Unbound is thrilled to have passed FIPS 140-2 Levels 1 & 2 certification for Unbound Key Control (UKC). This significant milestone for Unbound gives us strong industry validation of our pioneering virtual HSM and key management platform in today’s digital climate. FIPS 140-2 Level 1 and Level 2 certification is also a practical gain for our present and future clients, as it assures companies that Unbound’s software-pure platform – the only one of its kind— meets NIST’s strict security standard. Unbound is the first and only company to obtain FIPS 140-2 Level 1 and FIPS 140-2 Level 2 certification for a software-pure cryptographic module that spans multiple separate machines and uses secure multiparty computation (MPC) rather than relying on physical security measures to protect keys.
What are NIST and FIPS?
The National Institute of Standards and Technology (NIST) issued the FIPS (Federal Information Processing Standard (FIPS) 140 series to set standards for cryptographic models that include both hardware and software components, and this standard assures the protection of a cryptographic module within a security system that maintains confidentiality and integrity of the information protected by the module. FIPS 140-2 Level 1 and Level 2 certification is used specifically for cryptographic modules by private companies who want their products certified for use in regulated industries, such as financial and health-care sectors or government departments.
What does FIPS certification for UKC mean for you?
Unbound’s Distributed Trust Platform – the underlying technology platform on which UKC is built – leverages secure multi-party computation (MPC) for protecting keys from unauthorized access and use. Traditionally cryptographic keys exist in a single location at least at some point in their lifecycle, making
them a single point of compromise. If a key is stolen or compromised by an attacker, it can be used to decrypt sensitive data, digitally sign malware to disguise it as legitimate software, or gain illegitimate access to corporate systems, to name a few examples. Unbound’s Distributed Trust Platform splits keys into random shares placed in separate machines and uses MPC to perform cryptographic operations using the keys, so keys never exist in complete form throughout their lifecycle – not even when generated or while in use.
At Unbound, securing assets is our top priority, and with FIPS-140 validation organizations can go through their internal validation process to start realizing the benefits of
Unbound Key Control:
- Deploy unified key management across entire decentralized hybrid and multi-cloud and geo-distributed environments.
- Fully control keys in the cloud while maintaining excellent usability, flexibility and elasticity.
- Secure keys across all environments and app delivery models, including VMs and containers.
- Adopt future-ready, crypto-agile key management to address future challenges such as quantum computing and quickly expand to new applications such as blockchain crypto schemes.