NetHSM is a secure hardware and software solution for storing cryptographic keys used in web servers' TLS, DNSSEC, PKI, CA, and blockchain applications. The system utilizes an open-source architecture that includes a memory-safe, functional programming language (OCaml) and a formally verified microkernel (Muen) to mitigate common security vulnerabilities such as buffer overflows. It operates on a tailored unikernel (MirageOS) without an ordinary operating system or terminal shell, keeping the overall system size under 50 MB to minimize the attack surface.
The system supports management via a modern REST API, PKCS#11 module, and command-line tools, with client libraries available for multiple programming languages. It provides high-performance cryptographic operations, processing thousands of operations per second with support for AES, ECC, and RSA algorithms. NetHSM offers deployment options as dedicated hardware or as a software container, featuring unlimited scalability through native clustering, IPv6 network support, and system readiness for post-quantum cryptography integration via future software updates.
