# What is a Hardware Security Module (HSM)?

> A hardware security module (HSM) is a physical computing device that safeguards cryptographic keys and performs cryptographic operations within a defined security boundary.

- Canonical URL: https://yellowcube.eu/glossary/hardware-security-module/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Depending on its design, it may generate, store, use, wrap, unwrap, back up, or destroy keys and execute signing, decryption, message authentication, or other functions while keeping designated secret or private keys inside that boundary.

An HSM can be an appliance, an expansion card, an embedded component, or infrastructure exposed through a managed service. Applications call it through controlled interfaces, while authentication, roles, authorization rules, separation of duties, and audit records govern who can request sensitive operations.

### Key points

- **Security boundary:** Document which hardware, firmware, software, interfaces, keys, and operations are inside the evaluated boundary, along with approved operating modes and physical protections.
- **Key lifecycle:** Define generation, import, export restrictions, backup, recovery, rotation, revocation, deletion, and dual-control procedures without creating unmanaged copies of protected keys.
- **Integration and resilience:** Authenticate callers, restrict permitted operations, protect administration, monitor activity, and design capacity, redundancy, and recovery for applications that depend on the module.
- **Important limitation:** An HSM protects specified cryptographic functions; it does not make the host, application, administrator, supply chain, or key policy trustworthy. Federal Information Processing Standard (FIPS) validation applies to an exact module version, configuration, and approved mode — not automatically to a wider product, deployment, or compliance program.

### Related terms

[Cryptography](<https://yellowcube.eu/glossary/cryptography/>) · [Public key infrastructure (PKI)](<https://yellowcube.eu/glossary/public-key-infrastructure/>) · [Certificate management](<https://yellowcube.eu/glossary/certificate-management/>) · [Encryption](<https://yellowcube.eu/glossary/encryption/>) · [Secrets management](<https://yellowcube.eu/glossary/secrets-management/>)

### Sources

[NIST, Hardware Security Module (HSM)](https://csrc.nist.gov/glossary/term/hardware_security_module_hsm) · [NIST FIPS 140-3, Security Requirements for Cryptographic Modules](https://csrc.nist.gov/pubs/fips/140-3/final) · [NIST Cryptographic Module Validation Program, Validated Modules](https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules) · [ISO/IEC 19790:2025, Security requirements for cryptographic modules](https://www.iso.org/standard/82423.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.