vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Because private keys are not stored by the platform, users are responsible for downloading and securing their private key. Therefore, when a higher level of security is required for private keys, an HSM is recommended. An HSM is a hardware appliance that performs cryptographic operations and provides the capability to ensure that the cryptographic keys never leave the HSM. Hyperledger Fabric supports HSM devices that implement the PKCS #11 standard. PKCS #11 is a cryptographic standard for secure operations, generation, and storage of keys. See [Configuring a node to use a Hardware Security Module (HSM)](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-cfg-hsm) to learn more.
* Can I integrate my corporate LDAP server with the Certificate Authority (CA) in the IBM Blockchain Platform?

You cannot currently directly integrate your LDAP server with the CA. However, you can use an external mechanism to generate X.509 certificates for the LDAP users. To use those certificates with a peer or ordering service, see these topics on [Using certs from an external CA for your peer or ordering service](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-adv-deploymentibp-console-adv-deployment-third-party-ca) and [Manually building an organization MSP](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-build-msp).

Also, you cannot configure the blockchain console login authentication to use an LDAP user registry at this time.
* What is the process for rotating certificates on a periodic basis?

Similar to how passwords need to be regularly updated, identity certificates need to be renewed, a process also referred to as "certificate rotation". The platform displays certificate expiration dates for components throughout the console. When a certificate expires, transactions on the network will fail because the identity can no longer be trusted.
Initializing your service instance - Unified Key Orchestrator Plan 

Before you can use IBM Cloud® Hyper Protect Crypto Services to manage encryption keys and perform cryptographic operations, you need to initialize your service instance first.

Service instance initialization is the process of loading the master key, so that you can take the ownership of the cloud

hardware security module (HSM)of Hyper Protect Crypto Services and own the root of trust that encrypts the entire hierarchy of encryption keys.

To initialize your service instance, you need to create

signature keysforcrypto unitadministrators, set quorum authentication thresholds to exit theimprint mode, and load themaster keyto the crypto units.



 Understanding administrators and signature keys 

A crypto unit is composed of an HSM and the corresponding software stack that is dedicated to the HSM. Each crypto unit can manage up to 5000 digital keys. If you're setting up a production environment, it is suggested to assign at least two crypto units for high availability when you create a Hyper Protect Crypto Services instance. The crypto units are located in different availability zones within the region that you select when you create the service instance. All crypto units in a service instance need to be configured the same. If one availability zone cannot be accessed, the crypto units in a service instance can be used interchangeably. Crypto units contain the master key that encrypts the contents of key storage, including root keys and standard keys in the key management keystore and Enterprise PKCS #11 (EP11) keys in the EP11 keystore.

To issue commands for crypto units to perform actions, you need to assign administrators to the crypto units. Each administrator has an associated signature key for identity authentication. The following flow chart shows how the signature keys are created and assigned to a service instance with two crypto units.

Zoom

![Creating and assigning signature keys](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/hs-crypto//images/sigkey-flow.svg)

Figure 2.
* Hyper Protect Crypto Services ([Instructions](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-virtual-private-endpoints-for-vpc))
* Hyper Protect DBaaS for MongoDB ([Instructions](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-virtual-private-endpoint))
* Hyper Protect DBaaS for PostgreSQL ([Instructions](https://cloud.ibm.com/docs/hyper-protect-dbaas-for-postgresql?topic=hyper-protect-dbaas-for-postgresql-virtual-private-endpoint))
* IAM Access Groups ([Endpoint URLs](https://cloud.ibm.com/apidocs/iam-access-groupsendpoint-urls))
* IAM Identity Services ([Endpoint URLs](https://cloud.ibm.com/apidocs/iam-identity-token-apiendpoints))
* IAM Policy Management ([Endpoint URLs](https://cloud.ibm.com/apidocs/iam-policy-managementendpoint-urls))
* Key Protect ([Instructions](https://cloud.ibm.com/docs/key-protect?topic=key-protect-virtual-private-endpoints))
* Network Time Protocol
* Resource Controller ([Endpoint URLs](https://cloud.ibm.com/apidocs/resource-controller/resource-controllerendpoint-url))
* Resource Manager ([Endpoint URLs](https://cloud.ibm.com/apidocs/resource-controller/resource-managerendpoint-urls))
* Schematics ([Instructions](https://cloud.ibm.com/docs/schematics?topic=schematics-private-endpointsendpoint-setup))
Components and concepts - Standard Plan 

Before you can use IBM Cloud® Hyper Protect Crypto Services to manage encryption keys and protect data, learn the basic components and concepts of Hyper Protect Crypto Services.



