Azure Project Tessera Open-Sources Integrated HSM

Introduction

Microsoft has unveiled Project Tessera, the next evolution of Azure Integrated HSM, as a fully open-source initiative. Announced at the OCP Global Summit, the project is designed to strengthen hardware-based key protection while helping the industry prepare for AI-driven attacks and the transition to post-quantum cryptography.

For IT and security teams, this matters because keys and credentials remain some of the most critical assets in any environment. Compromise at this layer can enable impersonation, signing abuse, and broader infrastructure attacks.

What’s new with Project Tessera

Project Tessera expands Azure’s integrated HSM model into an open ecosystem with contributions from Microsoft, Marvell, Oracle, and OCP.

Key announcements include:

• Open-source release of the integrated HSM architecture, specifications, protocols, drivers, software, firmware, and reproducible build environments
• A roadmap toward fully open-source silicon implementation
• Focus on FIPS 140-3 Level 3 key protection across the key lifecycle
• Built-in support for post-quantum cryptography to help organizations prepare for future cryptographic migration
• Demonstrated interoperability between Tessera Integrated HSM and Marvell LiquidSecurity 2 HSM

Microsoft says Tessera builds on lessons learned from deploying Azure Integrated HSM at scale and follows the collaborative open model used in Caliptra.

Why this matters for administrators

Traditional centralized HSM deployments can introduce latency and operational complexity because cryptographic operations traverse the network. That often leads to risky workarounds such as:

• Caching keys outside the HSM
• Exporting wrapped keys for external use
• Using software-held keys to reduce latency
• Relying on proprietary protocols that limit interoperability

Project Tessera is intended to reduce those anti-patterns by bringing cryptographic operations closer to workloads while keeping keys protected inside the HSM boundary.

For Azure and security administrators, the biggest implications are:

• Better alignment with zero trust and hardened key management practices
• More flexibility in hybrid and heterogeneous HSM environments
• Improved readiness for post-quantum migration planning
• Greater transparency through open standards and open-source components

Next steps

Organizations that manage sensitive signing, identity, or encryption workloads should:

1. Review current HSM architectures for key-management anti-patterns
2. Evaluate post-quantum cryptography requirements in long-term security roadmaps
3. Monitor the Tessera Integrated HSM GitHub for specifications, software, and hardware updates
4. Assess whether open, interoperable HSM models could reduce operational risk in existing environments

Project Tessera is still evolving, but it signals Microsoft’s broader push toward open hardware security standards that could influence future Azure and enterprise security architectures.