English
Menu

What is Hardware security module (HSM)?

A dedicated device that generates and stores cryptographic keys securely and performs operations such as signing and decryption inside, without letting the keys out. It is tamper-resistant and erases its keys when it detects attempts such as prying it open. It is used to protect CA signing keys, payment keys and the top-level keys of cloud key management services (KMS). Many products are certified against standards such as FIPS 140-3. Besides PCIe cards and network-attached appliances, HSMs are also offered as cloud services.

Japanese name: HSM(ハードウェアセキュリティモジュール)

Hardware security module (HSM) appears in 4 practice questions across 2 topics, including Applied Cryptography, Hardware Security: Advanced Topics and Trends.

Field: Applied Cryptography

Try it: questions about Hardware security module (HSM)

Which of the following correctly describes the role of an HSM (hardware security module)?

  1. AA fast storage device with built-in encryption functions for storing large amounts of encrypted data
  2. BA device that generates and stores keys inside tamper-resistant hardware and performs operations such as signing and decryption without letting the keys out
  3. CA network device that monitors network traffic and finds and blocks malicious packets and attack traffic
Show answer and explanation

Answer: B. A device that generates and stores keys inside tamper-resistant hardware and performs operations such as signing and decryption without letting the keys out

An HSM is a dedicated device for protecting keys such as the signing keys of certificate authorities, payment keys and the top-level keys of cloud key management services (KMS). Keys are generated inside the HSM and built so that they cannot leave it in plaintext; applications send requests such as "sign with this key" and receive only the results. It is tamper-resistant, for example erasing its keys if someone tries to open it, and many products are certified against standards such as FIPS 140-3. The secure element of a smartphone and the TPM of a PC protect keys with a similar idea, though on a smaller scale.

Hardware security module (HSM) in the explanations

Questions that mention Hardware security module (HSM) (4)

  1. Which of the following correctly describes the role of an HSM (hardware security module)?
  2. Let DEK be a data encryption key and KEK a key encryption key. Which of the following correctly describes envelope encryption, as used in cloud storage and elsewhere?
  3. Regarding security levels 1 to 4 of FIPS 140-3, the certification standard for cryptographic modules, which correctly describes the requirements for physical security?
  4. Which is the most appropriate design for authenticated debugging that lets only the manufacturer's engineers open the debug port of shipped products?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Comparisons that include this term

Related terms

FIPS 140-3 Certificate authority Trusted Platform Module (TPM) Envelope encryption AES (Advanced Encryption Standard) Authenticated encryption (AEAD) Birthday attack Block cipher mode of operation Crypto agility Diffie–Hellman key exchange

Back to the glossary