Back to Demos
39/54
HSM - Hardware Security Modules
Tamper-resistant devices that protect your most critical private keys
The "Black Box" Model
HSM DEVICE
Private Key
(Generated inside, CANNOT leave)
INPUT
"Sign this data"
OPERATION
(happens inside)
OUTPUT
"Signature"
Private key NEVER comes out
Only operation results exit
Key Operations Flow
Software Storage
/etc/ssl/private/key.pem
- Can be copied
- Can be read
- Root access = game over
HSM Storage
Tamper-resistant hardware
- Key generated inside
- Key used inside
- Even root can't extract
Types of HSMs
Network HSM
Luna / Thales nShield
Data center appliance
$10,000 - $100,000+
Network attached
High throughput
CA roots, code signing
Cloud HSM
AWS CloudHSM / Azure HSM
Cloud-managed
$1-2/hour per HSM
Multi-region available
Scalable clusters
Cloud workload keys
USB Token HSM
YubiHSM / Nitrokey
USB form factor
$500 - $1,000
Personal/small business
Code signing, SSH
Dev/small scale CA
TPM
Trusted Platform Module
Built into motherboard
Included with hardware
BitLocker, device identity
Lower performance
Phones, laptops, servers
HSMs: Keys that never leave = keys that can't be stolen
Want to learn more?
Read our complete guide on Hardware Security Modules
