- Marvell, Microsoft and Oracle announced an Open Compute Project working group to write an open specification for a key vault built into the server.
- The companies say most servers use network-attached key devices or software-only key handling, which exposes keys. They targeted an initial draft around October 12-15; we have not confirmed its release.
- Ask your cloud and hardware suppliers where your encryption keys are held and used, and whether they plan to adopt the specification.
The question behind every encryption system
Encryption is only as strong as the place its keys are kept. A lock is easy to build. The hard part is deciding where the key lives and who can reach it. A new industry effort is about that decision.
On October 13, 2026, Marvell Technology, Microsoft and Oracle announced a working group inside the Open Compute Project (OCP). OCP is a community that designs data center hardware. The group will write an open specification for an integrated hardware security module, or HSM. An HSM is a dedicated device that stores cryptographic keys and performs operations with them. The companies are aiming at the NIST FIPS 140-3 Level 3 certification level.
How keys are handled today
The announcement describes the current picture. Most cloud and enterprise servers use network-attached HSMs or software-only key management, according to the three companies.
Each approach has a cost, they say. With a network-attached HSM, keys have to travel across the network. With software-only handling, keys sit in memory that does not meet FIPS 140-3 Level 3. In both cases, the companies say, sensitive keys are exposed to potential attacks.
Think of a bank that keeps its vault in another building. Every time a teller needs something, a courier runs between the two. The vault may be strong, but the trip is part of the risk. The working group wants the vault built into the teller's own room.
What the specification would define
The working group's charter is to define how to embed three things directly into the server. The first is a hardware security boundary. The second is a key vault. The third is an attestation chain, which is a verifiable record that the hardware and software are what they claim to be.
The companies say this would let cryptographic operations run where the data is processed. They say keys would stay inside a certified hardware boundary. They also say workload integrity could be proven cryptographically to any party that relies on it. In their telling, handling keys on the server would also be faster, easier to scale and safer for cloud workloads.
Those are the companies' own claims. The announcement gives no performance figures and names no products. It also cites no independent testing.
Why executives should care now
Cary Ussery, a senior vice president at Marvell, said an integrated HSM would help satisfy both regulatory compliance and zero-trust requirements. Zero trust means no system is trusted by default and every request must be verified. Attestation fits that idea, because a workload can show proof of its state instead of asking to be believed.
Mark Russinovich, CTO of Microsoft Azure, tied the work to AI and quantum computing. He said AI is transforming cybersecurity and quantum technology is reshaping cryptography. He said the open-source HSM should help interoperability and speed adoption of post-quantum cryptography.
For readers, the lesson is about dependency. Keys now guard AI workloads, customer data and the credentials that software uses to talk to other software. Where those keys sit is a design choice made by hardware and cloud suppliers. A shared open specification could make that choice easier to inspect and compare across vendors.
What is still unknown
This is a plan, not a product. The companies targeted an initial draft of the specification around the 2026 OCP Global Summit, held October 12-15 in San Jose. We have not confirmed whether it has been released. Version 1.0 is to follow, with no date given.
The announcement does not say which server makers will build the hardware. It does not say when cloud customers could use it or what it would cost. It also does not say how it would work with existing network HSMs.
Oracle's Pradeep Vincent said the effort aims to give the whole industry a shared base to build on. Whether suppliers actually build on it is the part that is yet to be shown.
Questions to put to your team
Start with an inventory. Which of our keys sit in software-only memory today? Which depend on a network round trip to an HSM, and what happens to performance and availability if that link fails?
Then ask suppliers. Does your cloud provider or server vendor plan to support the OCP specification once it is published? Can workload integrity be proven to our auditors with evidence, not assurances?
Finally, ask about the roadmap for post-quantum cryptography. Key storage and algorithm choice tend to be decided together.
A strong lock matters less if the key travels. This effort aims to keep the key inside the room. The specification text, once readers can examine it, will show whether it can.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Dark Reading.
