What it does. Configures Hardware Security Modules for cryptographic key storage Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill configuring-hsm-for-key-storage, or copy the skill folder into ~/.claude/skills/configuring-hsm-for-key-storage/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/configuring-hsm-for-key-storage/SKILL.md
SKILL.md (verbatim)
name: configuring-hsm-for-key-storage
description: Configures Hardware Security Modules for cryptographic key storage
using the PKCS#11 standard interface, covering key generation, signing, encryption,
and key management on physical HSMs and SoftHSM2 for development. Use when protecting
cryptographic keys so they never leave a hardened device boundary, or when building
and testing PKCS#11-based key management workflows.
domain: cybersecurity
subdomain: cryptography
tags:
- cryptography
- hsm
- key-management
- pkcs11
- hardware-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1552.004
- T1555
- T1078
Configuring HSM for Key Storage
Overview
Hardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never leave the device boundary, providing the highest level of key protection. This skill covers configuring HSMs using the PKCS#11 standard interface, including key generation, signing, encryption, and key management using both physical HSMs and SoftHSM2 for development.
When to Use
- When deploying or configuring configuring hsm for key storage capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Familiarity with cryptography concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Configure SoftHSM2 as a development PKCS#11 provider
- Generate and manage keys inside the HSM via PKCS#11
- Perform cryptographic operations (sign, verify, encrypt, decrypt) using HSM-resident keys
- Implement HSM-backed certificate authority operations
- Configure key access policies and user authentication
- Interface with cloud HSM services (AWS CloudHSM, Azure)
Key Concepts
HSM Compliance Levels
| FIPS Level |
Protection |
Use Case |
| FIPS 140-2 Level 1 |
Software only |
Development |
| FIPS 140-2 Level 2 |
Tamper-evident, role-based auth |
General production |
| FIPS 140-2 Level 3 |
Tamper-resistant, identity-based auth |
Financial, government |
| FIPS 140-2 Level 4 |
Physical tamper response |
Military, classified |
PKCS#11 Architecture
Application --> PKCS#11 API --> HSM Provider --> Hardware HSM
|
(SoftHSM2 for dev)
Key Objects in PKCS#11
| Object Type |
Description |
Operations |
| CKO_SECRET_KEY |
Symmetric keys (AES) |
Encrypt, Decrypt, Wrap |
| CKO_PUBLIC_KEY |
Public keys (RSA, EC) |
Verify, Encrypt, Wrap |
| CKO_PRIVATE_KEY |
Private keys (RSA, EC) |
Sign, Decrypt, Unwrap |
| CKO_CERTIFICATE |
X.509 certificates |
Storage, retrieval |
Security Considerations
- Never export private keys from HSM (use CKA_EXTRACTABLE=False)
- Use separate slots/partitions for different applications
- Implement multi-person key ceremony for CA root keys
- Enable audit logging for all HSM operations
- Implement HSM backup and disaster recovery
- Use strong PINs and enable SO (Security Officer) PIN
Validation Criteria
Other files in this skill
assets/template.md (verbatim)
HSM Key Storage Configuration Template
HSM Selection Matrix
| HSM |
FIPS Level |
Cloud |
On-Premise |
Cost |
| SoftHSM2 |
N/A (dev) |
N/A |
Yes |
Free |
| AWS CloudHSM |
140-2 L3 |
Yes |
No |
~$1.60/hr |
| Azure Dedicated HSM |
140-2 L3 |
Yes |
No |
~$5,500/mo |
| Thales Luna |
140-2 L3 |
Both |
Yes |
License |
| YubiHSM 2 |
140-2 L3 |
No |
Yes |
~$650 |
