HSM - Hardware Security Modules Explained

About 2 min read

An HSM (Hardware Security Module) is a device that securely generates, stores, and processes cryptographic keys within dedicated hardware. Because cryptographic processing is completed without the keys ever leaving the device, it delivers far higher security than software-based key management. As of 2025, the spread of cloud HSM services has made HSM-level key protection readily accessible even to small and medium-sized businesses.

What It Means That Keys Never Leave the Device

Keys managed in software as files on a server can be copied and exfiltrated if that server is compromised, and it is difficult to verify afterwards whether a copy was ever made. An HSM eliminates this weakness by design. Keys are generated and stored inside the device, and operations such as encryption and signing are also performed within it, returning only the results, so even legitimate operations cannot extract the key itself. Because the location of a key is always confined to a specific device, it becomes possible to demonstrate clearly where the keys reside and who can use them, which is one of the reasons HSMs are adopted in fields such as payments, where strict proof of key management is required.

How HSMs Work

An HSM performs cryptographic processing on a dedicated chip with tamper resistance (resistance to physical attacks). It is designed so that the keys are automatically erased if someone attempts to dismantle the device, and products certified to FIPS 140-2/140-3 Level 3 or higher are widely used by financial institutions and government agencies. In cloud environments, AWS CloudHSM and Azure Dedicated HSM offer dedicated HSMs as a service, used for protecting the private keys of PKI certificate authorities and for processing digital signatures.

Use Scenarios

In payment systems, HSMs are essential for credit card PIN verification and transaction signing. PCI DSS (Payment Card Industry Data Security Standard) stipulates protecting the encryption keys for card information with an HSM as a requirement. HSMs are also used to protect signing keys on blockchain validator nodes. Learning the role of HSMs after understanding the basics of encryption makes it easier to grasp the overall picture.

Criteria for Adoption

Because HSMs are costly (several million yen for a physical device, and even tens of thousands of yen per month in the cloud), there is no need to manage every key with an HSM. It is practical to apply HSMs only to the most critical keys, such as the private key of a root CA, the encryption keys for payment processing, and master keys, while managing the rest with a cloud KMS service. Protect the HSM management interface with a sufficiently long random password, and require multi-factor authentication for administrator access.