Hardware Encryption

🔑 Key Takeaway: Hardware-backed key storage (TPM, SED, HSM) reduces exposure of keys to host memory and malware when deployed and managed correctly.

Hardware encryption moves key use into purpose-built modules. Consumer endpoints often rely on TPM; high-assurance key custody uses HSMs.

Hardware encryption, such as HSM, uses dedicated hardware to encrypt data, providing robust security. Utilizing a HSM is a fairly specialized thing, but consumers are for example often using TPM.

Best practices

1. Enable TPM when available on your computer to enhance the security of hardware-based encryption.
2. Consider using self-encrypting drives (SEDs) for storage to ensure data is encrypted at the hardware level.
3. If relevant for your use case, use HSMs to securely generate, store, and manage encryption keys.

Further Reading

• Encryption overview: framework map and shared concepts
• NIST SP 800-175B: guideline for using cryptographic standards in the federal government (useful baseline references)
• OWASP Cryptographic Storage Cheat Sheet