About This Guide | Utimaco Integration Guides

This guide describes how to integrate Paraview API Security Gateway with the Utimaco u.trust GP HSM so that:

The private key of the server certificate used by the API Security Gateway’s HTTPS services is generated, stored and used for handshake signing inside the hardware security boundary of the HSM.
The post-quantum signature algorithm ML-DSA-65 (FIPS 204) can be used to address the long-term threat that quantum computing poses to conventional RSA/ECDSA certificate hierarchies.

The guide assumes that the Paraview API Security Gateway is already deployed and running. It covers only what must be done from that point onwards to bring the HSM and its post-quantum capability into service.

Two key-custody paths are available and are selected per certificate:

Path	Where the private key lives	When to use it
Software key (key_source=local)	Generated by the operator, held encrypted by the product, decrypted into gateway memory only	The recommended way to first validate post-quantum HTTPS in a new environment
HSM-managed (key_source=utimaco_hsm)	Generated inside the HSM and never leaves it; signing performed by the HSM through PKCS#11	Production deployments requiring hardware key custody. Note the deployment prerequisite in Known Limitations and Considerations

Key-custody paths

Target Audience

This guide is intended for platform administrators / security officers of the Paraview API Security Gateway and Utimaco HSM administrators. Readers are expected to be familiar with Linux administration, PKI and certificate management, and the basic concepts of PKCS#11.

Purpose of the Integration

The private key never touches disk: On the HSM-managed path the server certificate private key is generated inside the HSM and is never written to disk or to a configuration file in clear text.
Quantum resistance: Certificates are signed with ML-DSA-65 as standardized in FIPS 204 and, combined with TLS 1.3 hybrid key agreement (X25519MLKEM768), make the transport layer postquantum ready.
Centralized management: HSM connection settings and certificates are maintained once in the management console and delivered automatically to every gateway node, so nodes need not be configured individually.

Abbreviations

Abbreviation	Meaning
AES	Advanced Encryption Standard
CKM	Cryptoki Mechanism, a PKCS#11 mechanism identifier
CXI	Utimaco Cryptographic eXtended Interface
GCM	Galois/Counter Mode
HBS	Hash-Based Signature (LMS/XMSS)
HSM	Hardware Security Module
MBK	Master Backup Key
ML-DSA	Module-Lattice-Based Digital Signature Algorithm (FIPS 204, formerly CRYSTALS-Dilithium)
ML-KEM	Module-Lattice-Based Key-Encapsulation Mechanism (FIPS 203, formerly CRYSTALS-Kyber)
PCIe	PCI Express
PIN	Personal Identification Number
PKCS#11	Public-Key Cryptography Standard #11, cryptographic token interface standard
PQC	Post-Quantum Cryptography
PQMI	Utimaco post-quantum mechanism distribution firmware module
SNI	Server Name Indication
SO	Security Officer
VDM	Vendor Defined Mechanism
GUI	Graphical User Interface
TLS	Transport Layer Security
API	Application Programming Interface
HTTPS	Hypertext Transfer Protocol Secure

Abbreviations

Document Conventions

The following conventions are used in this guide:

Convention	Use	Example
Bold	Items of the Graphical User Interface (GUI), e.g., menu options	Click Test Connection
`Monospaced`	Code that is given for explanation or as an example, file paths	Edit `cs_pkcs11_R3.cfg`
Italic	References and important terms	See the Utimaco p11tool2 Manual
<angle brackets>	Placeholder to be replaced with an actual value	<HSM-IP>

Document conventions

We use special icons to highlight the most important notes and information.

Here you will find important safety information that should be followed.

Here you will find additional notes or supplementary information.

This message indicates the expected result after the successful execution of an instruction.