English
Menu

TPM vs HSM vs Secure Element: Location, Purpose, Key Protection and Certification Compared

All three are dedicated hardware that generates and stores cryptographic keys and performs signing or decryption inside, without letting private keys out. They differ in what they protect and where they sit. A TPM sits in each PC or server, records and proves that machine's boot state, and protects keys bound to that machine. An HSM is a dedicated appliance that holds an organization's most important keys in one place; it sits at the heart of certificate authorities, payment systems and cloud key management services and handles large volumes of signing and decryption. A secure element is a small tamper-resistant chip in smart cards and phones that protects payment and identity credentials inside devices people carry around.

AspectTPMHSMSecure element
Location and formA discrete chip on the motherboard of a PC or server; it can also be firmware inside the CPU or SoC (fTPM)A PCIe card or a network-attached appliance; also offered as a cloud serviceA small chip in smart cards, SIM cards, or on the board of a smartphone or IoT device; it can also be integrated into an SoC
Main purposeRecord and prove the boot state of that machine, and protect keys bound to itProtect an organization's important keys in one place and serve signing and decryption requests from many systemsProtect payment, identity and mobile-subscriber credentials inside devices people carry
Typical devices and usersPCs and serversCertificate authorities, banks and payment providers, key management services (KMS) in data centers and cloudsSmart cards such as credit cards and employee badges, SIMs, smartphones, IoT devices
How keys are protectedKeys are generated inside the TPM and the private part never leaves in plaintext; sealing can bind a key to PCR values so it is released only when the boot state is correctKeys are generated and stored inside the device; applications ask it to "sign with this key" and receive only the result; user roles and an audit trail are managedKeys and credentials are stored on the chip, and applications (applets) on the chip perform authentication and signing
Crypto performanceLow; bulk data is encrypted by the CPU using a key released by the TPMHigh; built to process many signing and key operations continuouslyLow; suited to authenticating or signing short pieces of data
Tamper resistance and certificationA discrete chip is tamper-resistant; an fTPM relies on the main processor's protection. Depending on the product, certified under Common Criteria or FIPS 140Erases its keys when it detects an attempt to open it; many products are certified against standards such as FIPS 140-3Smart-card-grade tamper resistance, with countermeasures against side-channel and fault injection attacks also evaluated; many are evaluated under Common Criteria (ISO/IEC 15408)
AttestationA core function: PCR values are signed with a key that cannot leave the TPM (a quote) for remote attestationNot a core function; some products can prove that a key was generated inside and cannot be exportedUsed to show that a key was generated on the chip and that the chip is genuine
Cost and sizeInexpensive; one component of a PC, and an fTPM needs no extra partThe most expensive and largest; services that must not stop use several units for redundancyThe smallest; fits into cards and small devices, and is cheap per unit because it is mass-produced
Typical usesSealing disk-encryption keys, measured boot, device-health checks before network accessCA signing keys, payment keys, top-level KMS keys, code-signing keys for softwareContactless payment, SIM and eSIM subscriber authentication, e-passports and ID cards, IoT device authentication

Figures are typical orders of magnitude and vary by process generation and product.

When to use which

TPM
On PCs and servers, when you want to protect keys tied to the boot state (disk encryption, for example) or prove to a server that the machine booted the right software.
HSM
When an organization's most important keys, such as CA signing keys or payment keys, must be guarded in one place while many systems use them. Also used when regulations or audits require keys to be handled in a certified device.
Secure element
In cards, phones and IoT devices that may fall into an attacker's hands, when payment or identity credentials and per-device keys must be protected against physical attacks.
Together
Systems commonly use them side by side: a server proves its boot state with a TPM, the service's critical keys live in an HSM, and the user's smartphone keeps payment keys in a secure element.

FAQ

What is the difference between a TPM and an HSM?

A TPM sits in a single machine, records and proves its boot state and protects keys bound to it, and is relatively slow. An HSM is a dedicated appliance that holds an organization's important keys and handles signing and decryption requests from many systems with high performance. Both follow the idea of processing keys inside without letting them out; they differ in scale and role.

Are a secure element and a TEE the same thing?

No. A secure element is a separate tamper-resistant chip with its own processor and memory. A TEE (trusted execution environment), such as Arm TrustZone, creates an isolated execution environment inside the main processor and shares cores and caches with the normal OS. Smartphones often use both, for example matching fingerprints in the TEE while keeping the most valuable keys in a secure element.

Is an fTPM as secure as a discrete TPM chip?

The interface is the same, but the protection differs. An fTPM runs in an isolated environment inside the main processor, so no extra chip is needed, but it can be affected by vulnerabilities in the processor's firmware and by side-channel attacks. A discrete chip can be purpose-built to resist physical attacks. Which to choose depends on the attacks you need to withstand.

