No. When you deploy GaraTrust, cryptographic keys are never exported from the hardware security module (HSM) or key manager. The HSM private keys are generated and stored in a non-exportable state within the cryptographic device.

Clients are restricted to proxied key access, meaning that clients make their cryptographic requests via GaraTrust. GaraTrust then authenticates and authorizes the client according to the policy in place, interfaces with the HSM to perform the cryptographic operation on the client’s behalf, and returns the finalized cryptographic data to the client.

GaraTrust is deployed on customer-managed infrastructure and can run on-premises, in the cloud, or in a hybrid environment. All types of infrastructure are supported.

No. GaraTrust is licensed to customers and deployed on fully customer-managed infrastructure, so the Garantir team never has access to your hardware security module (HSM) private keys or data.

GaraTrust integrates with Thales Luna HSMs, Entrust nShield HSMs, HashiCorp Vault, AWS KMS, AWS CloudHSM, Google Cloud KMS, and Azure Key Vault. New integrations are added frequently so check in with the Garantir team if your HSM or key manager is not listed here.

Although GaraTrust introduces an additional network hop in the architecture, the overall data sent over the network is drastically reduced via techniques like client-side hashing and enveloped encryption.

With client-side hashing, signing clients compute the hash of the data they wish to sign locally, then send the hash over the network to GaraTrust, which finalizes the digital signature authentication by applying the private key in the cryptographic device to the hash. This keeps the data sent over the network to a minimum, regardless of the size of data being signed.

While it is technically possible to have clients interface directly with the HSM, deploying GaraTrust brings several major benefits that would otherwise be difficult to achieve.

First, GaraTrust integrates with all major tools and platforms to ensure fast and easy deployment. Clients are only required to interface with GaraTrust (rather than the HSM), and GaraTrust provides a multitude of native client integrations. Hence, the solution works end-to-end without any custom development work.

Second, because clients interface with GaraTrust, it becomes much easier to enforce granular security controls, like multi-factor authentication, device authentication, privileged access management (PAM), privileged identity management (PIM), approval workflows, notifications, and more, that might not be possible with the HSM alone. GaraTrust supports these granular access controls for a wide range of use cases. Policies can be established and enforced on a per-key or per-user basis with a few clicks from the GaraTrust admin interface.

Third, not all HSMs and key managers allow granular access to different keys. In some cases, if you have access to a slot on the HSM, you have access to all HSM private keys on that slot. With GaraTrust, more granularity is possible.

Strictly speaking, GaraTrust does not enable new use cases for the HSM. Technically, an HSM can be used to secure any cryptographic key. The trouble is using the HSM keys at speed and scale from existing workflows without needing to export them from the HSM. This is where GaraTrust comes in.

Because GaraTrust provides all of the necessary native client integrations and ensures extremely high performance, it becomes practical to use HSM software to secure the keys for new use cases that aren’t typically considered appropriate for the HSM cryptographic hardware. An example will help illustrate this point.

Suppose you begin storing the secure shell (SSH) keys to access sensitive production servers in your HSM security module. How would authorized end-users access those keys when they needed to? Either the HSM keys would need to be exported from the HSM to the authorized end-user’s device, which defeats the purpose of storing them in the HSM to begin with, or the enterprise would need to build custom integrations from the SSH client (e.g. PuTTY, OpenSSH, WinSCP, etc.) to the HSM. The latter is a difficult, time-consuming, and expensive project. It may also introduce vulnerabilities, as a project of this nature is generally not an enterprise’s area of expertise. If the enterprise wants to enforce granular controls like multi-factor authentication (MFA) across a fleet of servers, it would require manually installing privileged access management (PAM) modules on each and every server individually.

GaraTrust provides a plethora of native client integrations, and also ensures high performance, so it becomes feasible to store the cryptographic keys for any use case in the HSM software without needing to build custom HSM integrations or modify existing processes. Because clients authenticate to GaraTrust, customers can enforce granular controls like MFA and device authentication with just a few clicks from a single interface.

All GaraTrust nodes deploy in a high availability cluster. Through a combination of strong redundancy and minimal data sent over the network, GaraTrust provides high assurances for uptime. Customers who desire “break glass” capabilities can configure GaraTrust appropriately at deployment time.

Yes, GaraTrust has a documented threat model. Get in touch with the Garantir team to request a copy.

Yes, GaraTrust provides certificate lifecycle management features, including issuance, revocation, renewal, CSR generation, and more. This capability is available to all customers who deploy GaraTrust for at least one use case.