Skip to main content

Layer 0 (L0) - Hardware Crypto Boundary

Objective​

Provide a physically and logically protected boundary for key storage and sensitive operations that must occur in hardware. Typical devices include HSMs, TPMs, smart cards, and other validated hardware modules.

Responsibilities​

  • Protect keys at rest inside the module boundary
  • Provide true random number generation and approved DRBGs
  • Perform sensitive operations such as unwrap, sign, and key derivation when required by policy
  • Execute power up and conditional self tests and enforce error states

Common components​

  • Network HSMs, PCIe HSMs, embedded TPMs
  • Hardware backed key stores in cloud or on premises
  • Hardware entropy sources, sensors and tamper evidence

Implementation guidance​

  • Define and document the hardware boundary. Reference the module certificate and Security Policy
  • Use approved mechanisms for key entry and output. Enforce separation of roles
  • Bind hardware identities to platform attestation used by L7

Validation and evidence​

  • Reference CMVP certificate number and Security Policy
  • Capture initialization procedures, self test logs, error handling, and tamper response
  • Record inventory and serials for devices in scope

Common pitfalls​

  • Assuming a device is validated without checking the exact model, firmware, and certificate
  • Operating in a configuration that is outside the Security Policy
  • Mixing hardware and software keys without documented controls

Relationship to other AFIPS Layers​

AFIPS Layer 0 Call Map
FromToWhy this edge existsTypical operationsEvidence
L2L0Hardware backed keys or RNG are mandatedKeygen, unwrap, sign in HSM or TPM.HSM audit logs, module SP references, serials
L7L0Generate and hold sensitive roots in hardwareRoot CA keys, KEKs.Dual control procedures, device inventory