vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-is-cloud-hsm)
* [How does Hyper Protect Crypto Services provide a single-tenant cloud service?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-single-tenant)
* [What are the responsibilities of users and IBM Cloud for Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-responsibilities-users-cloud)
* [How is this service different from IBM Cloud HSM?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-differentiators-cloud-hsm)
* [How is Hyper Protect Crypto Services different from Key Protect?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-differentiators-key-protect)
* [How is Keep Your Own Key different from Bring Your Own Key?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-differentiators-KYOK)
* [What can I do with IBM Cloud Hyper Protect Crypto Services?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-what-do-with-hpcs)
* [How do I know whether Hyper Protect Crypto Services is right for my company?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-faq-basicsfaq-choose-hs-crypto)
* [How does Hyper Protect Crypto Services work?]
VMware image protection with KYOK







 Using Hyper Protect Crypto Services as PKCS 11 HSMs 

IBM Cloud Hyper Protect Crypto Services provides the

[PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref). PKCS #11 is defined as one of the Public-Key Cryptography Standards. Cryptographic operations are executed inside the HSMs at the cloud side. This allows for schemes where a cryptographic key is never in the clear outside the HSM, and all corresponding sensitive cryptographic operations are handled inside the HSM boundary as well.



 Application-level encryption using the PKCS 11 API 

Hyper Protect Crypto Services allows application programmers to design and develop applications with a standard PKCS #11 API to request encryption or to sign the application data. It means that you can invoke security without having programmers to become encryption experts. Now you can enable and improve data integrity through digital signing and confidentiality through data encryption. Applications can use the Hyper Protect Crypto Services PKCS #11 library to perform cryptographic operations. This capability helps you to modernize business processes through building applications that have a digital workflow with private data and digital reviews, approvals, and signatures that are secure and trustworthy.

You can use the PKCS #11 API to encrypt applications between clouds. With the support of PKCS #11, you have access to a full range of advanced cryptographic operations, such as signing, signature validation, message authentication codes, and more advanced encryption schemes.

Zoom

![Application encryption by using PKCS #11](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/application-encryption-pkcs11.svg)

Figure 3. Application encryption by using PKCS #11





 Databases encryption by using the PKCS 11 API
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-manage-accessuko-manage-access-next)



[Granting access to vaults](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaultsgrant-access-vaults)



* [Step 1. Retrieve the vault ID](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaultsaccess-vault-retrieve-ID)
* [Step 2. Grant access to vaults from the IBM Cloud UI](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaultsgrant-access-vault-console)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grant-access-vaultsgrant-access-vaults-next)



[Setting up custom roles for Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesuko-role-best-practices)



* [Step 1: Create custom IAM roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesstep1-create-custom-roles-uko)
* [Step 2: Assign IAM roles to users](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesstep2-assign-iam-roles-uko)
* [ What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesuko-role-best-practices-next)
[Global Search Service](https://cloud.ibm.com/docs/account?topic=account-tag) global-search-tagging [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_acc_mgt_resources) 
 [Catalog Management](https://cloud.ibm.com/docs/account?topic=account-filter-account) globalcatalog-collection [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_catalog_management) 
 [Software instances](https://cloud.ibm.com/docs/account?topic=account-sw-instance-details) globalcatalog-instance [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-at_events_acc_mgtat_events_sw_instance) 
 [Context-based restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-whatis) context-based-restrections [Global events](https://cloud.ibm.com/docs/atracker?topic=atracker-auditing-events-for-context-based-restrictions) 







 Security services 

The following table lists security Cloud services that send auditing events:



Table 10. List of security services

 Service CRN service name Events 

 [IBM Cloud® App ID](https://cloud.ibm.com/docs/appid?topic=appid-getting-started) appid [Location-based events](https://cloud.ibm.com/docs/appid?topic=appid-at-events) 
 [IBM Cloud Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-started) hs-crypto [Location-based events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-at-events)
In Hyper Protect Crypto Services, you can [rotate a root key on demand](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys) or [by setting a rotation policy](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-rotation-policy), without needing to keep track of your retired root key material.

Setting a rotation policy for a key
: Hyper Protect Crypto Services helps you simplify rotation for encryption keys by enabling rotation policies for keys that you generate in the service. After you create a root key, you can manage a rotation policy for the key in the IBM Cloud console or with the API. [Choose an automatic rotation interval](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-root-key-rotation-introrotation-frequency) between 1 - 12 months for your key based on your on-going security needs. When it's time to rotate the key based on the rotation interval that you specify, Hyper Protect Crypto Services automatically replaces the key with new key material.

Rotating keys on demand
: As a security admin, you might want to have more control over the frequency of rotation for your keys. If you don't want to set an automatic rotation policy for a key, you can manually create a new key to replace an existing key, and then update your applications so that they reference the new key. To simplify this process, you can use Hyper Protect Crypto Services to rotate the key on demand. In this scenario, Hyper Protect Crypto Services creates and replaces the key on your behalf with each rotation request. The key retains the same metadata and key ID.





