How a hardware security module works
Applications do not read keys from an HSM. They send a request, to sign this, decrypt that or translate a PIN block from one key to another, and get back only the result.
The device is built to resist tampering: sensors detect opening or probing, and the module erases its keys in response. Sensitive operations, such as loading a master key, need several officers present, each holding one part. HSMs come as appliances in a rack, as cards inside a server, or as a cloud service in which the provider runs the hardware and the customer controls the keys.
The standards an HSM is tested against
Two recur in payments. FIPS 140-3, the US standard on security requirements for cryptographic modules, published by NIST on 22 March 2019, provides four increasing levels of security. PCI SSC's PTS HSM standard defines security requirements for the characteristics and management of HSMs throughout their lifecycle, for activities such as financial transactions and payment card personalisation.
Who needs a hardware security module
- Issuers and their processors: PIN verification and card personalisation keys
- Acquirers and gateways: PIN translation and encryption of card data
- Token service providers and 3-D Secure servers
- Crypto custodians: wallet keys, or the shares of an MPC key
Most new products meet HSMs through a provider: the card processor, the cloud platform or the custody vendor operates them, and the contract and the audit reports say so.
HSM, secure element or MPC?
- Secure element
- The same idea at the scale of one chip in a card or a phone, protecting one user's keys. An HSM serves a whole institution.
- Multi-party computation
- Splits a key into shares so that no single device ever holds it. The two are often combined, with each share kept in its own module.
- Key management service
- A cloud interface for creating and using keys, which may or may not keep them in HSMs.
Where a hardware security module shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Glossary: HSM
- PCI SSC, PCI Security Standards: PTS Hardware Security Module (HSM)
- NIST, FIPS 140-3: Security Requirements for Cryptographic Modules, 22 March 2019
General information, not legal advice: what applies to you depends on your services and your market.