HSM & Cryptography

HSMs (Thales, Utimaco) generate and store keys in tamper-proof hardware. Used for PIN translation, EMV ARQC/ARPC verification, key exchange (TR-31), and TLS key protection. Keys never leave HSM in plaintext.

// HSM operations (PKCS#11 / vendor API)
// PIN block translation
hsm.translatePin(
  encryptedPinBlock,  // From ATM/POS
  sourceKeyId,        // Zone PIN Key
  destinationKeyId    // Issuer PIN Key
);

// EMV ARQC verification
VerifyResult result = hsm.verifyArqc(
  masterKeyId,
  pan, atc, unpredictableNumber,
  arqc, amount, currencyCode
);

// Key ceremony — dual control
// 1. Generate key in HSM
// 2. Split into components (2-of-3)
// 3. Load to production HSM under ceremony
// 4. Never export plaintext key