Hardware Security Modules
Tamper-resistant hardware that generates, stores, and uses cryptographic keys without ever exposing them to the software using them.
Keys That Never Leave the Box
A hardware security module (HSM) is a dedicated, tamper-resistant device that performs cryptographic operations and safeguards keys. Its defining property is that keys generated inside it never leave in plaintext: software asks the HSM to sign or decrypt, and the HSM returns the result, but the key itself stays sealed within the hardware. Even a fully compromised application cannot extract the key, only request operations while it has access.
What HSMs Protect
- Signing keys for code, firmware, and certificates
- Root and intermediate keys of a certificate authority
- Master keys that encrypt other keys (envelope encryption)
- High-value keys whose exposure would be catastrophic
Tamper Resistance and Response
HSMs are built to resist physical attack and, in higher-assurance models, to respond to it: attempts to open or probe the device trigger the erasure of the keys inside, so an attacker who steals the hardware gets nothing. Certified HSMs are validated against standards such as FIPS 140, which grade their resistance to logical and physical attack.
Related Hardware
Smaller relatives extend the same idea: a Trusted Platform Module (TPM) anchors keys and measurements on an individual machine, and secure elements protect keys in smart cards and phones. All share the principle of keeping the secret in hardware the software cannot read out.
Fusion Context
In the Hyperion breeder and burner designs, the keys that sign firmware and control software, whose compromise would let an attacker sign malicious updates, are held in hardware security modules, so that signing is possible but key extraction is not. This underpins code signing and secure boot, and it is chosen with a path to post-quantum signing keys given the plant's decades-long life.