What does the Security World give us?

All current nShield devices share the same key architecture, so appliance, card and service mix in one estate. With nShield as a Service the keys and the Security World stay with you, while Entrust runs the hardware.

What happens to our nShield XC devices?

Sales ended on October 31, 2025, mainstream maintenance runs until December 31, 2027, and the -CC, -NTS, TSOP and Issuance variants are excluded. The successors are nShield 5c and nShield 5s, and we plan the move along your maintenance dates.

Does nShield already compute post-quantum algorithms?

Yes, the 5 series computes ML-DSA natively at levels 44, 65 and 87, ML-KEM at 512, 768 and 1024 and all SLH-DSA sets, while LMS comes through the Post-Quantum Option Pack. The implementations are CAVP validated since firmware 13.8.0, and the CMVP revalidation has been submitted.

Can we have nShield operated in Germany?

Yes, we work with operators of critical infrastructure and regulated industries and run the devices in German data centers. Entrust itself also uses a data center in Germany for nShield as a Service.

Entrust nShield HSM: Models and Certifications

nShield at a glance

A hardware security module creates and stores keys in certified hardware and never releases them in plaintext. At Entrust all current nShield devices share the Security World architecture and the same interfaces PKCS#11, OpenSSL, JCE, CAPI and CNG, nCore and Web Services, so you can mix models in one estate.

Cryptography and hardware security modules are our core competence. We know how a Security World is built, how the XC models are replaced and how CodeSafe runs custom code inside the device, and we run your project from the first selection through the key ceremony into operations.

Family: nShield 5c, 5s, as a Service, Edge, Issuance
Highest validation: FIPS 140-3 Level 3, CMVP 4745
Post-quantum algorithms: ML-DSA, ML-KEM, SLH-DSA, LMS
Operating forms: Appliance, PCIe card, USB device, as a Service

The series in detail

Series 01

nShield 5c

The nShield 5c is the network appliance of the current generation and replaces the nShield Connect XC. It carries FIPS 140-3 Level 3 and Common Criteria EAL4+ per EN 419 221-5 and serves PKI, code signing, databases and mobile networks.

View device illustration

Models

nShield 5c: Models
Base	Three client licenses included, up to 10 possible
Mid	Up to 20 client licenses
High	Up to 1,000 client licenses, 11,680 RSA-2048 operations per second
nShield 5c 10G	Four SFP+ ports

Form factors: 1U network appliance
Operation: Your own data center, Hosting at a service provider

Certifications

FIPS 140-3 Level 3, certificate 4745
The CMVP lists certificate 4745 under nShield 5s
Common Criteria EAL4+ with AVA_VAN.5 and ALC_FLR.2 per EN 419 221-5
Basis for QSCD per EN 419 241-2
Random numbers per BSI AIS 20/31

Features

Firmware 13.8.3 on the High model with 23,890 ECDSA P-256 operations per second
ML-DSA-44 with 3,130 signatures per second
Two power supplies, hot swappable
Separated roles for provider and tenant
Remote management through nShield Remote Administration and KeySafe 5
CodeSafe 5 runs custom code in containers inside the device

Vendor information

Series 02

nShield 5s

The nShield 5s is the PCIe card of the same generation, replaces the nShield Solo XC and delivers 13,614 RSA-2048 operations per second on the High model. The Multi-Tenancy option puts separated Security Worlds on a single card.

Models

nShield 5s: Models
Base	Smallest of the three performance tiers
Mid	Middle performance tier
High	13,614 RSA-2048 and 21,826 ECDSA P-256 operations per second
Multi-Tenancy for nShield 5s	Separated Security Worlds on one card

Form factors: Low profile PCIe 2.0 x4 card
Operation: Application server, Your own data center

Certifications

FIPS 140-3 Level 3, CMVP certificate 4745
Validated on July 31, 2024, valid until July 30, 2029
Common Criteria EAL4+ per EN 419 221-5
eIDAS QSCD

Features

Card with 25 watts of power draw
External smart card reader included
ML-DSA-44 with 2,780 signatures per second
Same post-quantum algorithms as the nShield 5c
Successor of the nShield Solo XC

Vendor information

Series 03

nShield as a Service

With nShield as a Service Entrust runs the devices in its own data centers, among them one in Germany, and you keep the keys and the Security World. You choose between four performance tiers and between self managed and fully managed operations.

Models

nShield as a Service: Models
Basic	400 RSA-2048 signatures per second
Standard	800 RSA-2048 signatures per second
Premium	6,000 RSA-2048 signatures per second
Enterprise	16,000 RSA-2048 signatures per second

Form factors: Hosted service
Operation: Data centers run by Entrust, Disaster recovery in the cloud

Certifications

The US region is certified to PCI DSS

Features

Data centers in Germany, the United Kingdom, the United States and Australia
Operations either self managed or fully managed
CodeSafe is supported
Option for disaster recovery in the cloud
Keys and Security World stay with the customer

Vendor information

Series 04

nShield Edge

The nShield Edge is a portable USB device with a smart card reader for the offline root of a PKI, for development and for your own keys in the cloud. The datasheet dates from 2020 and names neither FIPS 140-3 nor post-quantum algorithms.

Models

nShield Edge: Models
nShield Edge FIPS 140-2 Level 2	Variant at validation level 2
nShield Edge FIPS 140-2 Level 3	Variant at validation level 3
Developer Edition	Edition for development and test

Form factors: USB device
Operation: Workplace, Development environment

Certifications

FIPS 140-2 Level 2
FIPS 140-2 Level 3
No statement on FIPS 140-3

Features

About 2 RSA-2048 operations per second
Smart card reader for administration
For offline root certificate authorities, development and your own keys in the cloud
All figures come from the datasheet of 2020

Vendor information

Series 05

nShield Issuance HSM

The nShield Issuance HSM prepares EMV data and generates keys for issuing cards, and EMV is the standard for chip cards. It works only with Entrust Adaptive Issuance and the Key Manager from version 6.6 and is not a general payment HSM per PCI PTS.

