HSMs: key storage and access

A hardware security module (HSM) stores keys and performs cryptographic operations within a dedicated hardware boundary.

Integration requires decisions about key access and recovery:

• Which keys are generated inside the HSM, imported or exportable?
• Which applications and operators can use them?
• How are privileged roles separated and their actions logged?
• How are keys backed up and recovered when hardware is replaced?

The guide below introduces HSMs in a PKI. The PKCS#11 note covers an interface used by applications to access cryptographic tokens.