Remote HSM & mTLS Architecture
Edge-to-Hardware Cryptographic Pipeline
Cloudflare Workers encrypt player PII at the edge, then tunnel operations through an mTLS-authenticated channel to an on-premises YubiHSM 2 via OpenBao Transit. Field-level encryption, JWT signing, and hardware-seeded RNG never leave the HSM boundary — even when called from a globally distributed edge network.
From edge request to hardware key operation
Every cryptographic operation follows a deterministic path through four security layers. The HSM master key never leaves the hardware boundary.
Player PII encryption at the edge
min_decryption_version advanced — all prior ciphertexts become permanently unrecoverable.mTLS tunnel architecture
Five layers of defense protect every request. The master key is hardware-bound and non-exportable — cryptographic operations execute exclusively inside the HSM’s tamper-evident boundary.
Four HSM-backed operations at the edge
Envelope encryption delivers cloud-grade KMS performance at a fraction of the cost. The same pattern used by AWS KMS, Azure Key Vault, and Google Cloud KMS — but running on a $650 YubiHSM 2 instead of pay-per-request cloud pricing.
AES-256-GCM field-level encryption via Transit. Player email, phone, SSN, and card data are encrypted before storage. Supports key versioning for rotation.
Decrypts ciphertext using the same Transit key. Only authorized services with valid mTLS certificates and API keys can decrypt. Audit-logged per request.
ECDSA/Ed25519 signing for JWT tokens, withdrawal authorizations, and KYC verification receipts. Private key never leaves the HSM perimeter.
Hardware TRNG from YubiHSM 2 for session tokens, nonces, and supplementary entropy. NIST SP 800-90B validated, 7.9998 bits/byte entropy.
Cloud-grade KMS at on-premises cost
Envelope encryption uses a locally cached Data Encryption Key (DEK), wrapped by the HSM-backed Transit engine. This is the exact same architecture used by AWS KMS, Azure Key Vault, and Google Cloud KMS — delivering 2,000+ encrypt/decrypt operations per second at sub-millisecond latency, while maintaining full hardware key isolation and regulatory compliance.
| Provider | Cost Model | 1M ops/month | 10M ops/month | Compliance |
|---|---|---|---|---|
| AWS KMS | $1/key/mo + $0.03/10K req | $4/mo | $31/mo | FIPS 140-2 L2 (L3 with CloudHSM: $1.60/hr) |
| Azure Key Vault | $1/key/mo + $0.03/10K req | $4/mo | $31/mo | FIPS 140-2 L2 (L3 with Managed HSM: $3.20/hr) |
| Google Cloud KMS | $0.06/key version/mo + $0.03/10K req | $3/mo | $30/mo | FIPS 140-2 L2 (L3 with Cloud HSM: $2.50/hr) |
| YubiHSM 2 + OpenBao | $650 one-time + $0 per request | $0/mo | $0/mo | FIPS 140-2 Level 3 (native, no extra cost) |
At 10M operations/month, the YubiHSM 2 pays for itself in 21 months compared to cloud KMS. With cloud HSM (FIPS L3), the payback period drops to less than 1 day. Performance is comparable: 2,000+ ops/s vs typical cloud KMS throughput of 1,000–5,000 ops/s.
Six security layers protect the tunnel
Mutual TLS requires both server and client certificates. The client cert is issued by the OpenBao PKI CA with a 30-day TTL and automatic renewal.
nginx enforces that the client certificate CN matches cloudflare-worker-hsm-client. Certificates with other CNs are rejected with 403.
Only Cloudflare’s published IPv4 ranges and the production server IP are allowed. All other source IPs are dropped at the nginx layer.
A 256-bit HMAC-compared API key is required in the X-API-Key header. Timing-safe comparison prevents brute-force attacks.
Transit operations are scoped to specific key names. The proxy token can only access field-cipher and jwt-signing — no root access.
The YubiHSM 2 master key is non-exportable and tamper-evident. All cryptographic operations execute inside the HSM’s FIPS 140-2 Level 3 boundary.
GDPR, PCI DSS, and GLI-19 alignment
Right to erasure via crypto-shredding. Instead of searching and deleting PII across distributed systems, we advance the Transit key’s minimum decryption version. Prior ciphertexts become permanently unrecoverable.
{ "min_decryption_version": N+1 }
Requirement 3: Protect stored account data. Card data is encrypted at the edge before reaching any origin server. The encryption key is HSM-protected and never stored in software.
Hardware RNG and audit chain. The YubiHSM 2 TRNG passes NIST SP 800-22 statistical tests. Every cryptographic operation is audit-logged with timestamp, operation type, key name, and client identity.
Real-time HSM metrics from production
Metrics are collected every 30 seconds from the HSM Proxy API and pushed to Redis. The traffic bot simulates realistic iGaming workloads — player PII encryption, JWT signing, decrypt verification, and random generation.
Covered across multiple chapters
Hardware Security Modules
YubiHSM 2 setup, PKCS#11 integration, OpenBao Transit engine, key hierarchy design, HKDF derivation, and FIPS validation.
GDPR & Edge Encryption
Cloudflare Workers field-level encryption, pseudonymisation, crypto-shredding for Art.17, D1 encrypted models, and the remote HSM tunnel.
TLS & mTLS Infrastructure
End-to-end encryption lifecycle, certificate management, mTLS tunnel design, Coraza WAF integration, and TLS compliance testing.