IT lexicon › Security › Payment HSM

Payment HSM

Security På svenska → Updated: 2026-10-14

An HSM built for card payments, handling PINs and card cryptograms without a single key ever leaving the box.

A general-purpose HSM usually speaks PKCS#11 and signs certificates. A payment HSM instead speaks a command language over TCP in which every operation is a banking function: verify a PIN, translate a PIN block between zones, check a card cryptogram from an EMV terminal, derive keys with DUKPT or wrap keys in TR-31 blocks. The relevant certification is PCI PTS HSM.

The family tree starts with Mohamed Atalla's "Atalla Box" in the 1970s, which protected PINs on ATM networks. Today the market is dominated by Thales payShield and Utimaco's Atalla line. The commands are two letters long and the manuals are under NDA, which says something about the industry's attitude to openness.

← Back to the lexicon