Fundamentals of Hardware Security Modules Mark Yakabuski Product Manager, HSM René Bastien Product Manager, Payment Products Clara Wicke Product Marketing Manager, HSM

Agenda Definition of an HSM Product overview & general applications Market drivers/trends Going to market/ Why we win Product overview (individual) Competitive matrix Payment products Marketing tools and Q2 outlook

What is a Hardware Security Module (HSM)? A device to keep Business critical crypto keys at the highest level of security Accelerate Crypto operations to eliminate bottlenecks Provides a clear audit trail for all key materials, crypto operations We have a wide range of HSM options Varying performance, storage capacity, and Form Factors, authentication models Wide range of SDKs/Toolkits for flexible integration

HSM Technology Breadth of Hardware Security Offerings Luna PCI Luna SA / SP Luna XML Protect Host EFT Performance Protect Server PCM, CA4 SafeNet offers technology for cryptography and secure key management from intellectual property that can be embedded on a chip all the way through scaleable networked appliances – no one else offers this breadth Networked, Scaleable Offline Key Archive Customizable, Economical Payments, EMV/EFT SOA, Web Services Fastest

Market Overview

Typical HSM Applications 2A. Code Signing 1. PKI Certificate Authority 10. Financial Transactions: EFT, Payments Clearing & PIN Mgt 2B. Secure Manu. / Device Issuance 1B. Time Stamp 2C. Smart Card, Passport & License Issuance Financial Networks 5. Certificate Validation HSM’s are the Tire!...Find the cars that need high security Tires! Internet 3. Client Systems with Disc Enc & 2F Auth 4. Authentication & VPN Access Control 9. SSL & XML Webservers Documents Database 8. Gaming consoles 7. Secure EMAIL & Document Rights Mgt / Signing 6. Database Encryption

General Purpose Market Trends ECC Brainpool/E-passport projects ECC interest, Suite B (NSA standard http://en.wikipedia.org/wiki/NSA_Suite_B) Key Management PKI…real growth of 3rd gen PKI apps Combining COTS solutions, and Customized development efforts. Web Services/Service oriented architectures MS CertServ continuing to gain install base PCI-express Paper to digital processing PCI-DSS standard Large HSM deployments Hand/Hand with customized solutions. In account early, help architect Leverage our great SE’s SWIFT/UBS/SIC… The BIG DEALS.

Ideal Customers – how to find them An HSM is nothing without a Host Application (a car). Off the Shelf or Custom? Solution Seekers Are purchasing/have purchased some application from a 3rd party Our HSM has either been recommended or referred as one of a number of supporting HSMs Customers will select an HSM based on 3rd party recommendation Responsiveness & Support global presence and capability level of integration price Developers Are developing their own application for sell, cost or competitive reasons Developers are either internal users or OEMs Customer will select their HSM partner based on: Apps Eng team, SE capabilities technology & toolkits Responsiveness & Support global presence and capability, stability price Integrations team in India Building Integration guides

Examples Solution Seekers Developers …any size organizations – with small to medium sized deployments Always because of a Partner Integration SafeNets most valuable partners Entrust & Verisign Microsoft Card Personalization Payments Apps providers From Contact to Contract ~ 3 months Revenue from the deal is mostly complete at that point but the partnership continues to deliver Developers …large organizations – with large future plans Select SafeNet because of the quality of products/tools, our global presence and our relationship management Examples SWIFT, NCR, Cisco, Cavium, SIC From Contact to Contract ~ 3 to 12 months Revenue follows 3 to 6 months after Contract Revenue is then ongoing based on the nature of the end solution Action: Continue enhanced focus on partners – and developing those relationships Action: Focus on enhancing toolkit & product offerings, material and positioning - and training Sales & responsiveness