 How root key rotation works 

Root key rotation works by securely transitioning key material from an Active to a Deactivated key state. To replace the deactivated or retired key material, new key material moves into the Active state and becomes available for cryptographic operations. For more information about different key states, see [Monitoring the lifecycle of encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-key-states).
* [Added: Using Terraform to manage Hyper Protect Crypto Services instances and resources](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadd-terraform)
* [Updated: key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newupdate-kms-api-december)



* [30 November 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-november2020)



* [Added: Support for the BIP32 mechanism](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadd-bip32-mechanism)
* [Added: TKE activity tracker events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadd-tke-at-events)



* [30 September 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-september2020)



* [Added: Master key rotation](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-master-key-rotation)

[Added: Support for performing cryptographic operations with the standard PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-pkcs11)



* [31 August 2020](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newhs-crypto-august2020)



* [Added: Support for import tokens to securely upload encryption keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newadded-import-tokens)
* [Service dependencies](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-architecture-workload-isolationservice_dependencies)



[Use cases - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-casesuse-cases)



* [Pervasively protecting data at rest in the cloud](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-casesdata-at-rest-encryption)

[Using Hyper Protect Crypto Services as PKCS #11 HSMs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-casespkcs11_hsm)

[Using Hyper Protect Crypto Services as Enterprise PKCS #11 HSMs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-casesep11_hsm)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-casesuse-case-next)



[Security and compliance - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancesecurity-and-compliance)



* [Security readiness](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancesecurity-ready)
* [Compliance readiness](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancecompliance-ready)



[Components and concepts - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsunderstand-concepts)
* The responseData.adminIds field lists the SHA-256 hashes of the signature key files associated with all the administrators that are added to the crypto unit.







 Remove a crypto unit administrator 



* The requestData.adminId field includes the SHA-256 hash of the signature key file that is associated with the administrator to be removed.
* The responseData.adminIds field lists the SHA-256 hashes of the signature key files associated with all the administrators that are added to the crypto unit.







 Set the signature thresholds 



* The requestData.signatureThreshold field includes the [main signature threshold](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-signature-thresholds-concept) that you set on the crypto unit.
* The requestData.revocationSignatureThreshold field includes the [revocation signature threshold](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-signature-thresholds-concept) that you set on the crypto unit.
* The responseData.signatureThreshold field includes the [main signature threshold](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-signature-thresholds-concept) that is successfully set on the crypto unit.
* The responseData.revocationSignatureThreshold field includes the [revocation signature threshold](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-understand-conceptsuko-signature-thresholds-concept) that is successfully set on the crypto unit.







 Load the new master key register 



* The requestData.masterKeyIds field lists the SHA-256 hashes of all the master key parts files that you select to load to the crypto unit.
* The responseData.verificationPattern field includes the SHA-256 hash of the master key that is composed of the selected master key parts and is loaded to the new master key register.
IBM Cloud Hyper Protect Crypto Services docs 

Find useful information about Hyper Protect Crypto Services.

 Developer tools 

[API & SDK reference](https://cloud.ibm.com/docs?tab=api-docs&category=security&subCategory=hs-crypto)[CLI reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-cli-plugin-hpcs-cli-plugin)[Terraform reference](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/hpcs)

 Recommended content 

[Initialize service instances using smart cards and the Management Utilities This approach gives you the highest security, which enables you to store and manage master key parts using smart cards.](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities)[Initialize service instances using recovery crypto units If you create your service instance in Dallas (us-south) or Washington DC (us-east) where the recovery crypto units are enabled, you can choose this approach where the master key is randomly generated within a recovery crypto unit and then exported to other crypto units.](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-recovery-crypto-unit)[Initialize service instances using key part files You can also initialize your service instance using master key parts that are stored in files on your local workstation. You can use this approach regardless of whether or not your service instance includes recovery crypto units. ](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm)

 Video library 

[!
(https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/key-rotation.svg)

Figure 1. Key rotation

With each rotation request, Hyper Protect Crypto Services associates new key material with your root key.

Zoom

![The diagram shows a micro view the root key stack.](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/root-key-stack.svg)

Figure 2. Root key stack

To learn how to use the Hyper Protect Crypto Services key management service API to rotate your root keys, see [Rotating keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rotate-keys).





 Rewrapping data after rotating a root key 

After a root key rotation completes, new root key material becomes available for protecting data encryption keys (DEKs) with [envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption). Retired root key material moves to the Deactivated state, where it can only be used to unwrap and access older DEKs that aren't yet protected by the latest root key.

