Secure key hardware that keeps up with change.
Coming soon: Arcrix™ HSM, secure key hardware you can upgrade one function at a time, while the rest keeps running.
The hardware guarding your keys was built to stay the same.
An HSM is secure hardware that protects encryption keys. Most were designed around a fixed set of methods, meant to last the life of the device.
Why that’s now a problem
- Cryptographic methods are now retired on a schedule, and NIST has published new quantum-safe standards.
- Even reprogrammable hardware often has to pause everything it does to change one thing.
- Changing one function while the rest keeps running, which the industry calls cryptographic agility, has to be designed in from the start.
Change one part while the rest keeps working.
One protected core coordinates several working parts. When a method changes, only the part doing that job pauses. The others keep serving.
How it works
- Each working part keeps its connections and safeguards. Only the piece that does the mathematics is swapped.
- A new method arrives as a matched pair, the hardware and its instructions, and the two are switched on together.
- The device can put more of itself behind the methods you use most, instead of holding space for ones sitting idle.
- The same design is meant to scale from a compact module to an enterprise system.
For technical evaluators
- Built on an FPGA with partial reconfiguration: one region is reprogrammed while the rest of the chip keeps running.
- A single RISC-V control core coordinates every part. The parts themselves have no processors.
- An enterprise configuration is designed with eight parallel working parts on one chip.
- Each capability is a hardware tool plus an approved recipe. Changes are planned events; nothing is reconfigured per request.
Every new function is checked before it runs.
A newly loaded function doesn’t run until it’s complete and checked. Until then, the part it belongs to stays out of service.
- ApprovedAn approved function, not just any file
- UnalteredExactly as it was approved
- Meant for this deviceAnd for this working part
- MatchedHardware and instructions belong together
What the device keeps track of
- It records what is running where, and which approved version, so an outdated or unapproved combination can’t be switched on.
- If one part fails, it is isolated and recovered without exposing the work of the others.
Your keys stay inside one boundary, even during change.
Everything that handles your keys sits inside one chip, so there are fewer connections to defend.
Why that matters
- While your keys are in use, they don’t travel across the board between chips.
- Changing a function leaves the security boundary as it was.
- The boundary is drawn so the finished product can be submitted for FIPS 140-3 testing, the US and Canadian standard for cryptographic modules. Arcrix™ HSM is not certified today.
Randomness, quantum‑safe cryptography and key protection, in one design.
Arcrix™ HSM is being built in three stages, each resting on the one below.
Stage 1In development
Randomness from hardware
Keys are only as strong as the randomness behind them. Arcrix™ HSM draws its random numbers from a physical source in the hardware, and is planned to offer that randomness to your applications over a secure connection.
Stage 2In development
Quantum-safe cryptography in hardware
NIST’s new quantum-safe standards run in dedicated hardware, alongside the methods you use today, so your move can be gradual rather than a single cutover.
For technical evaluatorsML-KEM, ML-DSA and SLH-DSA, with SHA-3, SHAKE and AES-256. Designed to resist attacks that read secrets from timing or power use; not yet tested.
Stage 3Planned
Key vault and key management
An on-premises vault for quantum-safe keys, with key management planned to connect to the secrets and workloads you already run, on your terms for where keys live and who controls them.
What’s true today, and what’s still open.
Where it stands
- Arcrix™ HSM is being engineered now, in India, on our own core technology. It isn’t available yet.
- It’s planned to be manufactured in India.
- No part of it is certified, or ready for certification, today.
What we don’t claim yet
- Performance figures, until there are real measurements.
- Compatibility with other hardware, until it’s validated.
What we work out with you
- How it fits alongside the key hardware and certificate systems you run today.
- Which form suits you: a card for your servers, a network appliance, an embedded module or a rack system.
Integrated, never locked in.
Arcrix™ Platform and Arcrix™ HSM work together, and neither requires the other.
Arcrix™ Platform tells you what to change. Where hardware is the right place for that change, Arcrix™ HSM is one way to make it.
Help shape Arcrix™ HSM.
Co-development and national-programme conversations are welcome.