Hardware Token or HSM Requirement

Oct 13, 2025 by wbrum.org 19 views

How Compliant is it to Sign with Cloud HSM (Google or Azure) with the New CA/B Forum's Code Signing Rules?

The CA/B Forum's Code Signing rules have undergone significant changes, and it's essential to understand the implications of these updates on code signing practices. One of the key changes is the requirement for a hardware token or a Hardware Security Module (HSM) for code signing. In this article, we'll explore the compliance of using cloud HSMs from Google or Azure with the new CA/B Forum's Code Signing rules.

Understanding the CA/B Forum's Code Signing Rules

The CA/B Forum is a consortium of certificate authorities (CAs) that work together to establish best practices for the issuance and management of digital certificates. The CA/B Forum's Code Signing Baseline Requirements are a set of guidelines that CAs must follow when issuing code signing certificates. The latest version of these requirements, version 1.7.1, introduces significant changes to the code signing process.

Hardware Token or HSM Requirement

One of the key changes in the CA/B Forum's Code Signing Baseline Requirements is the requirement for a hardware token or an HSM for code signing. This means that CAs must ensure that code signing certificates are used with a hardware token or an HSM that meets the specified security requirements.

Cloud HSMs from Google and Azure

In response to the CA/B Forum's Code Signing Baseline Requirements, some CAs have started to offer cloud HSMs as a solution for code signing. Google Cloud and Azure offer cloud HSMs that meet the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements.

Google Cloud HSM

Google Cloud HSM is a cloud-based HSM that provides a secure environment for key management and code signing. Google Cloud HSM meets the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements, including:

Key management: Google Cloud HSM provides a secure key management system that allows for the creation, storage, and management of cryptographic keys.
Access control: Google Cloud HSM provides fine-grained access control, allowing administrators to control who has access to the HSM and what operations they can perform.
Audit logging: Google Cloud HSM provides detailed audit logging, allowing administrators to track all activity on the HSM.

Azure Cloud HSM

Azure Cloud HSM is a cloud-based HSM that provides a secure environment for key management and code signing. Azure Cloud HSM meets the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements, including:

Key management: Azure Cloud HSM provides a secure key management system that allows for the creation, storage, and management of cryptographic keys.
Access control: Azure Cloud HSM provides fine-grained access control, allowing administrators to control who has access to the HSM and what operations they can perform.
Audit logging: Azure Cloud HSM provides detailed audit logging, allowing administrators to track all activity on the HSM.

Comparison with Sectigo's Requirements

Sectigo, a leading CA, has stated that the CA/B Forum's Code Signing Baseline Requirements require a hardware token or an HSM for code signing. However, Sectigo's requirements go beyond the CA/B Forum's requirements, stating that a cloud HSM is not sufficient for code signing.

GlobalSign's Azure Cloud HSM Code Signing Process

GlobalSign, another leading CA, has implemented an Azure Cloud HSM code signing process that meets the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements. GlobalSign's code signing process uses Azure Cloud HSM to securely manage cryptographic keys and perform code signing operations.

In conclusion, the CA/B Forum's Code Signing Baseline Requirements introduce significant changes to the code signing process, including the requirement for a hardware token or an HSM. Cloud HSMs from Google and Azure meet the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements, making them a viable solution for code signing. While Sectigo's requirements go beyond the CA/B Forum's requirements, GlobalSign's Azure Cloud HSM code signing process demonstrates that cloud HSMs can be used for code signing.

Based on our analysis, we recommend that CAs and organizations consider using cloud HSMs from Google or Azure for code signing. Cloud HSMs provide a secure environment for key management and code signing, meeting the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements. Additionally, cloud HSMs offer scalability, flexibility, and cost-effectiveness, making them an attractive solution for organizations with large-scale code signing needs.

The CA/B Forum's Code Signing Baseline Requirements are subject to change, and it's essential to stay up-to-date with the latest developments. We recommend that CAs and organizations monitor the CA/B Forum's website for updates on the Code Signing Baseline Requirements and adjust their code signing practices accordingly.

