AWS Key Management Service vs QuintessenceLabs Trusted Security Foundation

AWS Key Management Service creates and controls cryptographic keys for data encryption and digital signatures. It centralizes key lifecycles and permissions, including separate control over administrators and key users. KMS supports symmetric encryption, asymmetric signing or encryption pairs, and HMAC generation and verification. The AWS Encryption SDK can use KMS as a key provider for local application encryption and decryption. Integrations include Amazon S3, EBS, RDS, DynamoDB, Lambda, and CloudTrail. With CloudTrail enabled, requests can record the user, time, API action, and key. AWS says hardware security modules validated to FIPS 140-3 Security Level 3 protect key material and operations, with plaintext keys kept only in volatile HSM memory. Multi-Region keys support cross-Region workflows; external key stores keep material in a customer-managed external manager. KMS scales with demand but has default key and request limits. The listed plan is $1 a month per KMS key, prorated hourly.

QuintessenceLabs Trusted Security Foundation (TSF) is a centralized manager for cryptographic keys and policies across the key lifecycle. It is offered as a virtual machine or hardware appliance; TSF 100 virtual appliances can run locally or on AWS, Azure, and GCP. Product materials describe policies for objects and users, plus replication across up to 16 nodes. The TSF range supports OASIS KMIP and has been tested with products from IBM, HP, Oracle, and NetApp. Listed capabilities cover one-time pad, symmetric and asymmetric ciphers, key derivation, random objects, certificates, and selected cryptographic operations. Administrators can use web HTTPS or command-line SSH interfaces. The product sheet states support for thousands of end-client systems, tens of millions of keys, and 8,000 key requests per minute per node. The maker says TSF 400 contains an Entrust nShield XC FIPS 140-3 Level 3 validated HSM as a root of trust. TSF is under evaluation for Common Criteria NDcPP compliance. The maker also states that its key management application is compliant with NIST SP 800-57 where applicable. Pricing is available on request, with configurations tailored to different needs.