Roadmap

2008 HSM Value Add Easy setup/management Enterprise Grade Features Early 2008 Luna Sx Luna SA maturity Luna XML Brainpool support (PSG, SA) DOCK II (I know…finally!) Mid 2008 PCI Express support on Luna platform Luna XML v2 Luna Sx v2 Late 2008, early 2009 Luna “PKI Bundle” Luna SA maturity continued Remote PED PCI Express support on PS platform Easy setup/management Enterprise Grade Features Easy deployment, First XML HSM in Market ePassports Initiative PCI Express Support

Luna SA Result: A mature Enterprise Grade Appliance Robust Feature Set The required certifications SA 4.2(Nov 2007): NTLS redesign (connection limit increase, 800) Over 4000 ops/sec CNG support Enhanced SNMP Fuller Platform support (including Solaris X86 support) Luna SA 4.3(march 31/08) Brain pool Support HP Itanium OS support Luna SA 4.4(Q4/08) HA Overhaul Remote PED PKI Bundle

Remote PED Administration (part of Luna SA 4.4 release, Q4/08) Will offer full PED functionality at Remote Admin work station. Centralized control No PED required at Data Centers Will require new Remote PED built at manufacturing (not field upgradeable). Can be used as either remote/local PED. Will not be compatible with 2U units. 010110111010111011 New Orange PED key for Remote Admin

PKI Bundle (part of Luna SA 4.4 release, Q4/08) Why? Customer/Partners have asked for it; Verisign, Entrust, Arcot, Microsoft, RSA…. Allows us to leverage existing technology Luna SA/Luna tokens Create competitive differentiator What is it? Luna SA, up to 20 partitions for Signing/key management. Internal SA card reader is used to house PCM tokens. Tokens are accessible via same client API as the Luna SA. Each token is a member of the available slot list exposed by the SA/CA4/KE total. Benefit: Key Gen/Offline Root/Online Root capable from 1 unit Cost savings to customer Product IT Will not be compatible with 2U units.

SafeNet Luna XML…world’s first! Rapid-to-deploy high-assurance HSM for XML environments Revolutionizing application and transactional security with the world’s easiest to integrate and deploy hardware security module Why? Business applications move to Service Oriented / XML based architecture. Nature of XML is designed to allow for B2B, B2G, B2C inline communication/processing = Security Need! Benefits? Clientless OS independent Customers don’t need to be crypto API gurus(P11/JCA/CAPI) FIPS validated HSM 140-2 Level 3 Scalable, Reduces IT costs and Time to deploy. Built for Service Oriented Architectures Meets Compliance Needs

Rapid Deployment with Luna XML Traditional HSM SafeNet Luna XML OS dependency OS independent! Customer Application Customer XML Application Custom built XML service Custom Java layer JCA/JCE API Cryptoki Layer XML Crypto Service From months … … to days! Jan | Feb | Mar | Apr | Jun | … ? Mon | Tue | Wed | Thu | Fri !

Luna XML Operational Use Platform independent XML Based Application SSL SSL SSL XML XML SSL SSL XML SSL Easy to Scale! Load balancer Available across multiple sites for DR XML crypto service XML crypto service XML crypto service Crypto object synchronization

Sample XML Call What is XML? (Extensible Markup Language) XMLSign Signs XML Document <xmlSign Profile="urn:oasis:names:tc:dss:1.0:profile:dss_interop" RequestID="id"> <OptionalInputs> <KeySelector> <KeyInfo/> </KeySelector> <IncludeObject WhichDocument="12345" ObjectID="54321"/> </OptionalInputs> <InputDocuments> <Document ID="12345" RefURI="uri"> <EscapedXML>escaped XML</EscapedXML> <InlineXML>Some XML</InlineXML> <Base64XML>base64 encoded xml </Base64XML> <Base64Data>base64 data</Base64Data> </Document> </InputDocuments> <AuthToken/> </xmlSign> What is XML? (Extensible Markup Language) Like HTML in structure Data centric, not concerned with display Leveraged via WSDL (Web Service def’n language)…like our PKCS#11 API. SOAP (Simple object access protocol), used to encapsulate msg objects. SOAP msg’s defined in pairs (request/response)

Luna XML Replacement for Luna SA? No it is not… New customers, new opportunities Paper to digital PCI DSS B2B, B2G Existing customers, new opportunities New deployments

XML Value Added Questions Reduce risk, $ cost of compromise Are you deploying SOA/XML today, or in the future? What if your services were compromised? Are these services client or partner based? Would you like to differentiate from your competitors? Would you like decrease your HSM deployment and management costs Would you like a quick/easy way to add Enterprise grade security to your service offerings? Help Architect. Know the customer = larger deals There are 1000’s of companies deploying Web Services…FIPS/CC HSM differentiates No more platform Dependence, Upgrades Luna XML!