 Key management service 

Learn concepts that are related to the Hyper Protect Crypto Services [key management feature](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overviewkey-management) to manage encryption keys. The list starts with the most fundamental concepts.



 Root keys 

Root keys, also known as customer root keys (CRKs), are primary resources in Hyper Protect Crypto Services. They are symmetric key-wrapping keys that are used as roots of trust for wrapping (encrypting) and unwrapping (decrypting) other data encryption keys (DEKs) that are stored in a data service. With Hyper Protect Crypto Services, you can create, store, and manage the lifecycle of root keys. Root keys that are created in Hyper Protect Crypto Services are symmetric 256-bit AES keys. Unlike a standard key, a root key can never leave the bounds of the Hyper Protect Crypto Services service. To learn more, see [Introduction to envelope encryption](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-envelope-encryption) and [Manage your keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-startedmanage-keys).





 Standard keys 

Standard keys are another resources in Hyper Protect Crypto Services to directly encrypt and decrypt data. You can manage standard keys by following steps in [Manage your keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-get-startedmanage-keys).





 Data encryption keys 

Data encryption keys (DEKs) are cryptographic keys that you use for data encryption. They are provided by user-owned applications and are used to encrypt data stored in applications. Root keys that you manage in Hyper Protect Crypto Services serve as wrapping keys to protect DEKs.
For example, you can set a policy on the import token that limits the use based on time and usage count.



 How it works 

When you [create an import token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokens) for your service instance, Hyper Protect Crypto Services generates a 4096-bit RSA key-pair from the HSMs. When you [retrieve the import token](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-create-import-tokensretrieve-import-token-api), the service supplies the public key that you can use for encrypting and uploading a key to Hyper Protect Crypto Services.

The following list describes the import token workflow.



1. You send a request to create an import token.



1. Hyper Protect Crypto Services generates an RSA key-pair from the crypto units (HSMs).
2. The public key becomes available for retrieval based on the policy that you specified at creation time.
3. The private key becomes nonextractable and never leaves the crypto unit.



2. You send a request to retrieve the import token.



1. You receive the import token contents, including:



* A public key for the encrypting key material that you want to import into the service.
* A nonce value that is used to verify the key import request.





3. You prepare the key that you want to import to the service.



1. You generate key material by using an on-premises key management mechanism.
2. You encrypt the nonce value with the key material by using an AES-GCM encryption method that is compatible with your environment.
3. You encrypt the key material with the public key by using an RSA encryption method that is compatible with your environment.



4. You send a request to import the key.



1.
[Public-Key Cryptography Standards (PKCS) #11](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html) is an industry standard that defines a platform-independent API, called Cryptoki, for devices such as HSMs that hold cryptographic information and perform cryptographic operations. With Hyper Protect Crypto Services, you can use the standard PKCS #11 API to access the cloud HSM with the PKCS #11 library. The library connects your applications to the cloud HSM to perform cryptographic operations.

With the support of the PKCS #11 API, you don't need to change your existing applications that use the PKCS #11 standard. The PKCS #11 library accepts the PKCS #11 API requests from your applications and remotely accesses the cloud HSM to execute the corresponding cryptographic functions. For more information about the PKCS #11 API, see

[Introducing PKCS #11](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-intro).





 Accessing the cloud HSM with the GREP11 API 

In addition to the PKCS #11 API, you can also use the Enterprise PKCS #11 over gRPC (GREP11) API to access the Hyper Protect Crypto Services cloud HSM.

[Enterprise PKCS #11 (EP11)](https://www.ibm.com/security/cryptocards/pciecc3/ep11) is an IBM-supported cryptographic API that is enabled in the Hyper Protect Crypto Services cloud HSM. EP11 is designed for users that are seeking support for open standards and enhanced security. The [EP11 library](https://www.ibm.com/security/cryptocards/pciecc4/library) offers a wide variety of general-purpose cryptographic functions and provides an interface that is similar to the PKCS #11 API. Existing applications that use PKCS #11 can benefit from enhanced security because the applications can be migrated easily to meet the EP11 requirements.
- mountpath: /usr/sbin/pkcsslotd
name: pkcsslotd
volumeSource:
emptyDir:
medium: Memory
- mountpath: /var/run
name: varrun
volumeSource:
emptyDir:
medium: Memory
- mountpath: /var/lib/opencryptoki
name: tokeninfo
usePVC: true
- mountpath: /etc/opencryptoki
name: opencryptoki-config
volumeSource:
emptyDir:
medium: Memory
- mountpath: /var/lock/opencryptoki
name: lock
volumeSource:
emptyDir:
medium: Memory
- mountpath: /stdll
name: stdll
volumeSource:
emptyDir:
medium: Memory
type: hsm
version: v1
Show more



