HSM Crypto: Hardware Security Modules in Custody and Payments

PIN checks and chip card transactions run on keys held in HSMs at card issuers and payment processors. The PCI Security Standards Council sets the rules in its PTS HSM standard, which covers the whole life of the device. PCI-recognized laboratories test each device, and the council publishes a list of the approved ones. Version 4.0 covers card verification, PIN processing, chip transaction processing, card personalization and key loading, and added an approval class for cloud HSMs sold as a service, as Help Net Security reported.

The page on PCI DSS 4.0 covers the data security rules that apply around these devices.

In crypto custody the HSM keeps private keys non-exportable and signs inside the device. Only the signature leaves it, so an attacker on the server cannot copy a key file. Staff can only request signatures, and the custodian logs and rate-limits those requests, as the BIT knowledge hub on HSMs describes. The same source explains the NIST standard FIPS 140, which grades devices from Level 1 to Level 4, and names Level 3 or 4 as the usual choice of institutional custodians.

The key management guide of Ripple Custody states that every HSM it supports meets at least FIPS 140-2 Level 3. It names the Swiss vendor Securosys as available case by case and lists rented cloud instances such as AWS CloudHSM as an option. The page on crypto custody in Germany covers the license a custodian needs.

Multi-party computation is the alternative. An HSM keeps one key in one hardened device. An MPC wallet splits the key into shares held in several places, so no single device or person has all of it. Ripple Custody lets the client choose HSM or MPC per vault. The two differ in recovery: HSM backups are physical, for example smart cards, and need a secure offline procedure, while MPC shares can be reshared online.

A move to post-quantum cryptography also runs through the HSM, since the device has to support a new algorithm before a bank can sign with it. The page on cryptographic agility covers that migration.

Finance Loop covers the key layer of digital assets on its pages on crypto custody, MPC wallets, account abstraction and post-quantum cryptography in finance. Finance Loop events in Frankfurt bring together people from banks and custodians who work on tokenized money and securities.

A certified hardware device that generates and stores the private keys of a crypto custodian or exchange and signs transactions inside the device, so the keys never exist in plain form outside it.

A hardware wallet is built for one person who holds the device and the seed phrase. An HSM is built for an institution: it is certified under FIPS 140 or PCI PTS and can require several people to approve a signature.

An HSM approved under the PCI PTS HSM standard for card and PIN processing, such as PIN checks, card verification values and the personalization of new cards.

Neither is safer in general. An HSM protects one key in certified hardware, and MPC removes the single place where the key exists. The choice depends mostly on how keys are recovered and what the supervisor requires. Ripple Custody offers both.