Marvell LiquidSecurity: cards for HSM platforms

The LS2-A050 separates 21 partitions, the LS2-A100 separates 32 and the performance upgrade raises the count to 42. The product page states up to 45 partitions and the CMVP report up to 64 logical partitions, so in tenders we name the source with every figure.

The LS2-A050 separates 21 partitions. The LS2-A100 separates 32 partitions. The performance upgrade raises the count to 42. The product page states up to 45 partitions. The CMVP report states up to 64 logical partitions. In tenders we name the source with every figure.

Marvell sells the cards to cloud providers, HSM service providers and device makers that build a finished system from them. We are a partner of the vendor and not a distributor, we clear the procurement path in the project and take on installation, connection and operations.

Marvell sells the cards to cloud providers and HSM service providers. Device makers also buy the cards. These providers build a finished system from them. We are a partner of the vendor and not a distributor. We clear the procurement path in the project. We take on installation, connection and operations.

Marvell names Common Criteria and eIDAS on the product page, and no certificate number is published for either. Documented is FIPS 140-3 Level 3 with the number 4703, and everything else we state separately as a vendor statement.

Marvell names Common Criteria and eIDAS on the product page. No certificate number is published for either of them. Documented is FIPS 140-3 Level 3. Its number is 4703. Everything else we state separately as a vendor statement.

We work with operators of critical infrastructure and regulated industries and run the cards in German data centers on request. As an alternative you use Azure Key Vault, Azure Managed HSM or Azure Cloud HSM, which have worked with LiquidSecurity 2 since 2024.

We work with operators of critical infrastructure and regulated industries. We run the cards in German data centers. As an alternative you use Azure Key Vault or Azure Managed HSM. Azure Cloud HSM is available as well. These services have worked with LiquidSecurity 2 since 2024.

A LiquidSecurity card sits in the server and generates, stores and uses cryptographic keys inside a validated hardware boundary. Applications call signing and decryption through PKCS#11, JCA/JCE, CNG/KSP or OpenSSL, and the key stays on the card. Marvell runs no cloud service of its own and sells the cards to providers that build services and appliances from them. Cryptography and hardware security modules are our core competence. We know how the LiquidSecurity cards are partitioned, how PKCS#11 connects to them and how to read the reports of the CMVP, the program that runs the FIPS validations. We run your project from the first selection to daily operations.

Four questions decide the choice: the number of partitions, the required proof of validation, the interfaces of your applications and the operating model. We clear them in a workshop and record the result with a source for every figure.

Four points decide the choice. First the number of partitions. Second the required proof of validation. Third the interfaces of your applications. Fourth the operating model. We clear that in a workshop. We record the result. For every figure we name the source.

The LS2-A050 separates 21 partitions, the LS2-A100 separates 32 and the upgrade raises the count to 42. The product page states up to 45 partitions and the validation report up to 64 logical partitions, so we record each figure with its source.

The LS2-A050 separates 21 partitions. The LS2-A100 separates 32 partitions. With the upgrade the count reaches 42 partitions. The product page states up to 45 partitions. The validation report states up to 64 logical partitions. We record each figure with its source.

FIPS 140-3 Level 3 is documented for both generations with the numbers 4703 and 4700 and runs until 2029. Marvell names Common Criteria and eIDAS on the product page without a certificate number, so we carry both as a vendor statement.

FIPS 140-3 Level 3 is documented for both generations. The numbers are 4703 and 4700. The entries run until 2029. Marvell names Common Criteria and eIDAS on the product page. A certificate number is missing there. We carry both as a vendor statement.

Your applications speak PKCS#11, JCA/JCE, CNG/KSP or OpenSSL, and the card serves all four paths. We check up front whether your PKI, database or signing service works with the planned firmware and the planned partition.

Your applications use fixed interfaces. These are PKCS#11, JCA/JCE, CNG/KSP or OpenSSL. The card serves all four paths. We check up front whether your PKI, database or signing service fits. Firmware and planned partition count here.

You buy the card inside an appliance, book a service from an HSM provider or use Azure Key Vault, Managed HSM and Cloud HSM. The entire solution runs in German data centers.

You buy the card inside an appliance. You can also book a service from an HSM provider. Or you use Azure Key Vault, Managed HSM or Cloud HSM. The entire solution runs in German data centers.

We deliver the work around the card: choosing the version, cutting the partitions, connecting the applications, the key ceremony and monitoring. One team accompanies you from consulting to operations.

We deliver the work around the card. That covers the version, the partitions and the applications. It also covers the key ceremony and monitoring. One team accompanies you from consulting to operations.

We pick the version by your load, cut the partitions to your tenants, connect PKCS#11 and CNG/KSP to your applications and document the key ceremony in an audit proof form.

We pick the version by your load. We cut the partitions to your tenants. We connect PKCS#11 and CNG/KSP to your applications. We document the key ceremony for auditors.

We record which keys and protocols rest on RSA and ECC, because quantum computers threaten both algorithms. We then plan the use of the LS-SW-PQC license that brings post-quantum algorithms onto the card.

We record your keys and protocols. We look for RSA and ECC in use. Quantum computers threaten both algorithms. We then plan the use of the LS-SW-PQC license. That license brings post-quantum algorithms onto the card.

We set up Azure Key Vault, Managed HSM and Cloud HSM, separate the keys by application and connect the service to your systems in your own data center.

We set up Azure Key Vault, Managed HSM and Cloud HSM. We separate the keys by application. We connect the service to your systems. They sit in your own data center.

Four rules decide the selection and the documentation on Marvell projects. We tell you which statement carries a validation number and which one only appears on the product page.

Four rules decide the selection on Marvell projects. They also decide the documents. We tell you which statement carries a validation number. We also say which statement only appears on the product page.