KeyLink Flow is the companion to Fireblocks Key Link: a customer-hosted key management and signing orchestration service that connects your HSM to Fireblocks.
With KeyLink Flow, you deploy a ready-made service in your own environment instead of building and maintaining your own integration between Fireblocks and your hardware security module (HSM). It works in hot mode, where signing happens on a connected server, or in air-gapped cold mode, where signing happens on a server that has no connection to Fireblocks.
KeyLink Flow is available to Fireblocks Key Link customers. To get access, contact your Customer Success Manager (CSM).
How KeyLink Flow fits into Key Link
In a Key Link workspace, your keys stay in your own HSM. Fireblocks manages transactions, Policies and approvals, and sends signing requests to your environment.
Three components work together on your side:
- Fireblocks Agent: a service you run in your environment. It connects to Fireblocks over an outbound connection, receives signing requests, verifies them, and passes them to KeyLink Flow. It holds no keys and does no signing.
- KeyLink Flow: receives signing requests from the Agent, signs them with your HSM, and returns the signatures. It also provides a web console for your operators.
- Your HSM: generates and stores your keys. Private keys never leave it.
The Agent is required in every Key Link deployment. KeyLink Flow replaces the server you would otherwise build yourself.
Deployment modes
KeyLink Flow runs in one of two modes. You choose the mode when you deploy it.
Hot mode
In hot mode, a single KeyLink Flow server is connected to both the Agent and your HSM. Signing requests are signed as they arrive, or after an operator approves them in the KeyLink Flow console.
Use hot mode when you want signing to happen without manual steps, or with a single approval step in the console.
Cold mode
In cold mode, KeyLink Flow runs as two separate servers:
- An online server in your network receives signing requests from the Agent and exports them to a file.
- An offline server in an air-gapped environment, connected to your HSM, imports the file, signs the requests, and exports the signatures to a file.
The files are moved between the two servers, either by an operator through the KeyLink Flow console or through shared directories that you configure. The offline server and your HSM have no connection to Fireblocks or to your online environment.
Use cold mode when your security requirements call for keys that are only ever used in an air-gapped environment.
Signing control
You decide how much of the signing runs without an operator:
- In hot mode: sign requests automatically as they arrive, or hold them in the console until an operator approves them.
- In cold mode: move and sign request files manually, or automate the export, import and signing steps.
Fireblocks Policies and approvals still apply to every transaction before a signing request reaches your environment.
Key management
You create and manage your keys from the KeyLink Flow console. Keys are always generated inside your HSM.
- Validation keys: certify your signing keys. KeyLink Flow creates RSA 2048-bit validation keys.
- Signing keys: sign transactions. KeyLink Flow creates ECDSA (secp256k1) and EdDSA (Ed25519) signing keys.
- Certificates: KeyLink Flow builds a certificate for each signing key and signs it with a validation key you choose, individually or in bulk.
After you create your keys, register them with Fireblocks and assign signing keys to vault accounts from the Key Management Dashboard in the Fireblocks Console, or through the Fireblocks API. For details, see Managing keys with the Key Management Dashboard.
Key derivation on Thales Luna HSMs
On a supported Thales Luna HSM, KeyLink Flow can create master keys and derive signing keys from them, instead of generating each signing key separately. This helps when you need a large number of keys. Derivation is off by default and needs a compatible HSM and configuration.
Supported HSMs
KeyLink Flow works with any HSM that supports the PKCS#11 interface, the industry-standard way for applications to use an HSM. It includes ready-made configurations for Thales Luna Network HSM 7.
SoftHSM, a software HSM, is included for testing and evaluation only. Don't use it in production.
For Thales Luna, KeyLink Flow requires firmware 7.8.7 or later and Luna HSM Client 10.7.1 or later. Key derivation also requires the HSM policy that allows non-FIPS algorithms (algorithms outside the US government FIPS 140 standard). Check with your security team before enabling it.
Requirements
To deploy KeyLink Flow, you need:
- A Key Link workspace and the Fireblocks Agent.
- A Linux server (64-bit, x86) with Docker for each KeyLink Flow server you run: one in hot mode, two in cold mode.
- An HSM that supports PKCS#11, or SoftHSM for testing.
- Access to KeyLink Flow and its deployment guides, through your CSM.
Get access to KeyLink Flow
KeyLink Flow is available to Fireblocks Key Link customers. To get access, contact your Customer Success Manager (CSM).