It is mandatory to use an HSM to do key recovery as the recovery process implies that

            1. The private key which should be owned by an end user will now also resides somewhere else, on the HSM
            2. That private key can be retrieved by someone which is not the owner, the Key Recovery Operators

Because of those two concepts, the private key must be stored in the most secure way and be also recovered in a secure manner, which the HSM provides.

We do support nCipher nShield and netHSM, and also any PKCS #11-compliant HSM, including the nCipher P11 library. RSA has tested Key Recovery Manager with Safenet Luna SA.