HSM and TPM - Lesson 3.5 | CompTIA A+ Core 1 Notes

The Role of Encryption in Technology

Encryption is used to protect sensitive information from unauthorized access.
Common applications of encryption include:
- Storing data on mobile phones, hard drives, and SSDs.
- Securing network communications (e.g., web server interactions).
- Transmitting data over airwaves (e.g., mobile networks).
Encryption processes are typically based on open standards and publicly documented algorithms.
Just as knowing how a doorknob lock works doesn’t grant access, understanding encryption methods doesn’t compromise security—keys are required.

Encryption and decryption rely on digital keys, which function like physical keys for locks.
To decrypt data, the correct unique key must be used.
The challenge: Protecting the encryption key itself from unauthorized access.
Solutions for key protection include:
- Trusted Platform Module (TPM) for individual devices.
- Hardware Security Module (HSM) for enterprise environments.

A TPM is a hardware-based security chip designed for cryptographic operations.
Key features of a TPM:
- Cryptographic processor: Handles encryption, decryption, and random number generation.
- Persistent memory: Stores burned-in keys created during manufacturing.
- Versatile memory: Holds temporary keys and other sensitive data.
- Security protections: Password-locked and resistant to tampering.
TPMs are either:
- Built into the motherboard.
- Installed as a separate module.
Each TPM contains a unique, system-specific key that cannot be replicated.
Common uses of TPM:
- Full disk encryption (e.g., BitLocker).
- Device authentication (ensuring a system is genuine).
- Secure boot processes (verifying system integrity).
TPMs establish a root of trust, ensuring the system’s hardware and software haven’t been altered.
TPM settings can be configured in the BIOS/UEFI under Security or TCG (Trusted Computing Group) options.

An HSM is a dedicated hardware device for managing cryptographic keys at scale.
Key features of an HSM:
- Centralized key storage: Manages keys for multiple systems (e.g., web servers).
- High-performance cryptography: Accelerates encryption/decryption operations.
- Tamper-resistant design: Protects against physical and logical attacks.
- Compliance-ready: Meets industry security standards (e.g., FIPS 140-2).
Types of HSMs:
- Enterprise HSMs: High-end devices for data centers, often rack-mounted.
- Personal HSMs: Portable devices (e.g., for cryptocurrency or individual use).
Common use cases for HSMs:
- Securing web server SSL/TLS keys.
- Managing certificate authority (CA) keys.
- Offloading cryptographic operations from software to hardware.

TPM:
- Designed for single-system security.
- Built into or added to a motherboard.
- Used for full disk encryption, secure boot, and device authentication.
HSM:
- Designed for enterprise-scale security.
- Deployed as a standalone device in data centers.
- Used for centralized key management and cryptographic acceleration.