What is the difference between FIPS 140-3 and Common Criteria?

FIPS 140-3 is a standard used in the US and Canadian programs that sets security requirements for cryptographic modules, grouped into four security levels of increasing strictness. Common Criteria (ISO/IEC 15408) is an international standard in which a product is evaluated against security targets defined for it, with the depth of evaluation expressed by evaluation assurance levels (EAL) and similar measures. HSMs are commonly validated under FIPS 140-3 and smart cards and secure elements under Common Criteria, though some products have both.

Check your understanding

What is the main role of a TPM (Trusted Platform Module) installed in PCs and similar?

  1. AA dedicated circuit to speed up display
  2. BA component managing CPU cooling
  3. CSecurely generating and storing keys, recording measurements of booted software and attesting to that state, among other security functions
Show answer and explanation

Answer: C. Securely generating and storing keys, recording measurements of booted software and attesting to that state, among other security functions

A TPM is a tamper-resistant security chip (or a function built into the CPU) that generates and stores keys, performs cryptographic operations, generates random numbers and records hashes of booted software. For example, releasing the disk encryption key only when the boot state is correct makes data hard to read even if the disk is removed or boot software is altered.

Which of the following correctly describes the role of an HSM (hardware security module)?

  1. AA fast storage device with built-in encryption functions for storing large amounts of encrypted data
  2. BA device that generates and stores keys inside tamper-resistant hardware and performs operations such as signing and decryption without letting the keys out
  3. CA network device that monitors network traffic and finds and blocks malicious packets and attack traffic
Show answer and explanation

Answer: B. A device that generates and stores keys inside tamper-resistant hardware and performs operations such as signing and decryption without letting the keys out

An HSM is a dedicated device for protecting keys such as the signing keys of certificate authorities, payment keys and the top-level keys of cloud key management services (KMS). Keys are generated inside the HSM and built so that they cannot leave it in plaintext; applications send requests such as "sign with this key" and receive only the results. It is tamper-resistant, for example erasing its keys if someone tries to open it, and many products are certified against standards such as FIPS 140-3. The secure element of a smartphone and the TPM of a PC protect keys with a similar idea, though on a smaller scale.

Which describes the tamper resistance required of security chips such as smart cards?

  1. AThe property of not breaking when wet
  2. BThe property of protecting internal secrets by making physical attacks such as opening the chip or probing difficult, and erasing keys when tampering is detected
  3. CThe property of running fast at high temperature
Show answer and explanation

Answer: B. The property of protecting internal secrets by making physical attacks such as opening the chip or probing difficult, and erasing keys when tampering is detected

Tamper resistance is the ability to withstand attempts to extract secrets by deprocessing the chip or probing internal wiring. Countermeasures combine detecting cuts in a metal mesh (shield) covering the surface, detecting abnormal light, temperature or voltage, encrypting or scrambling internal buses and layout, and erasing keys when an anomaly is detected. Evaluation also covers resistance to side-channel and fault injection attacks.

  1. Which describes remote attestation?
  2. Which describes a fault injection attack?
  3. Let DEK be a data encryption key and KEK a key encryption key. Which of the following correctly describes envelope encryption, as used in cloud storage and elsewhere?

Practice Hardware Security questions

Key terms explained

Trusted Platform Module (TPM)
A security chip or function that generates and stores keys, records measurements of booted software and attests to platform state.
Hardware security module (HSM)
A dedicated device that generates and stores cryptographic keys securely and performs operations such as signing and decryption inside, without letting the keys out. It is tamper-resistant and erases its keys when it detects attempts such as prying it open. It is used to protect CA signing keys, payment keys and the top-level keys of cloud key management services (KMS). Many products are certified against standards such as FIPS 140-3. Besides PCIe cards and network-attached appliances, HSMs are also offered as cloud services.
Tamper resistance
The ability to withstand physical attacks such as opening a chip or probing it, protecting internal secrets, for example by erasing keys on detection.
Remote attestation
A mechanism in which a device signs the state of its running software with an on-chip key and presents it to a remote server for trust verification.
Measured boot
A mechanism that cumulatively records hashes of each boot stage's software in a TPM or similar so the boot state can be verified later.
Trusted execution environment (TEE)
A hardware-protected execution environment isolated even from the normal OS, used for critical work such as key handling and authentication, for example Arm TrustZone.
Envelope encryption
A scheme in which data are encrypted with a data encryption key (DEK), and the DEK is in turn encrypted (wrapped) with a separate key encryption key (KEK) and stored together with the data. The KEK stays inside a KMS or HSM and never leaves it, while large data can be encrypted locally. When the KEK is rotated, only the small DEKs need to be re-encrypted, not all of the data. It is widely used to encrypt cloud storage and databases.

Related comparisons