Cloud Kms Software Vs Hsm Isolation Attestation

What Cloud HSM and Software Keys Are in Cloud KMS

Google Cloud Key Management Service (Cloud KMS) provides cryptographic key management across multiple protection levels. Keys configured with the software protection level (SOFTWARE) run on standard production server infrastructure, whereas keys configured with the hardware security module protection level (HSM) operate inside dedicated, tamper-resistant FIPS 140-2 Level 3 validated hardware security modules.

How Cloud HSM Meets the Security and Compliance Requirements

• Hardware Isolation & Key Generation: When a hardware-backed key is requested, the Cloud KMS API delegates creation directly to an HSM partition. Plaintext key material is generated inside the HSM boundary using hardware random number generators and remains within the cryptographic boundary during all cryptographic operations (such as wrapping, unwrapping, and signing).
• Non-Extractability: Cloud HSM keys are stored in the KMS database wrapped with location-specific or instance-specific regional wrapping keys. They can only ever be unwrapped inside an HSM partition, preventing host operating systems, hypervisors, or Google operators from inspecting unencrypted key material.
• Cryptographic Attestation: For every generated or imported key, Cloud HSM produces a signed attestation statement. This statement includes key attributes (including the 0x0163 creation origin and non-extractability flags) and is cryptographically verifiable using certificate chains rooted in both Google and the HSM manufacturer (Marvell LiquidSecurity).

Key Capabilities of Cloud HSM

• Tamper Resistance: Built-in physical and environmental tamper-detection mechanisms compliant with FIPS 140-2 Level 3.
• Manufacturer Root of Trust: Enables third-party compliance verification that the hardware and firmware are authentic and running in FIPS mode.
• Unified API: Exposes the exact same KMS management and data plane APIs (CryptoKeys, CryptoKeyVersions) as software keys, requiring zero application logic redesign.
• Secure Key Import: Allows on-premises keys to be imported directly into HSM partitions with an attestation verifying that the wrapping key was generated inside an HSM.

Why This Is Optimal

Software-backed keys provide robust encryption at rest managed across Google production fleets, but they execute operations in host RAM using software cryptographic modules (such as BoringCrypto) and do not produce hardware-rooted cryptographic attestation statements. Only Cloud HSM provides the physical isolation, strict non-extractability enforcement, and dual-rooted attestation required by stringent regulatory standards.