Hardware Security Modules overview

A Hardware Security Module (HSM) is a physical device that provides secure cryptographic key storage and operations.

Important

Hardware Security Modules is a Technology Preview feature only.

HSMs protect cryptographic keys from unauthorized access and use by storing them in tamper-resistant hardware.

Unlike software-based key storage where private keys exist in files on disk or in memory, HSMs keep keys within dedicated hardware that prevents key extraction. This hardware-based protection ensures that private keys never leave the HSM in plaintext form, even during cryptographic operations.

HSMs typically provide access to their cryptographic capabilities through the Public-Key Cryptography Standard #11 (PKCS #11) interface. PKCS #11 is a platform-independent API that defines a standard way to interact with cryptographic tokens and HSMs.

The PKCS #11 interface allows applications to:

  • Generate and store cryptographic keys on the HSM
  • Perform signing and verification operations using keys stored on the HSM
  • Manage key attributes and access controls
  • Execute cryptographic operations without exposing private keys

Red Hat Trusted Artifact Signer supports PKCS #11 HSM integration for the following components:

  • Fulcio certificate authority signing key
  • Certificate Transparency log signing key

By storing these signing keys in an HSM, organizations can ensure that the critical private keys for their signing infrastructure remain protected by hardware-based security controls and never exist as files on disk. HSMs provide several security advantages for cryptographic operations:

Physical security
Keys are stored in tamper-resistant hardware that physically protects against unauthorized access. Many HSMs include tamper detection and response mechanisms that erase keys if physical tampering is detected.
Cryptographic operations in hardware
All cryptographic operations using the stored keys occur within the HSM itself. The private key never leaves the device, reducing the attack surface.
Compliance and certification
Many HSMs are certified to meet regulatory and industry standards such as FIPS 140-2 Level 2 or higher, helping organizations meet compliance requirements.
Key lifecycle management
HSMs provide secure key generation, storage, rotation, and destruction capabilities within the protected hardware environment.