HSM vs KMS for Crypto Signing Keys

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Use a cloud KMS for secp256k1 signing when cloud IAM can be your control plane, and a dedicated HSM for single tenancy, your own admin quorum or missing curves. Either way, approve transactions above the key store.

Watch: HSM vs KMS for Crypto Signing Keys 1:46

Video transcript

Cloud KMS or dedicated HSM? Use KMS when cloud IAM can be your control plane, and an HSM for single tenancy, your own admin quorum or missing curves.

Both keep keys in certified hardware. A KMS is a provider fleet governed by cloud permissions. A dedicated HSM is single tenant, with users and roles you manage.

Check curves first. Bitcoin and Ethereum need secp256k1, and EdDSA chains need Ed25519. AWS KMS supports both. Google and Azure each have gaps.

Three things break. AWS returns DER signatures without the recovery value. Ethereum rejects high S values, so check low S. And FIPS mode can block curves you need.

Single tenancy changes who can administer the HSM. It does not change who can call it.

So approve transactions above the key store. A policy service should decode each transaction, check limits and allowlists, and collect approvals before it calls Sign.

AWS KMS costs one dollar per key per month, plus requests. No signing latency is published, so measure from where your signer runs.

MPC splits keys into shares, but its policy often runs in vendor software. Consider KMS or HSM for limited automated signers, MPC for hot wallets spanning many chains, and multisig for provable approvals.

Read the full guide, or talk to Guardian. Our assurance pilot assesses where your keys live and who holds what share.

Every hot wallet, signing service and bridge relayer keeps its key somewhere. Most teams choose between a cloud key management service (KMS) and a hardware security module (HSM).

Both can keep the key inside certified hardware. They differ in who runs that hardware, which curves it supports, who approves its use and what it costs.

We read the current documentation for AWS, Google Cloud, Microsoft Azure and Thales Luna in November 2026. Here is how they compare for blockchain signing.

HSM vs KMS at a Glance

	Cloud KMS	Dedicated HSM
Who runs it	The provider; you call an API	You, or a provider on hardware reserved for you
Tenancy	The provider's HSM fleet	Single tenant
Who controls use	Cloud IAM and key policies	HSM users and roles you manage
Curves	A fixed list per service	Usually wider; FIPS mode can narrow it
Scaling	Request quotas, adjustable	The capacity you provision
Cost	Per key per month, plus per request	Per HSM per hour, or hardware you buy
Good fit	Automated signers inside one cloud	Keys you must administer yourself

Curve Support for Blockchains

Bitcoin and Ethereum sign on the secp256k1 curve. AWS calls that curve "required for Bitcoin, and other cryptocurrencies".

NIST's SP 800-186 (February 2023) allows secp256k1 "for blockchain-related applications". Chains that sign with EdDSA need Ed25519.

Service	secp256k1	Ed25519	FIPS level stated
AWS KMS	Yes	Yes	140-3 Level 3
AWS CloudHSM	Yes	hsm2m.medium in non-FIPS mode only	140-2 or 140-3 Level 3, FIPS mode
Google Cloud KMS	HSM protection level only	Software protection level only	Cloud HSM: 140-2 Level 3
Azure Key Vault Premium	Yes (P-256K)	Not listed	140-3 Level 3 on HSM Platform 2
Azure Managed HSM	Yes (P-256K)	Not listed	140-3 Level 3
Thales Luna 7	Listed	Listed; FIPS-approved from firmware 7.8.9	Ask for the certificate

Three things that break

Signature format. AWS KMS returns DER-encoded ECDSA signatures with only r and s. For Ethereum, your signer must also work out the recovery value (v).
Low-S. Ethereum rejects transaction signatures with s above secp256k1n/2 (EIP-2). Google says its secp256k1 signatures are already low-S. AWS's Sign reference makes no such promise, so check s.
FIPS mode. A CloudHSM cluster's mode cannot change after creation. Ripple Custody's Luna guide requires HSM policy 12, "Allow non-FIPS algorithms".

Check the curve, the mode and the protection level before you design around a service.

FIPS 140-3 Levels and Tenancy

FIPS 140-3 defines "four increasing, qualitative levels of security". The cloud HSM tiers above state Level 3, except older Azure vault keys on HSM Platform 1 (FIPS 140-2 Level 2).

