Overview of the Partner Product
OpenSSL is an open-source tool for using the Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols for Web authentication. It offers cryptographic functions to support SSL/TLS protocols.
It allows users to perform various SSL-related tasks, including generating CSR (Certificate Signing Request) and private keys, and installing SSL certificates. Most Linux distributions come with pre-compiled OpenSSL, but if you are on a Windows system, you can install it manually.
OpenSSL has an abstraction layer called providers, which can delegate cryptographic operations to different pieces of software or hardware.
The pkcs11-provider provides an OpenSSL plugin that tries to fit the PKCS#11 API within the OpenSSL provider API. That is, it provides a gateway between PKCS#11 modules and the OpenSSL provider API.
Overview of u.trust GP HSM and Quantum Protect
The u.trust GP HSM is a next-generation hardware security module developed by Utimaco IS GmbH. It is a multi-tenant, physically protected, and tamper-resistant cryptographic appliance designed to perform high-assurance cryptographic operations and manage cryptographic keys securely. The u.trust GP HSM is built on a modern, container-based design inspired by cloud technology. With support for up to 31 containers and multiple PKCS #11 partitions per cHSM, it ensures seamless application separation and key partitioning, making it an ideal choice for all types of cryptographic applications. It's also upgradeable for specific use cases like blockchain and 5G, and offers flexibility for custom solutions, including proprietary algorithms and customer key derivations via the Software Development Kit.
Quantum Protect (QP) is an extension to the Utimaco u.trust SecurityServer General Purpose Hardware Security Modules (HSMs).
It extends the cryptographic algorithms running inside the HSMs' tamper-proof environment, adding support for different “Post-Quantum” algorithms.
Joint Value Proposition
The integration of OpenSSL 3.5 with the Utimaco u.trust GP HSM and Quantum Protect enables organizations to use post-quantum digital signatures while generating and protecting ML-DSA private keys within the HSM.
Through the PKCS#11 provider, OpenSSL can use HSM-resident keys to create certificate signing requests and certificates, sign messages, and perform certificate authority signing operations. This allows organizations to adopt ML-DSA in supported OpenSSL workflows while keeping sensitive private keys protected by the HSM.
This joint solution combines OpenSSL’s post-quantum cryptographic capabilities with Utimaco’s hardware-based key protection. It gives organizations a practical way to introduce post-quantum signatures into their OpenSSL environments while retaining control of the keys used to create them.