Researchers at UC San Diego and France's Institute for Research in Computer Science impersonated a hardware security module—a tamper-resistant device that stores private keys and signs on request—without ever pulling the key out of it. They detailed the attack in a paper submitted to the IACR Cryptology ePrint Archive on September 20.