Exercise 3: What a Compromised Host Can Still Do to a Software-Stored Key vs. an HSM-Stored Key — Possible Solution
====================================================================

CASE (a) — signing key encrypted at rest, inside a software-based
cloud KMS running on a general-purpose server:

If the attacker fully compromises the HOST OPERATING SYSTEM, they gain
the same level of access the KMS software itself has -- including,
critically, whatever is needed to decrypt the key when the KMS process
itself needs to use it (the encryption key protecting the key at rest
has to be accessible to SOMETHING running on that host, or the KMS
software couldn't function at all). An attacker with full OS-level
compromise can typically intercept the key at the moment it's
decrypted into memory for use, extract it directly from process
memory, or manipulate the compromised software to hand over the raw
key material outright. Once extracted, the attacker now holds the
actual private key itself, permanently and independently of the
compromised host -- they can sign anything they want, anywhere, at
any time in the future, even after the original compromise is
detected and fixed.

CASE (b) — signing key stored inside a dedicated HSM:

Per this chapter's own description, the private key NEVER leaves the
HSM in plaintext form at all -- cryptographic operations happen
INSIDE the device itself. Even with full compromise of the host
operating system, the attacker does not gain access to the host's own
memory or disk where the raw key would need to exist for case (a)'s
attack to work, because the raw key was never present there in the
first place. The most an attacker with host-level compromise can do is
REQUEST operations from the HSM (for example, "sign this data") for as
long as the compromised host retains legitimate access to make such
requests -- which is a real risk, but a fundamentally more limited one:
it stops the moment the compromised host's access is revoked, and it
never yields the actual key material itself for the attacker to walk
away with and use independently, permanently, and undetectably.

The core difference:

In case (a), a full host compromise can result in PERMANENT,
INDEPENDENT possession of the actual key. In case (b), a full host
compromise can at most result in TEMPORARY, DEPENDENT ABUSE of the
key's capabilities, ending the moment host access is cut off -- the
key itself was never actually exposed to be stolen.

WHY THIS WORKS AS AN ANSWER
------------------------------
This directly applies the chapter's own stated distinction --
"even a fully compromised host system... still cannot extract the
private key, only request operations using it" -- to the specific
comparison the exercise asks for, making explicit exactly WHY that
distinction matters in practice: it changes an attacker's outcome from
permanent key theft to temporary, revocable operational abuse, which
is the concrete security benefit HSMs provide over software-only
storage even when both approaches encrypt the key at rest.