Luna SX (Start-up Xpress) Why? Difficult setup So is Competitors Gives us another competitive advantage. What is Sx? GUI management Built in partnership with KEYON. Can Manage SA or SP appliances (multiple) How to get it? Demo available Production features will require update to license on the sentinel key. GA? Q2, 2008.

Luna SX Screen shot Partition details Multiple clients Multiple devices, SA/SP Available preset actions Admin Tabs

Driven By ePassports Initiatives World Wide BrainPool Support PSG with PTK 3.32 release GA May /08 Luna SA with 4.3 release GA March 31/08 Luna PCI with 3.0 release GA Q3/08 Support for Named, and “user defined” Brainpool ECC curves Driven By ePassports Initiatives World Wide User Defined feature…opens other doors (like Marlin curve set)

Release Details (Protect Server) PTKC 3.32 (May/08) Brainpool support RoHS Card reader/Pin Pad support PTK-M password fix PSO/PSG support CNG support New OS support Java 1.5 support PTK 4.0 (Q1/09) PCI-Express support New PCI board layout PTK BETA with Brainpool support available Now!

SafeNet HSM Product Range Overview ProtectServer External ProtectServer Internal ProtectHost EFT Luna CA3/CA4 Luna PCM Luna PCI Luna SA Luna SP Server Network Network Network Embedded Embedded Embedded Server/ Network Attachment FIPS 140 Level 2 and Level 3 Certifications CCEAL 4+ (CA3) CCEAL 4+ CCEAL 4+ PKCS 11, Java, CAPI SW Support PPO PPO PPO 1024 RSA Signings (max) 27/sec 4000+/sec 4000+/sec 600/sec 27/sec 600/sec 7000/sec 1200/sec Encryption Algorithms Symmetric and Asymmetric 20 x partitions, SSL acceleration EFT Command Sets Other features

SafeNet Network-Attached HSMs Luna SA / SP ProtectHost EFT Luna XML Luna SX  High assurance enterprise-grade HSM 4,000 ops/s FIPS 140-2 Level 3, CC EAL 4+ Full platform support Secure remote administration 10/100 Ethernet interface Protected application execution environment (Luna SP) Extensive algorithm support  High assurance HSM for financial payment systems PIN generation & verification Supports global payment processing, EMV, and Card Issuance APIs 1,200 Visa PIN Verify operations / sec Certifications: FIPS 140-2 Level 3, CC Easy GUI-based administration  High assurance enterprise-grade HSM for XML environments XML interface (WSDL) encapsulates crypto functions, enabling rapid integration development FIPS 140-2 Level 3 Extensive algorithm support No client required 2,200 ops/sec OS independent Secure remote administration 10/100/1000 Ethernet interface  Central HSM Management Console Intuitive GUI Easy setup & management of multiple HSM appliances Reduces cost of administration

SafeNet Internal HSMs CA4 Luna PCM Luna PCI ProtectServer Gold  Root key HSM for true hardware key management FIPS 140-2 Level 3 certified Extensive algorithm support Supports two-factor trusted path authentication Supports common certificate authorities (Microsoft, Entrust, Verisign, RSA, etc.)  Portable, cost-effective PCMCIA HSM card for hardware key management and crypto acceleration Versions for document signing, key export for registration of tokens, and signing and back up of key material to a token FIPS 140-2 Level 3 Extensive algorithm support  Cost-effective high- assurance PCI HSM card for customizable hardware key management 600 ops/s Easy GUI-based administration Customizable interface FIPS 140-2 Level 3 Extensive algorithm support Secure remote administration  Fast, high-assurance PCI HSM card for hardware key management and crypto acceleration 7,000 ops/s FIPS 140-2 Level 3, CC EAL 4+ Supports two-factor trusted path authentication Extensive Algorithm support

