HSM

A hardware security module (HSM) is a physical device that manages digital keys and performs cryptographic operations in a secure, tamper-resistant environment. By isolating keys from general-purpose servers, HSMs reduce exposure to theft or misuse and provide strong protection for keys used in authentication, encryption, and digital signing.

HSMs securely generate, store, and handle cryptographic keys and execute operations such as encryption, decryption, digital signatures, and key wrapping. They commonly support APIs such as PKCS#11, Microsoft CAPI/CNG, and Java JCA/JCE, and may support PKI-related tasks like issuing certs or signing certificates. They can operate with symmetric keys (AES, 3DES) and asymmetric keys (RSA, ECC).

Deployment models vary: on-premises network-connected HSMs and PCI HSMs used by card processors; cloud-based HSM services offered by cloud providers; and embedded HSMs integrated into devices. HSMs differ by capacity, performance, and security level, with tamper detection, secure key backup, and partitioning to allow multiple tenants or applications to use the device securely.

Common use cases include securing root keys for PKI and certificate authorities, protecting TLS keys, encrypting database data at rest, enabling hardware-backed code signing and document signing, and supporting payment processing. In payment ecosystems, PCI HSMs are specially designed to handle cardholder data in compliance with PCI standards.

Standards and compliance: many HSMs are evaluated to FIPS 140-2 or FIPS 140-3, and/or Common Criteria. They often provide audit logging and role-based access control, and include key management features such as key rotation, backup, and recovery. They are a foundational element in enterprise security architectures and regulated industries.