HSMs, KMS, and hardware roots of trust
Learn what it means for a key to be non-exportable, and why that changes the shape of an attack.
Every scheme so far assumes some key must ultimately be protected. A hardware security module is the answer: a tamper-resistant device that generates keys internally and performs operations with them, without ever releasing the key material.
The critical property is non-exportability. You do not ask an HSM for the key. You send it data and ask it to sign or decrypt, and it returns the result.
This changes what an attacker gets. Compromise an application server holding a key file and they take the key: permanently, silently, and they can use it anywhere. Compromise a server that can call an HSM and they can use the key while they hold that access, but they cannot take it with them, and every use is logged.
- Generation: the key is created inside the boundary and never exists outside it.
- Use: sign, verify, wrap, unwrap are performed on the device.
- Attestation: the device can prove a key was generated in hardware.
- Audit: every operation is recorded, so use is observable even when authorized.
A KMS is the managed service wrapper around this: an API for creating keys, defining who may use them for what, and rotating them, with the private material staying inside a hardware boundary. Key versions matter: rotating creates a new version while old versions remain available for decrypting old data.
An HSM protects against key theft, not key misuse. If an attacker can call the API with valid credentials, the HSM will faithfully perform the operation. Non-exportability limits what they can steal, not what they can do while they have access.
Combine this with the previous lesson and the hierarchy appears: the KEK lives in the HSM and never leaves; DEKs are wrapped by it; the plaintext data is encrypted by the DEKs. The root of trust is hardware, and everything above it is derived.
Check your understanding
3 questionsWhat does non-exportability actually prevent?
Why keep old key versions after rotation?
In the envelope hierarchy, which key lives in the HSM?