Competitive Details

SafeNet HSM Industry Leadership First general purpose network HSM Secures the most financial transactions Most PKI deployments Most HSM hardware form factors/toolkits HSM leader for 15 years Leader in HSM compliance (FIPS, CC, PCI-DSS, E-passports…) ……New Luna XML

Why SafeNet HSM’s? Do You Care about these things? Reducing your risk Fraud/Breaches Physical disaster Reducing your costs Moving to digital processing Deployment/integration costs Increasing your revenue Enabling new online Business process Industry regulation/compliance FIPS, CC, Sarbox, PCI-DSS, E-Passports, EMV, and industry audits Who does: Largest online PKI provider in the World. Deploys 1000’s of SafeNet HSMs Who does: Largest Financial Network in the World. Deploys 1000’s of SafeNet HSM’s. Who does: World’s Largest internet Bank.

Luna Vs. PS, which to position? HW Key Management Enterprise class Appliance SNMP, HA, secure CLI, NTLS, Shareability CC certification in process PED auth More 3rd party integrations HSM backup option Existing Luna install base Higher Performance PS FM’s (and the customization they offer) PCI FF, lower entry $price$ Embedded OEM opportunities Fuller OS support than Luna PCI EFT FM Existing PS install base Position Luna: High Assurance, security focused offering. More FF choices. Enterprise Grade Appliance offering. Competing v nCipher on Security: Leverage Luna features on Entry Price: Leverage PS features Position PS: Flexible, Embedded focused offering Customizable Firmware lower entry price.

Competitive Details (Positioning) More Secure key management More Enterprise Grade features More speed, up to 7000 ops/sec (more than Double nCipher) First to market XML HSM Easiest to Set up/Manage (Luna Sx) More extensive API/Toolkit set FM’s, XML, Java, OpenSSL, P11, CAPI More Extensive range of HSM offerings Appliances, PCI cards, PCM tokens More Large Customer installations SWIFT, SIC, DOD UBS, Verisign, NCR, AOL LESS expensive HSM’s LESS expensive HSM product options (licenses, toolkits, FM) Updates: nCipher Buys Neoscale. Tape backup Key Man App (not very Robust). Bankrupt, then bought Sun Crypto card Cheap, but not real threat. Ltd OS/API support FCC only in SUN box. SSL/IPSec target card. = BEST VALUE Difference Difference Difference

Competitor’s Positioning nCipher leads with Key Management positioning We offer True Hardware key management nCipher positions themselves as “Enterprise provider”, SFNT as “low-cost” provider. We have lower list prices, but a more extensive, secure HSM offering nCipher offers discounts on maintenance, and initial purchases. nCipher has a stronger MS relationship nCipher “solution sells”, often is more marketing than “meat”. Most of what they market as solutions, are the same partnerships offering we have. We are moving to a clearer marketing focus on solutions.

Rene Bastien Product Marketing Manager Payment HSMs Rene Bastien Product Marketing Manager

HSMs in Payment Market drivers differ Retail Market: Wholesale: EMV PCI-DSS Streamlining of operations (outsourcing, PIN) Move to contactless cards Payment over new channels (m-payment, NFC, transit, loyalty) Wholesale: Transaction authentication User authentication Compliance requirements

Payment Products Network-attached HSM: ProtectHost EFT Replaces PHW Great competitive features : Form factor (1U instead of 4U) Price competitive Performance (50% faster than Thales) Ease of integration (runs same software as PHW) Backwards compatible

Payment Products ProtectTool EFT Version 5.02 in SQA. Expected GA by Q3-2008. Sits on ProtectServer Gold Essentially, Mark II in a different form factor Works with PTK C

