Compare Password and PED Authentication

• ownership of the black PED Key is mandatory  
• for backup/restore, ownership of both black and red PED Keys is necessary  
• the Crypto User role is available to restrict access to usage of keys, with no key management
• option to associate a PED PIN (something-you-know) with any PED Key (something you have), imposing a two-factor authentication requirement on any role

• Mof N (split-knowledge secret sharing) requires "M" different holders of portions of the role secret, in order to authenticate to an HSM role - can be applied to any, all, or none of the administrative and management operations required on the HSM

• linked to partition password knowledge,  
• linked to black PED Key(s) ownership

available roles:  

• Appliance admin  
• HSM Admin (Security Officer)
• Domain (Cloning / Token-Backup)
• Secure Recovery
• Remote PED
• Partition Owner (or Crypto Officer)
• Crypto User (usage of keys only, no key management)

for all roles, two-factor authentication (selectable option) and MofN (selectable option)