Today · October 13

Marvell, Microsoft, Oracle start an HSM spec; no text exists

Marvell, Microsoft and Oracle formed a working group at the open-hardware group OCP to write an open spec for a hardware security module built into the server, with a first draft targeted around this week's OCP summit. The three companies' joint press release says most servers today "rely on network-attached hardware security modules (HSMs) or software-only key management". That means key operations travel over the network to an external HSM, or rely on software alone. The working group is to define an open spec "embedding a hardware security boundary, key vault and attestation chain directly into the server" (Marvell press release, 2026-10-13). A quote from Mark Russinovich, CTO of Microsoft Azure, ties the motive to post-quantum cryptography. Our reading: this is the second spec around this week's OCP summit drafted with a large cloud buyer at the table. The first was the grid spec requiring data centers to stay connected during grid faults, which we covered on October 13. The two specs do not yet amount to a trend. So far there is a working group and a schedule, with no spec text and no purchase commitments. Google, AWS and Meta are not on the list. Our guess: Marvell sells security chips, and an open spec could widen its market. The things to watch are when the spec text appears and whether Google, AWS and Meta join. How we checked →

Concept illustration: down the left side are four stacked panels lettered "OCP", "MARVELL", "MICROSOFT" and "ORACLE"; the first three each have a small symbol beside the lettering, and the last shows the word twice, once in red and once in black. On a long table in the centre sits an opened red server chassis with its lid swung out to the left, showing a circuit board with chips and rows of slots; a person in a brown jacket with a lanyard badge leans over it with both hands on its edge, while a second person dressed in black with a lanyard badge types on a laptop at the right end of the table.

Source and checks

This item ran in the brief of Oct 14, 2026, alongside 14 other items. How we checked it, the quote checks and what was still missing that day are on that issue's How we checked page.

Cite this item

SecondSource (2026). "Marvell, Microsoft, Oracle start an HSM spec; no text exists." https://secondsource.io/en/news/2026-10-14-4/. Accessed access date.