADM].

Document Conventions

Special icons are used to highlight the most important notes and information.

Here you find important safety information that should be followed.

Here you find additional notes or supplementary information.

This message marks the result expected after the successful execution of an instruction.