Glossary

A short guide to the terms used across HSMAttest. See the Documentation Map for detailed explanations.

HSM - Hardware Security Module

A protected hardware environment for holding cryptographic secrets and enforcing permitted operations.

Attestation

Evidence about a workload and its execution environment, verified before access is allowed.

Confidential Computing

Technology that protects data in use within a protected execution environment.

Enclave

A protected execution environment in which a confidential workload runs.

Master secret

A root secret held in the HSM and used to derive more limited keys.

Derived key

A key produced from a master secret for a defined purpose, scope or lifetime.

Workload whitelist

The set of workloads approved to perform particular HSM operations.

Governance

Rules and controls defining which actors may perform which actions on the HSM core and its contents.

Blast radius

The extent of data and operations affected by a compromise.

CCHSM

The deliverable implementation components described by the HSMAttest architecture.

ARV - Attestation Request Verifier

The component to which the HSM delegates attestation verification, shown in the architecture and operational diagrams.

ESO - External HSM Storage Object

An externally stored object encrypted with an ESO Storage Key, usable by HSMs holding the same storage key.