Skip to content
AI Security

Lesson 7 of 7 · 6 min read

Hardware Roots of Trust and Key Custody

TPMs support platform identity and measured boot; TEEs, secure enclaves and HSMs can protect non-exportable keys and enforce usage policies. Their guarantees depend on the hardware, configuration and attacker access. Separate resistance to key extraction from authority to use a key. Add narrow caller permissions, authentication or approval where needed, and operation logs. Attestation lets a verifier evaluate key provenance and measured platform state against policy.

Reviewed By the AISecurityInterviews editorial team
free sign-in, no card required

Practise it as an interviewer asks it

Cryptography, PKI & TLSShould all data be encrypted at rest? Which threats does it address, and which does it not?Cryptography, PKI & TLSDesign key management with envelope encryption and a KMS for a multi-tenant service.Cryptography, PKI & TLSYou are reviewing code that implements its own encryption. What do you look for?Cryptography, PKI & TLSWhen do you need a hardware security module rather than a cloud KMS, and what does each protect against?Cryptography, PKI & TLSDesign encryption and key custody for high-value model weights.Systems, OS & Memory SafetyExplain Spectre and Meltdown at a conceptual level. Why do speculative-execution side channels matter for cloud and multi-tenant systems?

Course lessons that teach this

Security Fundamentals, From Packets to PlatformsSeparate accepted boot code from runtime assurance30 minSecurity Fundamentals, From Packets to PlatformsInventory credential authority and rehearse its loss30 min

Related lessons

Public-Key Cryptography and Key ExchangePKI and Certificate ChainsTrusting a Mobile Client: Pinning, Tamper Detection and AttestationProtecting Data on Mobile Devices