IT lexicon › Security › SmartCard-HSM

SmartCard-HSM

Security På svenska → Updated: 2026-10-14

A smart card from Germany's CardContact that does most of what an HSM does, at a fraction of the price, on a chip the size of a fingernail.

The card generates and stores RSA and EC keys that never leave the chip, and is accessed through PKCS#11 and OpenSC. That makes it useful for small certificate authorities, code signing and SSH keys – jobs that don't justify a rack-mounted HSM but also shouldn't live in a file on disk. The Nitrokey HSM is the same technology in a USB stick.

Its most thoughtful feature is backup. Keys can be exported encrypted under a device key, the DKEK, which can itself be split into shares held by several custodians, optionally with a threshold. It is a key ceremony in miniature. Capacity and speed are modest, naturally: one card manages a handful of signatures per second, not a bank's worth.

← Back to the lexicon