Hardware & Attestation

What Is Hardware Security Module (HSM)?

A Hardware Security Module (HSM) is a dedicated, tamper-resistant device that generates, stores and uses cryptographic keys without ever exposing them. Applications send operations — sign this, decrypt this — to the HSM; the private key itself is designed never to leave the hardware, even under administrative access.

Why software keys are not enough

A private key stored on disk is one backup, memory dump or misconfigured permission away from silent theft — and a stolen key works forever without leaving traces. HSMs change the failure mode: the key is generated inside certified hardware (typically FIPS 140-2/140-3 validated), is marked non-exportable, and every use can require authentication and leave an audit trail.

Where HSMs are used

Certificate authority root and issuing keys are the canonical case — WebTrust and ETSI audits effectively require them. Beyond PKI, HSMs protect code-signing keys, document-signing keys, payment infrastructure (PIN/EMV), and the key vaults behind cloud services: Azure Key Vault (Managed HSM), AWS CloudHSM/KMS and Google Cloud HSM are the same concept as a service.

Form factors range from network-attached appliances (Thales Luna, Entrust nShield, Utimaco) over PCIe cards to USB tokens like the YubiHSM — and for many "is this key in hardware?" questions, a TPM or YubiKey plays the same role at personal scale.

Attestation: proving a key lives in hardware

Modern HSMs and security keys can produce a key attestation: a certificate chain, rooted in the manufacturer, stating that a specific key was generated inside genuine hardware and is non-exportable. Auditors and CA ceremonies rely on attestation to prove the root key never existed in software — and it is verifiable by anyone with the attestation files.

Try it yourself — free tools

HSM Attestation Checker — verify a key attestation against the manufacturer root certificates
Key Ceremony Planner — script the HSM-based ceremony where CA keys are generated

How MI Support IT can help

PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.