Read the certificate, not the brochure. NIST moved all FIPS 140-2 certificates to its historical list in September 2026, though it still supports their use in existing systems.

Next, tenancy.

AWS KMS runs on "a distributed fleet" of HSMs. AWS says it is designed so that no one, including its employees, can retrieve your plaintext keys.
AWS CloudHSM gives you a single-tenant cluster in your VPC, with authentication "independent from AWS".
Azure vaults are multi-tenant. Managed HSM is single-tenant, with a security domain Microsoft cannot recover.
Google offers multi-tenant Cloud HSM, and a single-tenant option in a subset of locations.

Single tenancy changes who can administer the HSM. It does not change who can call it.

Approval Policies and Quorum

In a cloud KMS, permissions are the policy. A caller needs kms:Sign on the key; key policies can limit principals and signing algorithms.

KMS signs the message or digest it receives. It does not decode a transaction or check where funds are going.

In these HSM services, quorum guards administration and recovery, not each signature:

AWS CloudHSM: 2 to 8 approvers for HSM user management.
Azure Managed HSM: a Shamir-split security domain; Microsoft recommends a quorum of at least 3, up to 10.
Google Single-tenant Cloud HSM: quorum approval, with control keys, for administrative operations.

So transaction approval belongs above the key store. A policy service should decode each transaction, check limits and allowlists, and collect approvals before it calls Sign.

Or put approval onchain, in a multisig. Either way, lock down the path to Sign. See private key management for digital asset platforms.

Never park a signing key in a secrets manager, which hands it to your app. See secrets management for crypto companies.

Latency, Throughput and Cost

AWS KMS handles every Sign as an API call over TLS. The default quota is 1,000 ECC requests per second per account and Region, adjustable.
KMS pricing: $1 per key per month. AWS's own example prices ECC signing at $0.15 per 10,000 requests.
Free tier: AWS excludes asymmetric operations such as Sign.
AWS CloudHSM charges an hourly fee for each HSM until you terminate it, with no upfront cost.
Your own HSMs mean buying appliances and staffing ceremonies, backups and firmware updates.

We found no published signing latency for these services. Measure from where your signer runs.

Where MPC Fits

MPC splits a key into shares held by separate parties that sign together. No single device holds the whole key.

NIST says threshold schemes enable "a secure distribution of trust" in cryptographic operations, including signatures. It published the final version of its first call for multi-party threshold schemes on January 20, 2026.

With MPC, approval policy often runs in the vendor's software. Test that software like any other signing service.

Designs to consider:

KMS or HSM keys for automated signers with tight limits.
MPC for hot wallets that must span many chains.
Multisig or HSM-backed cold keys where approvals must be provable.

Compare the options in multisig vs MPC wallets. However you generate keys, record it in a key ceremony.

How Guardian Helps

The Digital Asset Assurance Pilot includes an architecture assessment of custody and key ceremony.

It covers where the keys live, who holds what share and what a quorum actually requires in practice.

Its offchain pentests target the consoles, APIs and signing services that can reach your keys.

Our regulatory assessments level key management against the CryptoCurrency Security Standard (CCSS), from evidence rather than interviews.

Frequently Asked Questions

Is AWS KMS good enough for crypto signing keys?

It supports secp256k1 and Ed25519 on HSMs validated to FIPS 140-3 Level 3. The weak point is access: anyone with kms:Sign on the key can sign whatever they submit. Pair it with tight IAM, a policy service and limits.

What is the difference between an HSM and a KMS?

An HSM is tamper-resistant hardware that stores keys and signs inside itself. A KMS is a managed service, usually backed by the provider's HSMs, controlled through cloud permissions and billed per key and per request.

Does Google Cloud KMS support Ed25519 in an HSM?

Not in its current algorithm tables. Ed25519 appears only at the software protection level, while secp256k1 appears only at the HSM level. Check the tables again before you design around either.

Is MPC better than an HSM?

They solve different problems. MPC spreads one key across parties so no device holds it whole. An HSM protects a whole key in certified hardware. Either needs a transaction approval policy above it.

Sources

Pressure test your signing architecture

Guardian's Digital Asset Assurance Pilot reviews where your keys live, who can call them and what a quorum really requires.

Talk to Guardian Explore the assurance pilot