Exchanging key material between HSMs of different manufacturers In the future we may be setting up a system to secure a large number of symmetric (device) keys (a few million) by using HSMs. So, the keys themselves will be stored outside the HSM, but they will be stored encrypted by a key that resides in the HSM.
We will setup two such systems with HSMs potentially from different manufacturers.
One requirement is that it must be possible to exchange the keys from one system to the other.
So, is there a secure and standardized way to exchange key material between HSMs of different manufacturers?
If so, which standards are applicable here, and are they commonly implemented by HSM manufacturers?
No, there's no standardized way to exchange key material between HSM (and often not even between HSM of the same manufacturer, although manufacturers may provide a backup/restore or replication capability that works at least within the same model). As far as an HSM is concerned, the world is divided in two: inside and outside. What is outside is not trusted. From the point of view of HSM1, HSM2 is outside and therefore not trusted, so HSM1 won't give up its keys to HSM2.
Assuming that you keep a single copy of the wrapped application keys (plus their identical backups), both HSM need to have the same wrapping key. Either create that key outside the HSM and import it to both, or create that key inside one HSM, export it, and import it into the other HSM. After import, make sure to switch the key attributes to be non-exportable.
Even with a single HSM, you would need to have a copy of the wrapping key outside the HSM for backup purposes. This copy (or more precisely all the backup copies) must of course be stored securely. Depending on your security requirements, this could be a piece of paper stored in a safe, or key shares where several company officers are responsible for securing their own shares and K shares among N are necessary to reconstruct the key. As far as I know, there's no standard way to create these key shares, but one HSM may have this as a proprietary featue.