Hardware security module

As explained in Real-World Cryptography

A hardware security module is a specialized device that generates, stores, and uses cryptographic keys while protecting them from unauthorized extraction.

A hardware security module (HSM) is a dedicated cryptographic device that stores secret keys and performs cryptographic operations while making physical attacks more difficult. Think of it as a larger, faster secure element for enterprise servers: usually a rack-mounted device or PCIe card in a data center, though small USB devices such as the YubiHSM also exist. section 13.2.3 section 13.3

An HSM’s role becomes clearer through its surrounding choices:

• It commonly exposes cryptographic operations through PKCS#11 rather than a universal HSM-specific interface. section 13.5
• It occupies the enterprise end of a hardware-security range: smart cards and secure elements are smaller, while TPMs and TEEs serve different integration points. section 13.3
• Certification levels communicate resistance claims rather than magical invulnerability: FIPS 140-3 levels range from no physical-attack protection at level 1 to secret wiping after intrusion at level 3. section 13.2.3
• Hardware alone is not enough; timing, power, electromagnetic, and fault attacks can still require software mitigations such as constant-time algorithms, blinding, and masking. section 13.5

A data-center deployment

An enterprise server can use an HSM installed as a PCIe card, such as an IBM 4767, or connect to an external rack-mounted unit. A small deployment might instead use a USB YubiHSM. The choice depends on required form factor, cryptographic throughput, and security level. section 13.2.3 section 13.3

Figure 13.2 An IBM 4767 HSM as a PCI card. Photo from Wikipedia (http://mng.bz/XrAG).

Use the figure to visualize an HSM as a physical PCI card attached to an enterprise server. section 13.2.3

How Real-World Cryptography covers it

How deep it goes

Explains form factors, interfaces, certification levels, and side-channel limits, but stops short of implementation detail.

Examples

Uses rack-mounted devices, PCIe cards such as the IBM 4767, and USB devices such as the YubiHSM.

What it assumes

Assumes familiarity with secure elements and introduces HSMs by comparing their size, speed, flexibility, and deployment context.

What you can do after

Evaluate HSM choices by comparing form factor, cryptographic speed, certification claims, and required security.

How it connects

Connects HSMs with secure elements, smart cards, TPMs, TEEs, PKCS#11, and FIPS 140-3.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersA hardware security module is a specialized tamper-resistant device that protects cryptographic keys and performs security-sensitive cryptographic operations.

Compare how 2 books explain hardware security module →

Related concepts

• PKCS#11uses · PKCS#11 is a standard API specification for accessing cryptographic tokens and performing protected key and cryptographic operations.
• key management servicepart of · A key management service is a system that securely creates, stores, controls access to, rotates, and revokes cryptographic keys.
• trusted platform moduleincludes · A Trusted Platform Module is a standardized hardware security component that securely stores cryptographic material and performs protected cryptographic operations for platform integrity and authentication.
• credential storeused by · A credential store is a protected system that securely stores, manages, and supplies authentication credentials to authorized clients.
• secure elementkind of · A secure element is a hardware security component that stores secrets and performs cryptographic operations as a coprocessor in a larger system.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.