Q: What is the CA/B Forum's Code Signing Baseline Requirements?
A: The CA/B Forum's Code Signing Baseline Requirements are a set of guidelines that CAs must follow when issuing code signing certificates.
Q: What is a hardware token or HSM?
A: A hardware token or HSM is a secure device that stores and manages cryptographic keys.
Q: Can I use a cloud HSM for code signing?
A: Yes, cloud HSMs from Google and Azure meet the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements, making them a viable solution for code signing.
Frequently Asked Questions (FAQs) on Cloud HSMs and Code Signing ====================================================================

Q: What is the CA/B Forum's Code Signing Baseline Requirements?

A: The CA/B Forum's Code Signing Baseline Requirements are a set of guidelines that CAs must follow when issuing code signing certificates. These requirements are designed to ensure the security and integrity of code signing certificates and the code signing process.

Q: What is a hardware token or HSM?

A: A hardware token or HSM is a secure device that stores and manages cryptographic keys. It provides a secure environment for key management and code signing, and is designed to meet the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements.

Q: Can I use a cloud HSM for code signing?

A: Yes, cloud HSMs from Google and Azure meet the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements, making them a viable solution for code signing. Cloud HSMs provide a secure environment for key management and code signing, and offer scalability, flexibility, and cost-effectiveness.

Q: What are the benefits of using a cloud HSM for code signing?

A: The benefits of using a cloud HSM for code signing include:

Scalability: Cloud HSMs can scale to meet the needs of large-scale code signing operations.
Flexibility: Cloud HSMs can be easily integrated with existing code signing workflows and systems.
Cost-effectiveness: Cloud HSMs can reduce the cost of code signing operations by eliminating the need for on-premises hardware and maintenance.
Security: Cloud HSMs provide a secure environment for key management and code signing, meeting the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements.

Q: How do I choose a cloud HSM for code signing?

A: When choosing a cloud HSM for code signing, consider the following factors:

Security: Ensure that the cloud HSM meets the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements.
Scalability: Choose a cloud HSM that can scale to meet the needs of large-scale code signing operations.
Flexibility: Select a cloud HSM that can be easily integrated with existing code signing workflows and systems.
Cost-effectiveness: Consider the cost of the cloud HSM and the cost of maintenance and support.

Q: What are the differences between Google Cloud HSM and Azure Cloud HSM?

A: Google Cloud HSM and Azure Cloud HSM are both cloud-based HSMs that meet the security requirements specified in the CA/B Forum's Code Signing Baseline Requirements. However, there are some differences between the two services:

Security: Both Google Cloud HSM and Azure Cloud HSM provide a secure environment for key management and code signing.
Scalability: Both Google Cloud HSM and Azure Cloud HSM can scale to meet the needs of large-scale code signing operations.
Flexibility: Both Google Cloud HSM and Azure Cloud HSM can be easily integrated with existing code signing workflows and systems.
Cost-effectiveness: The cost of Google Cloud HSM and Azure Cloud HSM may vary depending on the specific requirements of the code signing operation.

Q: Can I use a cloud HSM for other security use cases?

A: Yes, cloud HSMs can be used for other security use cases beyond code signing, including:

Key management: Cloud HSMs can be used to securely manage cryptographic keys for a variety of security use cases.
Data encryption: Cloud HSMs can be used to securely encrypt data for storage and transmission.
Digital signatures: Cloud HSMs can be used to securely create and verify digital signatures.

Q: What are the future developments in cloud HSMs and code signing?

A: The future developments in cloud HSMs and code signing include:

Improved security: Cloud HSMs will continue to improve security features to meet the evolving needs of code signing and other security use cases.
Increased scalability: Cloud HSMs will continue to scale to meet the needs of large-scale code signing operations.
Greater flexibility: Cloud HSMs will continue to offer greater flexibility and integration with existing code signing workflows and systems.
Cost-effectiveness: Cloud HSMs will continue to offer cost-effectiveness and reduce the cost of code signing operations.