Applied Cryptography
Which of the following correctly describes the role of an HSM (hardware security module)?
- AA fast storage device with built-in encryption functions for storing large amounts of encrypted data
- BA device that generates and stores keys inside tamper-resistant hardware and performs operations such as signing and decryption without letting the keys out
- CA network device that monitors network traffic and finds and blocks malicious packets and attack traffic
Show answer and explanation
Answer: B. A device that generates and stores keys inside tamper-resistant hardware and performs operations such as signing and decryption without letting the keys out
An HSM is a dedicated device for protecting keys such as the signing keys of certificate authorities, payment keys and the top-level keys of cloud key management services (KMS). Keys are generated inside the HSM and built so that they cannot leave it in plaintext; applications send requests such as "sign with this key" and receive only the results. It is tamper-resistant, for example erasing its keys if someone tries to open it, and many products are certified against standards such as FIPS 140-3. The secure element of a smartphone and the TPM of a PC protect keys with a similar idea, though on a smaller scale.
- A. An HSM is not a device for storing large amounts of data but one that protects keys and performs the operations that use them inside.
- B. Correct. Operations that use keys are performed inside the device without letting the keys out.
- C. This is the role of a firewall and similar devices.