In modern cryptography, keys must be kept secret. Depending on the effort that is made to  protect the key, keys are classified into the following levels: Because a secure key must be handled in a special hardware device, the use of secure  keys usually is far slower than the use of clear keys, as shown in Figure 6-1. Figure 6-1 Three levels of protection with three levels of speed GLYPH<SM590000> A  clear key  is a key that is transferred from the application in clear text to the cryptographic  function. The key value is stored in the clear (at least briefly) somewhere in unprotected  memory areas. Therefore, the key can be made available to someone under certain  circumstances who is accessing this memory area.  GLYPH<SM590000> The value of a  protected key  is stored only in clear in memory areas that cannot be read by  applications or users. The key value does not exist outside of the physical hardware,  although the hardware might not be tamper-resistant. The principle of protected keys is  unique to IBM Z. For more information, see 6.4.2, “CPACF protected key” on page 229. GLYPH<SM590000> For a  secure key , the key value does not exist in clear format outside of a special hardware  device (HSM), which must be secured and tamper-resistant. A secure key is protected  from disclosure and misuse, and can be used for the trusted execution of cryptographic  algorithms on highly sensitive data. If used and stored outside of the HSM, a secure key  must be encrypted with a  master key , which is created within the HSM and never leaves  the HSM. This risk must be considered when clear keys are used. However, many applications exist  where this risk can be accepted. For example, the transaction security for the (widely  used) encryption methods Secure Sockets Layer (SSL) and Transport Layer Security  (TLS) is based on clear keys. Chapter 6. Cryptographic features  221 b speed protection protected key secure key clear key