used by certification authorities (CAs) and registration authorities (RAs) to generate, store, and handle asymmetric key pairs. In these cases, there are some fundamental features a device must have, namely: Logical and physical high-level protection Multi-part user authorization schema (see secret sharing) Full audit and log traces Secure key backup On the other hand, device performance in a PKI environment is generally less important, in both online and offline operations, as Registration Authority procedures represent the performance bottleneck of the Infrastructure. Card payment system HSMs (bank HSMs) Specialized HSMs are used in the payment card industry. HSMs support both general-purpose functions and specialized functions required to process transactions and comply with industry standards. They normally do not feature a standard API. Typical applications are transaction authorization and payment card personalization, requiring functions such as: verify that a user-entered PIN matches the reference PIN known to the card issuer verify credit/debit card transactions by checking card security codes or by performing host processing components of an EMV based transaction in conjunction with an ATM controller or POS terminal support a crypto-API with a smart card (such as an EMV) re-encrypt a PIN block to send it to another authorization host perform secure key management support a protocol of POS ATM network management support de facto standards of host-host key | data exchange API generate and print a "PIN mailer" generate data for a magnetic stripe card (PVV, CVV) generate a card keyset and support the personalization process for smart cards The major organizations that produce and maintain standards for HSMs on the banking market are the Payment Card Industry Security Standards Council, ANS X9, and ISO. SSL connection establishment Performance-critical applications that have to use HTTPS (SSL/TLS), can benefit from the use of an SSL Acceleration HSM by moving the RSA operations, which typically requires several large integer multiplications, from the host CPU to the HSM device. Typical HSM devices can perform about 1 to 10,000 1024-bit RSA operations/second. Some performance at longer key sizes is becoming increasingly important. To address this issue, some HSMs now support ECC. Specialized HSM devices can reach numbers as high as 20,000 operations per second. DNSSEC An increasing number of registries use HSMs to store the key material that is used to sign large zonefiles. OpenDNSSEC is an open-source tool that manages signing DNS zone files. On January 27, 2007, ICANN and Verisign, with support