Securosys Secrets Engine for OpenBao
The Securosys Secrets Engine for OpenBao enables applications to perform cryptographic operations backed by Primus HSM through the OpenBao API.
How It Works
The secrets engine is deployed as an OpenBao plugin. Applications make API calls to OpenBao. OpenBao authorizes the request, allowing you to re-use existing access control mechanisms for your applications. The secrets engine then forwards the request to the Securosys TSB, which in turn forwards it to Primus HSM. All operations are executed inside the tamper-protected HSM.
Supported Operations
The Securosys Secrets Engine supports the following key management operations:
- List keys
- Read key metadata (attributes)
- Create or modify keys
- Import/export keys
- Delete keys
- Modify SKA policies
- Block/unblock SKA keys
- Get key attestations
The engine supports the following cryptographic operations:
- Encrypt/decrypt
- Sign/verify
- Wrap/unwrap
The cryptographic operations support asynchronous approval flows for SKA keys. The workflow state is managed by the TSB.
Benefits
- HSM-backed keystore: Perform cryptographic operations with HSM-backed keys and manage keys.
- Familiar setup:
Combine the secure, tamper-protected Primus HSM keystore with the familiar OpenBao setup.
- Authorization: Use OpenBao's auth methods and policies to control access from your applications to the secrets engine. Reuse your existing identity and access mechanisms.
- Logging: Reuse your existing OpenBao audit logging to have an audit trail of which application accessed what secret when.
- Compliance: Key material never leaves the FIPS- and CC-certified Primus HSM.
Next Steps
- Follow the installation guide to set up the Securosys Secrets Engine.