Explain like I'm five · Security

What is an HSM?

HSMs and key management (KMS), told as a story about an iron safe whose keys never come out.

x7#q!m2x7#q!m2x7#q!m2the sealed letterswhere do I keep the real key?this one key opens them alllose the key and I can't read them; let a thief take it and he reads them all

Where do you keep the real key to the sealed letters?One key opens every sealed letter. Lose it and I can't read them; let a thief take it and he reads them all.

written on paper, in a drawera drawer anyone can opencopied itBuy two applesa key kept outside gets copied someday — and the seal means nothing

Write it on paper and leave it in a drawer, and a thief copies it.A key that lives outside the safe gets copied someday. Then the seal on the letter means nothing.

the iron safethe key never leavesBuy two applesdrop the letter in the slotx7#q!m2sealed, and handed backthe key is born inside the safe and only ever works inside

An HSM is an iron safe that makes and uses keys. The key never, ever comes out.Drop a letter in the slot and the safe seals it inside and hands it back. Even I never see the key — so no thief can copy it.

Made insidethe key is born inside the safe
Never comes outnot me, not the thief
Through the slotletter in, sealed letter out
Forced open, it breaks the keythe thief gets an empty box
force it open, and…the key destroys itself — the thief gets an empty boxthe key ledgerwhich keymadeswapletter keyspringautumnseal keylast yearthis monthstoreroom keysummerwinteron swap day: a new key, the old one retiredwhich key gets swapped when — the ledger knowsthe safe protects; the ledger manages

Force it open and it destroys its own key. The key ledger says when each key gets swapped.Even hammered open, all that is left is an empty box. And no key is used forever — on swap day a new key is made and the old one retired.

the iron safex7#q!m2the sealed letterthe castle seal (certificate)the secret-note boxpasswords live hereit does not make keysthe safe makes and uses keys; the note box stores secrets — different jobs

The safe's keys seal letters and stamp the castle's seal.The castle seal is stamped with these keys too. The secret-note box only stores passwords — it does not make keys.

In one breath

An HSM = an iron safe that makes keys inside, uses them only inside, and never lets them out. Forced open, it destroys its own key. The key ledger (KMS) manages which key gets swapped when.

Hardware Security Module: dedicated hardware that generates, stores and uses cryptographic keys without ever exporting them, and wipes them if it detects physical tampering. A Key Management Service (KMS) sits on top to manage creation, rotation, retirement and who may use each key.

When grown-ups say it

HSM (hardware security module)
The iron safe that makes keys. Keys are born inside, work only inside, and never come out.
KMS (key management service)
The key ledger. Which keys exist, who may use them, when they get swapped. Works with the safe behind it.
Key generation · storage · destruction
A key's whole life. Made, kept, and broken when done — all inside the safe.
Key rotation
Swap day. No key is used forever. A new one is made and the old one retired.
Tamper resistance
Forced open, it breaks the key. Hammer it open and all that is left is an empty box; the key erases itself.
Root key / master key
The key to the keys. The biggest key, which seals the other keys. This one above all lives in the safe.
Certificate
The castle seal. The key that stamps the seal is used inside the safe too. → the castle seal and the seal office
Secrets vs. keys
Note box ≠ iron safe. The note box hands you the password. The safe never hands you the key. → the secret-note box
Next story
Only the Names on the List →
Want another term as a picture book? Request →