Choose the Architecture

Cascade can integrate with HSMs using either PKCS#11 or KMIP. Securosys supports both of these. Therefore, you need to decide which architecture option you want to use.

Option 1: PKCS#11

PKCS#11 is faster and simpler and simpler to set up if you are starting from scratch. Therefore, this is the recommended option.

PKCS#11 requires that you install and configure the Primus PKCS#11 Provider on the same machine where Cascade is installed. The necessary cascade-hsm-bridge is included in the default Cascade installation.

Continue with the PKCS#11-based installation guide.

Option 2: KMIP

KMIP is an alternative to PKCS#11 and has first-class support in Cascade. However, because Primus HSM does not natively support KMIP, you need to deploy the Securosys KMIP Server as a translation layer from KMIP to JCE.

Deploying the KMIP Server requires deploying the full CyberVault KMS suite: the KMIP Server, the TSB, and the Key Manager UI. This makes the setup more complex and maintenance-intensive than PKCS#11. Therefore, using KMIP with Cascade is only recommended if you anyway want to deploy CyberVault KMS, for example, if you have other applications that also require KMIP.

Continue with the KMIP-based installation guide.