HSM Support For Blockchain Custody Varies By Provider

A review of six hardware security module (HSM) providers found differences in support for blockchain signing curves and wallet-derivation methods. The review covered Thales Luna, Securosys Primus, Utimaco Blockchain Protect, Entrust nShield, Fortanix Data Security Manager and AWS CloudHSM.

The comparison examined secp256k1, used by Bitcoin and Ethereum, and Ed25519, used by Solana and other networks. It also covered hierarchical wallet methods such as BIP32 and SLIP-0010. The review was checked against vendor documentation in November 2026.

An HSM’s FIPS certificate applies to the algorithms validated for a specific device and firmware. It does not automatically cover every blockchain curve or key-derivation function offered by the product. Keys remain inside the hardware when a non-FIPS mode is used, but those operations fall outside the FIPS validation.

Thales documents BIP32 master- and child-key derivation for secp256k1 on Luna firmware 7.3 and later. The feature requires non-FIPS algorithms to be allowed. Luna supports PKCS#11, Java, OpenSSL and Microsoft CNG interfaces and is integrated with custody platforms including Fireblocks, Taurus and Dfns.

Securosys Primus supports BIP32, seed-phrase import and Ed25519. The company’s documentation says Ed25519 is enabled by default on its CloudHSM. Its approval policies can require several authorizations before a transaction is signed. SLIP-0010 derivation and BLS signing require separate licenses.

Utimaco offers blockchain functions through its Blockchain Protect extension for the u.trust General Purpose HSM Se-Series. The extension supports BIP32, BIP44 and SLIP-0010 derivation, along with multisignature and BLS signing. The cited product page does not identify supported curves or list pricing.

Entrust presents the nShield 5 range as a root-of-trust system for blockchain networks. Its blockchain materials cover the generation and storage of root keys, protection of keys that issue or revoke signing keys, authentication for network participants and clustering. Those materials do not identify supported curves or wallet-derivation methods and refer to professional services for custom implementations.

Fortanix documentation lists support for secp256k1, ECDSA, BIP32 and SLIP-0010 in Data Security Manager. It also lists Ed25519, Ed448, NIST P-curves and X25519 for different workloads. The company’s dedicated warm-wallet page was unavailable when the review was conducted.

AWS CloudHSM supports secp256k1 key generation and ECDSA signing through its single-tenant cloud HSMs. AWS documentation says Ed25519 is available only on the hsm2m.medium instance type and only in non-FIPS mode. Its OpenSSL engine does not support Ed25519. The service does not list native BIP32 derivation, leaving wallet logic to customer software.

The review found that support can depend on firmware, operating mode, licensing and the custody platform connected to the HSM. Teams selecting a product need to check those conditions for each blockchain and confirm where transaction-approval rules are enforced.