A hardware security module protects secret keys and performs cryptographic operations inside a tamper resistant chip. In vehicles, HSMs act as a hardware root of trust in control units, so signing keys and secure boot checks do not depend on software that an attacker could read or change.
What an HSM is
An HSM is a physical device that protects and manages secrets, mainly digital keys. It performs encryption, decryption, digital signatures and strong authentication. It contains secure cryptoprocessor chips. Many HSMs can generate keys on board, store the most sensitive master keys, and back up keys outside the device only in wrapped form.
The reference article lists automotive among common uses, where an HSM acts as a hardware root of trust in vehicle control units.
Three kinds of tamper protection
- Tamper evidence: visible signs, or logging and alerting.
- Tamper resistance: making tampering difficult without breaking the device.
- Tamper responsiveness: deleting keys when tampering is detected.
FIPS 140 and Common Criteria
FIPS 140 defines four security levels, from Level 1 as the lowest to Level 4 as the highest. The article says most certified HSMs are Level 3 and a limited number are Level 4. The current version is FIPS 140-3. Common Criteria is also used, with most HSMs at EAL4 plus. Vehicle control unit security modules are not necessarily certified this way, so ask a supplier which scheme, if any, applies.
Why vehicles need one
Several vehicle security measures depend on keys that must not leak.
- Secure update checks. A unit verifies signatures on update images, and the verification key must not be replaceable.
- Message authentication. Application level checks on bus messages need shared secrets.
- Diagnostic access. A seed and key scheme as in UDS needs a secret that is hard to extract.
- Identity. A unit proving itself to the cloud needs a private key that is not just a file.
Without hardware protection, an attacker who dumps flash memory may recover every one of these.
Design questions
- Which keys live in hardware, and which still sit in plain flash?
- Is the key per unit, or shared across a fleet?
- How are keys provisioned in the factory, and who can see them?
- What happens at end of life or when a unit is replaced?
- Can the module's firmware be updated, and who signs that?
A per unit key means that extracting one key from one unit does not unlock the fleet. That single choice limits the damage of a physical attack more than most others.
Common gaps
Three gaps appear often. Keys are generated outside the factory flow and copied around. Debug interfaces stay enabled in production units. Key rotation was never planned, so a leaked key cannot be replaced in the field. Ask about all three early, since they are hard to retrofit after release.
Quick check
Does an HSM make a system secure by itself?
No. It protects keys. The surrounding design still decides who may ask it to sign or decrypt.
Sources
Last reviewed: 19 October 2026.