PKCS#11 Key Attributes
CKA_TOKEN = True # Persistent storage
CKA_PRIVATE = True # Requires login
CKA_SENSITIVE = True # Cannot be revealed in clear
CKA_EXTRACTABLE = False # Cannot be exported
CKA_MODIFIABLE = False # Cannot change attributes
CKA_LABEL = "my-key" # Human-readable label
CKA_ID = <byte_string> # Unique identifier
Key Ceremony Checklist
references/api-reference.md (verbatim)
HSM Key Storage — API Reference
Libraries
| Library |
Install |
Purpose |
| boto3 |
pip install boto3 |
AWS CloudHSM and KMS API |
| python-pkcs11 |
pip install python-pkcs11 |
PKCS#11 interface for HSM operations |
Key boto3 CloudHSMv2 Methods
| Method |
Description |
describe_clusters() |
List CloudHSM clusters |
describe_backups() |
List cluster backups |
create_cluster(HsmType, SubnetIds) |
Create new cluster |
create_hsm(ClusterId, AvailabilityZone) |
Add HSM to cluster |
initialize_cluster(ClusterId, SignedCert, TrustAnchor) |
Initialize cluster |
Key boto3 KMS Methods (Custom Key Store)
| Method |
Description |
create_custom_key_store() |
Create KMS custom key store backed by CloudHSM |
describe_key(KeyId) |
Get key metadata including CustomKeyStoreId |
create_key(Origin="AWS_CLOUDHSM", CustomKeyStoreId=) |
Create key in HSM |
PKCS#11 Operations
| Function |
Description |
C_Initialize |
Initialize PKCS#11 library |
C_OpenSession |
Open session with HSM |
C_Login |
Authenticate with HSM PIN |
C_GenerateKeyPair |
Generate asymmetric key pair |
C_Sign / C_Verify |
Cryptographic signing operations |
HSM Types
| Type |
Use Case |
| AWS CloudHSM |
Cloud-native FIPS 140-2 Level 3 |
| Thales Luna |
On-premises enterprise HSM |
| nCipher nShield |
High-assurance code signing |
External References
references/standards.md (verbatim)
Standards and References - HSM for Key Storage
Primary Standards
PKCS#11 v3.0 (Cryptoki)
FIPS 140-2 / FIPS 140-3
NIST SP 800-57 Part 1 Rev. 5
HSM Products
SoftHSM2 (Development/Testing)
AWS CloudHSM
Azure Dedicated HSM
Thales Luna HSM
Python Libraries
python-pkcs11
PyKCS11
references/workflows.md (verbatim)
Workflows - HSM for Key Storage
Workflow 1: SoftHSM2 Initialization
# Install SoftHSM2
# Ubuntu: apt install softhsm2
# macOS: brew install softhsm
# Initialize a token
softhsm2-util --init-token --slot 0 --label "MyToken" --pin 1234 --so-pin 5678
# List tokens
softhsm2-util --show-slots
Workflow 2: Key Generation via PKCS#11
[Connect to HSM]
(open session, login with PIN)
|
[Generate Key]:
Symmetric: AES-256 (CKM_AES_KEY_GEN)
Asymmetric: RSA-4096 (CKM_RSA_PKCS_KEY_PAIR_GEN)
Asymmetric: EC P-256 (CKM_EC_KEY_PAIR_GEN)
|
[Set Key Attributes]:
CKA_EXTRACTABLE = False
CKA_SENSITIVE = True
CKA_TOKEN = True (persistent)
CKA_LABEL = "my-key-001"
|
[Key Stored in HSM]
(returns handle, not key material)
Workflow 3: Cryptographic Operations
[Application Request]
|
[Open PKCS#11 Session]
|
[Find Key by Label/ID]
|
[Perform Operation on HSM]:
Sign: C_SignInit + C_Sign
Verify: C_VerifyInit + C_Verify
Encrypt: C_EncryptInit + C_Encrypt
Decrypt: C_DecryptInit + C_Decrypt
|
[Return Result to Application]
(key never leaves HSM)
|
[Close Session]
Workflow 4: HSM Key Ceremony (Root CA)
[Prepare Air-Gapped HSM Station]
|
[Multi-Person Authentication]
(M-of-N key custodians present)
|
[Generate Root CA Key in HSM]
(CKA_EXTRACTABLE=False)
|
[Sign Root CA Certificate]
(self-signed, 20-year validity)
|
[Export Root CA Certificate]
(public certificate only)
|
[Secure HSM in Safe/Vault]
(offline until next signing ceremony)
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.