Models

nShield Issuance HSM: Models
nShield HSMi	1U appliance for card issuance
Variant FIPS 140-2 Level 2	Edition at validation level 2
Variant FIPS 140-2 Level 3	Edition at validation level 3

Form factors: 1U appliance
Operation: Your own data center

Certifications

FIPS 140-2 Level 2
FIPS 140-2 Level 3
No payment HSM approval per PCI PTS

Features

Preparation of EMV data for card issuance
Generation of the keys for cards
Usable only with Entrust Adaptive Issuance
Key Manager from version 6.6 required

Vendor information

Series 06

nShield XC

The XC line with nShield Connect XC and Solo XC is no longer sold but stays in mainstream maintenance until the end of 2027. The Connect XC carries FIPS 140-2 Level 2 and 3 as well as Common Criteria EAL4+ and delivers 3,500 or 8,600 RSA-2048 operations per second on the Mid and High tiers.

Models

nShield XC: Models
nShield Connect XC Mid	3,500 RSA-2048 operations per second
nShield Connect XC High	8,600 RSA-2048 operations per second
nShield Solo XC	PCIe card, the successor is the nShield 5s

Form factors: 1U network appliance, PCIe card
Operation: Your own data center, Application server
Lifecycle: End of sale on October 31, 2025, mainstream maintenance until December 31, 2027, the successors are nShield 5c and nShield 5s

Certifications

FIPS 140-2 Level 2 and Level 3
Common Criteria EAL4+

Features

Excluded from the end of sale are the -CC, -NTS, TSOP and Issuance variants
The Connect CLX image is no longer updated after Security World 13.3
The successors are the nShield 5c and the nShield 5s

Vendor information

How you pick the right model

Four points decide the choice at Entrust: the required validation level, the load with the number of tenants, the need for custom code and the operating model. We work through the points with your team and record the decision.

01

Validation level and approvals

nShield 5c and 5s carry FIPS 140-3 Level 3 and Common Criteria EAL4+ per EN 419 221-5 and serve as the basis for QSCD. The nShield Edge and the Issuance HSM stay at FIPS 140-2, which rarely satisfies tenders that demand proof.

02

Load and tenants

The nShield 5c delivers 11,680 RSA-2048 operations per second on the High model, and the nShield 5s card reaches 13,614. As a service the tiers range from 400 to 16,000 signatures per second, and the Multi-Tenancy option delivers separated Security Worlds.

03

Custom code and interfaces

All current devices speak PKCS#11, OpenSSL, JCE, CAPI and CNG, nCore and Web Services. Whoever needs custom logic inside the device uses CodeSafe 5 and runs the code in a container within the security boundary.

04

Operating model

You can run the devices yourself, you can hand operations to us, or you can book nShield as a Service with data centers in Germany. The entire solution runs in German data centers.

Our work around nShield

The Security World needs planning, documentation and care, and integration, monitoring and the move from XC to the 5 series come on top. One team accompanies you from consulting to operations.

HSM consulting and integration
We plan the Security World, set up cards and appliances and connect your applications through PKCS#11, JCE and CNG. We plan the replacement of the XC devices along your maintenance dates.
We plan the Security World. We set up cards and appliances. We connect your applications through PKCS#11, JCE and CNG. We plan the replacement of the XC devices along your maintenance dates.
HSM & Key Management
PQC readiness
We record which applications rest on RSA and ECC, because quantum computers can break both, and we plan the move to ML-DSA and ML-KEM. Firmware 13.8.0 of August 22, 2025 brings these algorithms, and the CMVP revalidation is still running.
We record your applications that use RSA and ECC. Quantum computers can break both algorithms. We plan the move to ML-DSA and ML-KEM. Firmware 13.8.0 of August 22, 2025 brings these algorithms. The CMVP revalidation is still running.
Post-Quantum Cryptography
Cybersecurity
We monitor the devices, separate the roles of provider and tenant, review the Security World cards and report events into your SIEM. The SIEM collects and rates security messages.
We monitor the devices in operation. We separate the roles of provider and tenant. We review the Security World cards. We report events into your SIEM. A SIEM collects and rates security messages.
Cybersecurity

Standards and evidence

Five rules decide the selection and the documentation on Entrust projects. We name the device that carries each rule and state open validations separately.

Requirement / Demands / OTOKO® delivers
Requirement	Demands	OTOKO® delivers
FIPS 140-3	Validated crypto modules with a defined physical protection level	nShield 5s at Level 3 with certificate 4745, valid until July 30, 2029, the nShield 5c cites the same certificate
Common Criteria EN 419 221-5	Certified signing module for trust services	nShield 5c and 5s with EAL4+, AVA_VAN.5 and ALC_FLR.2, certified through NSCIB
eIDAS EN 419 241-2	Qualified signature creation device for remote signing	nShield 5c and 5s as the basis for QSCD per EN 419 241-2
BSI AIS 20/31	Certified random number generator	Random number generator of the nShield 5c per AIS 20/31
PCI DSS	Certified operating environment for card data	nShield as a Service is certified to PCI DSS in the US region

Navigation

Entrust nShield: Security World across all devices

nShield at a glance

The series in detail

nShield 5c

nShield 5s

nShield as a Service

nShield Edge

nShield Issuance HSM

nShield XC

How you pick the right model

Our work around nShield

Standards and evidence

Frequently asked questions about Entrust

Related topics

You would like to learn more about

Entrust

Our clients

Our Partners