Hardware Security Modules

A hardware security module is a physical device dedicated for performing cryptographic computations such as key management, encryption and decryption.

Because of its crypto-only use, its hardware is designed to optimise all the operations it needs to do - without needing to worry about operation versatility (which would add more bloat and probably security vulnerabilities into the design)

What do I mean by this?

Consider a program that performs commands depending on the user input

(Written in Python for readability)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
# stub functions
def functionOne():
  pass # stub

def functionTwo():
  pass # stub

def functionThree():
  pass # stub

# program
message = input("Enter a message: ") # Enter a message: <enterYourMessageHere>
  if message == "dolphin":
    functionOne()
  elif message == "squirrel":
    functionTwo()
  elif message == "penguin":
    functionThree()
  else:
    pass # stub

Let’s say that message will ALWAYS be "penguin".
We wouldn’t have a need for functionOne and functionTwo, and we can remove it from the code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
# stub functions
def functionThree():
  pass # stub

# program
message = input("Enter a message: ") # Enter a message: <enterYourMessageHere>
  if message == "penguin":
    functionThree()
  else:
    pass # stub

The program here - evidently - does less, but!
If we had to physically implement this code on hardware - it would mean that we would need less physical circuit components, and could optimise the functionality to let it do what it does to the best that it could do :)

In the same way, by writing code (and creating a device) that specifically performs one task (or one category of tasks) - the device would be able to perform cryptographic operations much more efficiently.

You could consider a hardware security module as a sort of blackbox machine.
You give it an input, and it gives you an output.
We don’t need to know how exactly it works, and we don’t need to in order to use it.
Being external to our machine and our code, it provides both a physical and logical layer of separation.

Often (if not always?), these security modules are built from the ground up - completely from scratch.
It may seem redundant to ‘~~reinvent~~ reimplement the wheel’, but knowing how many vulnerabilities have been exposed in processors; it’s a safer bet.

Contents