Glossary
HSM (Hardware Security Module)
A tamper-responsive device that generates, stores and uses cryptographic keys inside a certified boundary, used for PKI, code signing, payments and key management.
A hardware security module keeps private and secret keys inside a physical and logical boundary that they never leave in the clear. Applications send data to the HSM and receive signatures, decrypted data or wrapped keys through APIs such as PKCS#11, Microsoft CNG, Java JCE or KMIP.
HSMs come as network appliances, PCIe cards, USB devices and single-tenant cloud services, and are usually validated under FIPS 140-3 (often Level 3) or Common Criteria. They add role separation, quorum authentication and audit logging around key use.