Payment Products ViewPIN+ Application that does 2 things quite well: Changes your PIN Enables you to retrieve a forgotten PIN All of this securely All of this either at home through a web browser, or in a bank branch No one does that! Replaces IVR interface Simplifies ATM upgrades Great lead-in to new accounts

Payment Product Roadmap ViewPIN+ formal launch in November 2008 Mark II roadmap for the next 2 years Full EMV support Dual role devices (MarkII plus AMB) Contactless Mobile commerce Multiple languages, printers for PIN mailers Integration with other products, partners Mark II over multiple platforms

SafeNet’s Competitive Edge Hardware: Performance Commonality of platform Multiple form factors Continuous R&D FIPS and CC compliance Application: General purpose appliances (including XML appliance) Depth, breadth of offering Market share: General purpose worldwide: leader Payment: EMEA (2nd) APACS (1st) Partnerships and integrations

HSM Marketing Materials and Campaigns Clara Wicke Product Marketing Manager, HSM

MySafeNet.com Our corporate intranet Mysafenet.com is broken down by departments. Here is where you can put a face to a name of a colleague, get contact information and also access the latest collateral including sales tools. Intuitive, complete, great bed-time reading material.

Sales Tools Case Studies Competitive Matrixes Presentations Qatar Central Bank Security Biometric PCI DSS E-passport Egg Bank Canadian Government Automotive Pharmaceutical Competitive Matrixes Presentations Sales Presentations and Corporate Product Slides Product Briefs Luna XML Luna SA Luna SP Luna CA4 Luna PCI 7000 ProtectServer External ProtectServer Gold ProtectHost EFT Sales & Partner Success Kits Hard and Soft Copy Solutions Briefs Solutions Selling Handouts Technical Matrixes Webinars Application Development PCI- Changes and Audits PCI- Global Compliance PCI- Technical Architecture & Best Practices PCI- Deadlines Past Merchants Still Not Compliant Parts 1 & 2 SOA Web Services Security with Layer 7 HSM 101 Whitepapers & Guides CA3-CA4 Migration Guide Compliance Microsoft Guide (almost there) Tumbleweed User Guide E-Passport PKI Best Practices XML Security -Qatar shows how our Luna SP, Luna PCI and iKeys were applied in a SWIFT-like environment -Security Biometric is a US federal government application, the Transportation Security Association, showing how our Luna SA secured data under the registered traveler program -PCI DSS show cases any HSM -E-Passport is a Luna SP application -Canadian Government is a general HSM application used to secure citizen’s private data for online services -Automotive case study is a European application showing secure authentication and back up with Luna SA and Luna CA3 -Pharmaceutical case study demonstrates access control to private information using CA3 and Luna SA and SP for database encryption ********************************************************************************************************* -Sales and Partner Success kits were mailed to Betty and Ingrian last week by Trisha Paine Solution Briefs are internal documents that are dense by nature because they are formatted for at-a-glance viewing and portability Examples of a Solution Selling Handout and “cheat sheet” on the slides to follow Under white papers and guides, we have integration guides for migrating CA3 to CA4, and user guides such as the Tumbleweed application. The compliance white paper explains the importance of compliance and how it is applied as a best-practice tool. Also falling under best practices, are our PKI and XML Security.

HSM XML “Cheat Sheet”

Sales Kit- What’s Inside! HSM Overview Key Drivers (Internal and External) HSM Value Proposition Applications by Vertical Problem Owner Profiles Vertical Solutions Competitive Analysis Partner Guides Quick Sheets for Applications, Competition, and Objection Handling Prospect List And More!!! Online version of sales kit http://mysafenet

Upcoming HSM Campaigns Q2/Q3 HSM Luna XML Campaign Launched product at RSA List being purchased to identify project managers for applications in IT Also use internal house list of software developers May: Email to promote XML white paper June: Email to promote XML webinar Vertical Focused Campaigns Financial PCI DSS Compliance Paper to Digital Transactions Government E-passport First Responders

Thank You