Forum Discussion

nigelpentland_2's avatar
nigelpentland_2
Icon for Nimbostratus rankNimbostratus
Oct 06, 2015

Thales integration

I'm trying to understand how F5 uses the Thales HSM. It would appear to me that the F5   (a) generates a key pair without using the HSM, storing locally (b) imports the private key only into the ...
design
security
TMSH
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 08, 2015

An incorrect assumption.

 

The integration allows the BIG-IP to access key functions of the Thales, so key generation is actually happening on the Thales itself, and the "key" in the BIG-IP keystore is simply a pointer to the Thales protected key. Here's more information:

 

https://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-fips-thales-12-0-0/_jcr_content/pdfAttach/download/file.res/BIG-IP_System_and_Thales_HSM__Implementation.pdf