Advancing hardware security with open-source Integrated HSM technology

Advancing Hardware Security with Open‑Source Integrated HSM

The security of cryptographic keys is a cornerstone of modern cloud and enterprise workloads. As AI accelerates attack speed and quantum computing threatens existing algorithms, the industry needs a more transparent, adaptable, and resilient hardware root of trust. Project Tessera—Microsoft’s evolution of Azure Integrated HSM—answers that call by releasing the entire HSM stack—specifications, protocols, drivers, firmware, and build environments—as open source. The initiative, built with Marvell®, Oracle, and the Open Compute Project (OCP), aims to standardize an integrated, workload‑attached HSM model that can be adopted, extended, and audited by anyone.

---

1. Why an Integrated, Open‑Source HSM?

Traditional HSM deployments sit on a separate network tier, forcing cryptographic operations to cross network boundaries. This latency drives workarounds such as exporting wrapped keys, caching keys in software, or sharing keys across domains—practices that erode the very protections a FIPS‑140‑3 Level 3 HSM provides. By attaching the HSM directly to the workload, Tessera eliminates these anti‑patterns:

• Continuous hardware protection – Keys never leave the secure boundary, even when used by compute instances.
• Reduced latency – Cryptographic calls stay local, improving performance for high‑throughput services.
• Simplified operations – A single, unified stack replaces complex network‑based key management workflows.

Open‑sourcing the design adds another layer of trust. Developers and auditors can inspect the code, verify compliance, and contribute improvements, fostering an ecosystem of interoperable hardware and software.

---

2. Building for the AI and Quantum Era

Two emerging forces reshape the threat landscape:

1. AI‑driven attacks – Automated exploit generation and credential‑theft tools increase the speed and scale of breaches, making rapid key compromise a realistic risk.
2. Quantum computing – Even modest quantum capabilities can undermine RSA and ECC signatures, accelerating the need for post‑quantum cryptography (PQC).

Tessera addresses both by:

• Supporting hybrid cryptography – Workloads can invoke classic algorithms alongside PQC primitives, enabling a smooth migration path.
• Embedding PQC in communication protocols – HSM‑to‑HSM channels use quantum‑resilient key exchange, ensuring that even the transport layer remains future‑proof.
• Providing a crypto‑agile firmware stack – The open firmware can be updated with new algorithms without hardware redesign, a crucial capability as standards evolve.

---

3. Open Collaboration and Extensibility

Project Tessera follows the collaborative model proven by Microsoft’s earlier Caliptra root‑of‑trust effort. Key aspects of the open ecosystem include:

• Public GitHub repository – All specifications, drivers, and firmware are version‑controlled and publicly accessible.
• Silicon reference designs – Early contributions include Marvell’s LiquidSecurity 2 reference, with plans for additional open‑source silicon implementations.
• Standardized protocols – The project defines interoperable partition‑cloning and resiliency‑ring protocols, allowing heterogeneous HSMs to form a unified security domain.
• Confidential‑computing extension – A minimal unikernel firmware stack runs inside AMD SEV‑SNP or similar enclaves, bringing the same key‑protection guarantees to virtualized workloads.

These assets lower the barrier for hardware vendors, cloud providers, and enterprises to adopt a consistent, auditable HSM model.

---

4. Practical Steps for Organizations

1. Evaluate workload‑attached HSM suitability – Identify services that would benefit from reduced latency and tighter key isolation (e.g., signing services, TLS termination, secret management).
2. Pilot the open‑source stack – Deploy the reference firmware on supported hardware or within a confidential‑computing enclave to validate integration.
3. Adopt hybrid cryptography – Begin using PQC‑enabled APIs alongside existing algorithms to future‑proof key‑signing pipelines.
4. Contribute back – Report bugs, suggest protocol enhancements, or share custom silicon designs to strengthen the community.

---

Closing Thoughts

Project Tessera demonstrates that hardware security need not be a black‑box monopoly. By exposing the full integrated HSM stack, Microsoft and its partners give the industry a transparent, quantum‑ready foundation for protecting the most valuable digital assets—cryptographic keys. Organizations that embrace this open model can reduce operational risk, accelerate innovation, and stay ahead of the evolving AI and quantum threats shaping tomorrow’s security landscape.