* In the daemon: section, provide the URL of the HSM daemon image that you created. If the image is not hosted publicly, then you need to create the appropriate pull secret and specify it here as well.
* In the library: section, provide the URL of the HSM client image that you created in [step two](https://cloud.ibm.com/docs/blockchain-sw-252?topic=blockchain-sw-252-ibp-hsm-gemaltoibp-hsm-gemalto-part-four-docker). This is the client that the CA, peer, and ordering node will use to talk to the HSM daemon. The filepath: is the location of the shared object library in the image. If the image is not hosted publicly then the user must create the appropriate pull secret and specify it as well.
* In the envs: section, provide the list of environment variables that are required to configure the HSM.
* [Using the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-add-failoverenable-add-failover-management-utilities)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-enable-add-failoverenable-add-failover-next)







 Deleting service instances 

[Deleting service instances](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instancedelete-instance)



* [Before you begin](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instancedelete-instance-prerequisite)
* [Step 1: Select the crypto units to be deleted](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instanceselect-crypto-unit-step)
* [Step 2: Zeroize crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instancezeroize-crypto-unit-step)
* [Step 3: Optional - Uninstall the Hyper Protect Crypto Services utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instanceuninstall-utilities-step)
* [Step 4: Delete your service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-delete-instancedelete-instance-step)







 Restoring your data from another region 

[Restoring your data from another region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-restore-datarestore-data)
* Use Hyper Protect Crypto Services to provide highly secured key management capability for your encryption keys. To find out more about programmatically managing your keys, check out the [Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).
* To find out more about encrypting your data by using the cloud HSM function of Hyper Protect Crypto Services, check out the

[PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref) and [GREP11 API reference doc](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref).
Tokyo api.jp-tok.hs-crypto.cloud.ibm.com uko.jp-tok.hs-crypto.cloud.ibm.com ep11.jp-tok.hs-crypto.cloud.ibm.com 
 Washington DC api.us-east.hs-crypto.cloud.ibm.com uko.us-east.hs-crypto.cloud.ibm.com ep11.us-east.hs-crypto.cloud.ibm.com 
 São-Paulo api.br-sao.hs-crypto.cloud.ibm.com uko.br-sao.hs-crypto.cloud.ibm.com ep11.br-sao.hs-crypto.cloud.ibm.com 
 Toronto api.ca-tor.hs-crypto.cloud.ibm.com uko.ca-tor.hs-crypto.cloud.ibm.com ep11.ca-tor.hs-crypto.cloud.ibm.com 



For more information about authenticating with Hyper Protect Crypto Services, see the following topics:



* [Setting up the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api)
* [Managing your keys with the Unified Key Orchestrator API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-uko-api)

[Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api)
* [Performing cryptographic operations with the GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-api)
* What can I do with IBM Cloud Hyper Protect Crypto Services?

IBM Cloud Hyper Protect Crypto Services can be used for key management service and cryptographic operations.

Hyper Protect Crypto Services can integrate with IBM Cloud data and storage services as well as VMware® vSphere® and VSAN, for providing data-at-rest encryption. The managed cloud HSM supports industry standards, such as Enterprise Public-Key Cryptography Standards (PKCS) #11. Your applications can integrate cryptographic operations such as digital signing and validation through Enterprise PKCS #11 (EP11 API). The EP11 library provides an interface similar to the industry-standard PKCS #11 application programming interface (API).

Hyper Protect Crypto Services leverages frameworks such as gRPC to enable remote application access. gRPC is a modern open source high-performance remote procedure call (RPC) framework that can connect services in and across data centers for load balancing, tracing, health checking, and authentication. Applications access Hyper Protect Crypto Services by calling EP11 API remotely over gRPC.

For more information, see [Hyper Protect Crypto Services use cases](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-use-cases).
* How do I know whether Hyper Protect Crypto Services is right for my company?

If you are concerned on data security and compliance in the cloud, you are able to maintain complete control over data encryption and signature keys An encryption key that is used by the crypto unit administrator to sign commands that are issued to the crypto unit. in a cloud consumable HSM. The HSM is backed by industry-leading security for cloud data and digital assets. With the security and regulatory compliance support, your data is encrypted and privileged access is controlled. Even IBM Cloud administrators have no access to the keys.

