Microsoft announced Project Tessera with participation from Marvell, Oracle, and OCP. It extends Azure Integrated HSM through open specifications, protocols, software, and firmware. A fully open silicon implementation is described as a further direction, not a completed milestone. Microsoft Azure official announcement
An HSM protects cryptographic keys and performs cryptographic operations. Publishing a design, completing a certification, and offering a deployable product are separate milestones.
On this page
An HSM protects a key while performing operations with it
A private signing key stored as an ordinary file can be copied by someone who gains sufficient file access. An HSM keeps keys inside a protected boundary and performs requested cryptographic operations. The application can request a signature instead of receiving the private-key file. Whether a particular key is exportable still depends on its policy and the product configuration.
Key protection does not remove the need to authorize use. An attacker might be unable to copy a key yet still possess permission to request an unwanted signature. Treat prevention of key extraction and approval of cryptographic operations as separate controls. Record who requested each sensitive operation and for what purpose so that hardware protection is supported by usable audit evidence.
Why placing cryptography closer to the workload matters
Calling a remote HSM creates dependencies on the network and the remote service. Copying keys into software to avoid latency or availability problems can weaken the original protection boundary. The integrated approach aims to place cryptographic operations closer to the workload while keeping the keys within protected hardware, rather than solving performance concerns by moving secrets outside that boundary.
Open implementation and protocol material gives reviewers more to inspect, but available source does not establish that deployed firmware and hardware match it. Evaluate reproducible builds, firmware updates, product support, and certification for the actual configuration. Connecting those pieces is how transparency becomes operational evidence rather than simply a property of a source repository.
Recovery is more than backing up a file
A hypothetical code-signing service might separate key creation from routine signing and require additional approval for replication or recovery. Check not only that recovery succeeds, but that it cannot restore a key to an unauthorized device. Define who performs recovery after hardware failure and how the former device is retired, while retaining the records needed to explain the key’s lifecycle.
Post-quantum planning also involves certificates, clients, and interoperability with other HSMs, not only algorithm names. Existing cryptography may remain necessary during a transition. Separate Tessera’s available materials from its longer-term roadmap, then evaluate the configurations you can actually obtain against your key creation, use, recovery, and retirement requirements.
Include these in an HSM evaluation
- Separate available implementations from roadmap commitments.
- Identify who approves key generation, replication, deletion, and recovery.
- Verify certification and product support for the exact configuration.
An open implementation creates opportunities for review and interoperability. It does not automatically establish that a particular certification has already been awarded.
Announcement reference date: 2026-10-13 · Checked: October 24, 2026
.jpg){kind=link}