To secure your envelope encryption workflow, [rewrap your DEKs](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-rewrap-keys) after you rotate a root key so that your at-rest data is protected by the newest root key. Alternatively if Hyper Protect Crypto Services detects that you're using retired root key material to unwrap a DEK, the service automatically reencrypts the DEK and returns a wrapped data encryption key (WDEK) that's based on the latest root key.
* [Compute service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicescompute-integration)
* [Container service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicescontainer-integration)
* [Ingestion service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesIngestion-integrations)
* [Security service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicessecurity-service-integrations)
* [Developer tools service integrations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesdevtools-integrations)
* [Understanding your integration](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesunderstand-integration)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-integrate-servicesintegration-next-steps)







 Release notes 

[Release notes](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-newwhat-new)



* [1 June 2023](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-new1-june-2023)



Updated

: Pricing plan for Unified Key Orchestrator



* [24 May 2023](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-what-new24-may-2023)



Updated

: Master key rotation support for all regions
An algorithmic pattern used to encrypt messages that only the corresponding public key can decrypt. The private key is also used to decrypt messages that were encrypted by the corresponding public key. The private key is kept on the user system and is protected by a password.





 private resource 

An entry that is visible only to account owners and their included accounts. When resources are created, they are private by default. See also [public resource](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx9439040).





 private service 

A service that is visible only to members of a specified IBM Cloud organization.





 processing engine archive (PEAR) 

A .pear archive file that includes an Unstructured Information Management Architecture (UIMA) analysis engine and all of the resources that are required to use it for custom analysis.





 profile 



* A specification of a resource's capacities and capabilities. Different profiles are optimized for different workloads and use cases. A resource's pricing model might depend on its profile.
* In Security and Compliance Center, a grouping of similar controls that can be used to evaluate resource configuration for compliance.A profile can be customized to fit specific use cases by editing the default parameters. See also [rule](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2037526), [scope](https://cloud.ibm.com/docs/overview?topic=overview-glossaryx2037763).







 project 

A collection of artifacts that define and manage resources and Infrastructure as Code deployments.





 promo code 

A code used to apply limited time credits to Pay-As-You-Go and Subscription accounts.





 proxy 

An application programming interface that forwards requests to a user-defined backend resource and relays responses back to the calling application.





 public cloud 

A cloud computing environment in which access to standardized resources, such as infrastructure, multi-tenant hardware, and services, is available to subscribers on a pay-per-use basis.
In the Source service menu, select Cloud Object Storage.
6. In the Source service instance menu, select the service instance to authorize.
7. In the Target service menu, select Hyper Protect Crypto Services.
8. In the Target service instance menu, select the service instance to authorize.
9. Enable the Reader role.
10. Click Authorize.







 Create a bucket 

When your key exists in Hyper Protect Crypto Services and you authorized the service for use with IBM COS, you can now associate the key with a new bucket:



1. Navigate to your instance of Object Storage.
2. Click Create bucket.
3. Select Custom bucket.
4. Enter a bucket name, select the resiliency (only Regional and US Cross Region are currently supported), and choose a location and storage class.
5. In Service integrations, toggle Key management disabled to enable encryption key management and click on Use existing instance.
6. Select the associated service instance and key, and click Associate key.
7. Verify the information is correct.
8. Click Create.



You can choose to use Hyper Protect Crypto Services to manage encryption for a bucket only at the time of creation. It isn't possible to change an existing bucket to use Hyper Protect Crypto Services.

If bucket creation fails with a 400 Bad Request error with the message The Key CRN could not be found, ensure that the CRN is correct and that the service to service authorization policy exists.

In the Buckets listing, the bucket now has a View link under Attributes, indicating that the bucket has a Hyper Protect Crypto Services key enabled. To view the key details (along with other object metadata), click View.

Note that the Etag value returned for objects encrypted using Hyper Protect Crypto Services will be the actual MD5 hash of the original decrypted object.
HSMs of IBM Cloud Hyper Protect Crypto Services are FIPS 140-2 Level 4 certified, which is the highest level of security for cryptographic hardware. At this security level, the physical security mechanisms provide a complete envelope of protection around the cryptographic module with the intent of detecting and responding to all unauthorized attempts at physical access.





 Crypto units 

A crypto unit is a single unit that represents an HSM and the corresponding software stack that is dedicated to the HSM for cryptography. In Hyper Protect Crypto Services, the following types of crypto unit are available:



* Operational crypto unit

When you create a Hyper Protect Crypto Services instance, the number of crypto units that you specify is the number of operational crypto units. For high availability and disaster recovery, you need to set up at least two operational crypto units. These operational crypto units are located in different [availability zones](https://www.ibm.com/cloud/data-centers/) of the same region where your service instance is located. Operational crypto units are used to manage encryption keys and perform cryptographic operations. Each operational crypto unit can manage up to 5000 digital keys.
* Recovery crypto unit

If you create your service instance in Dallas (us-south) or Washington DC (us-east), two recovery crypto units are automatically assigned to your service instance without extra costs; one in the same region and one in the disaster recovery region for that region. A recovery crypto unit is used to generate the random master key which is then securely exported to operational crypto units and the other recovery crypto unit to [initialize the service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-recovery-crypto-unit).

Recovery crypto units can also be used as backup crypto units that save a copy of the master key value used by the operational crypto units. If the master key is lost or destroyed, you can [recover the master key from a recovery crypto unit](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-recover-master-key-recovery-crypto-unit) using signed TKE administrative commands.