With Hyper Protect Crypto Services, you can ensure regulatory compliance and strengthen data security. Your data is protected with encryption keys in a fully managed, dedicated key management system and cloud HSM service that supports Keep Your Own Key. Keep your own keys for cloud data encryption protected by a dedicated cloud HSM.
* [Step 2: Assign IAM roles to users](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesstep2-assign-iam-roles-uko)
* [ What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-role-best-practicesuko-role-best-practices-next)



[Auditing events for Hyper Protect Crypto Services with Unified Key Orchestrator](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-eventsuko-at-events)



* [Supported events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-eventsuko-at-supported-events)
* [Viewing events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-eventsuko-at-ui)
* [Analyzing successful events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-eventsuko-at-events-analyze)
* [Analyzing failed events](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-eventsuko-at-events-analyze-failed)
* [Event severity](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-uko-at-eventsuko-event-severity)







 Logging and monitoring 

[Managing metrics](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-monitoring-metricsmanage-monitoring-metrics)



* [Managing metrics settings](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-monitoring-metricsmanage-metrics-policy)
* [Wrap a key](https://cloud.ibm.com/apidocs/hs-cryptowrapkey).
* [Unwrap a key](https://cloud.ibm.com/apidocs/hs-cryptounwrapkey).
* [Rewrap a key](https://cloud.ibm.com/apidocs/hs-cryptorewrapkey).
* [Rotate a key](https://cloud.ibm.com/apidocs/hs-cryptorotatekey).
* [Authorize deletion for a key with a dual authorization policy](https://cloud.ibm.com/apidocs/hs-cryptosetkeyfordeletion).
* [Remove an authorization for a key with a dual authorization policy](https://cloud.ibm.com/apidocs/hs-cryptounsetkeyfordeletion).
* [Enable operations for a key](https://cloud.ibm.com/apidocs/hs-cryptoenablekey).
* [Disable operations for a key](https://cloud.ibm.com/apidocs/hs-cryptodisablekey).
* [Restore a key](https://cloud.ibm.com/apidocs/hs-cryptorestorekey).



* Updated: You can now use the following two methods to manage the allowed network policy and the key create and import access policy:



* [Set instance policies](https://cloud.ibm.com/apidocs/hs-cryptoputinstancepolicy).
* [List instance policies](https://cloud.ibm.com/apidocs/hs-cryptogetinstancepolicy).



* Deprecated: [Invoke an action on a key](https://cloud.ibm.com/apidocs/hs-cryptoactiononkey).

This method is originally used for performing actions on a key, such as wrap, unwrap, and rotate. It is now replaced with individual request path for each action.
HSMs of IBM Cloud Hyper Protect Crypto Services are FIPS 140-2 Level 4 certified, which is the highest level of security for cryptographic hardware. At this security level, the physical security mechanisms provide a complete envelope of protection around the cryptographic module with the intent of detecting and responding to all unauthorized attempts at physical access.





 Crypto units 

A crypto unit is a single unit that represents an HSM and the corresponding software stack that is dedicated to the HSM for cryptography. In Hyper Protect Crypto Services, the following types of crypto unit are available:



* Operational crypto unit

When you create a Hyper Protect Crypto Services instance, the number of crypto units that you specify is the number of operational crypto units. For high availability and disaster recovery, you need to set up at least two operational crypto units. These operational crypto units are located in different [availability zones](https://www.ibm.com/cloud/data-centers/) of the same region where your service instance is located. Operational crypto units are used to manage encryption keys and perform cryptographic operations. Each operational crypto unit can manage up to 5000 digital keys.
* Recovery crypto unit

If you create your service instance in Dallas (us-south) or Washington DC (us-east), two recovery crypto units are automatically assigned to your service instance without extra costs; one in the same region and one in the disaster recovery region for that region. A recovery crypto unit is used to generate the random master key, which is then securely exported to operational crypto units and the other recovery crypto unit to [initialize the service instance](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-recovery-crypto-unit).

Recovery crypto units can also be used as backup crypto units that save a copy of the master key value used by the operational crypto units. If the master key is lost or destroyed, you can [recover the master key from a recovery crypto unit](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-recover-master-key-recovery-crypto-unit) by using signed TKE administrative commands.
* [Security readiness](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancesecurity-ready)
* [Compliance readiness](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-security-and-compliancecompliance-ready)



[Components and concepts - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptsunderstand-concepts)



* [Key management service](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptskey-management-concepts)
* [Cloud hardware security module](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-understand-conceptscloud-hsm-concepts)





 About service instance initialization - Standard Plan 

[Initializing your service instance - Standard Plan](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-serviceintroduce-service)



* [Understanding administrators and signature keys](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-serviceunderstand-crypto-unit-admin)
* [Understanding imprint mode and signature thresholds](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-serviceunderstand-imprint-mode)
* [Understanding the master key](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-serviceunderstand-key-ceremony)
* [What's next](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-introduce-serviceintroduce-instance-initialization-next)