What it does. Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-hardware-security-module-integration, or copy the skill folder into ~/.claude/skills/performing-hardware-security-module-integration/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-hardware-security-module-integration/SKILL.md

SKILL.md (verbatim)

name: performing-hardware-security-module-integration
description: Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface
  using python-pkcs11, performing key generation, signing, encryption, verification,
  and token/slot queries against SoftHSM2, AWS CloudHSM, or YubiHSM2. Use when implementing
  HSM-backed key management or validating HSM configuration for FIPS 140-2/3 compliance.
domain: cybersecurity
subdomain: cryptography
tags:
- HSM
- PKCS11
- CloudHSM
- YubiHSM2
- key-management
- cryptographic-operations
- hardware-security
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1600
- T1573
- T1553
- T1078.004
- T1530

Performing Hardware Security Module Integration

Overview

Hardware Security Modules (HSMs) provide tamper-resistant cryptographic key storage and operations. This skill covers integrating with HSMs via the PKCS#11 standard interface using python-pkcs11, performing key generation, signing, encryption, and verification operations, querying token and slot information, and validating HSM configuration for compliance with FIPS 140-2/3 requirements.

When to Use

• When conducting security assessments that involve performing hardware security module integration
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• HSM device or software HSM (SoftHSM2 for testing)
• PKCS#11 shared library (.so/.dll) for the HSM vendor
• Python 3.9+ with python-pkcs11
• Token initialized with SO PIN and user PIN
• For AWS CloudHSM: cloudhsm-pkcs11 provider configured

Steps

1. Load PKCS#11 library and enumerate available slots and tokens
2. Open session and authenticate with user PIN
3. Generate RSA 2048-bit or EC P-256 key pairs on the HSM
4. Perform signing and verification using on-device keys
5. List all objects (keys, certificates) stored on the token
6. Query mechanism list to verify supported algorithms
7. Generate compliance report with key inventory and algorithm audit

Expected Output

• JSON report listing HSM slots, tokens, stored keys, supported mechanisms, and compliance status
• Signing test results with key metadata and algorithm details

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference — Performing Hardware Security Module Integration

Libraries Used

• python-pkcs11: Python PKCS#11 wrapper for HSM cryptographic operations
• json: JSON serialization for audit reports

CLI Interface

python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 slots
python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 objects
python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 gen-rsa --label mykey --bits 2048
python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 gen-ec --label myec
python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 sign-verify --key-label mykey
python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 mechanisms
python agent.py --lib /usr/lib/softhsm/libsofthsm2.so --token MyToken --pin 1234 full

Core Functions

load_library(lib_path) — Load PKCS#11 shared library

Calls pkcs11.lib(lib_path) to initialize the PKCS#11 provider.

enumerate_slots(lib) — List slots and token info

Iterates lib.get_slots(token_present=True). Returns token label, manufacturer, model, serial, initialization status, and supported mechanism list.

list_objects(lib, token_label, pin) — Inventory stored keys

Opens authenticated session, calls session.get_objects(). Returns object class, label, key type, key length, and object ID.

generate_rsa_keypair(lib, token_label, pin, key_label, bits) — RSA key generation

Calls session.generate_keypair(KeyType.RSA, bits, store=True, label=key_label).

generate_ec_keypair(lib, token_label, pin, key_label) — EC P-256 key generation

Creates domain parameters for secp256r1 via encode_named_curve_parameters, then calls ecparams.generate_keypair().

sign_and_verify(lib, token_label, pin, key_label) — Signing test

Signs with priv.sign(data, mechanism=Mechanism.SHA256_RSA_PKCS). Verifies with pub.verify(data, signature, mechanism=Mechanism.SHA256_RSA_PKCS).

query_mechanisms(lib, token_label) — Algorithm support audit

Enumerates all mechanisms with min/max key sizes from the slot.

full_audit(lib, token_label, pin) — Comprehensive compliance report

PKCS#11 Object Classes

FIPS 140-2 Required Mechanisms

RSA_PKCS, SHA256_RSA_PKCS, SHA384_RSA_PKCS, SHA512_RSA_PKCS, ECDSA, ECDSA_SHA256, AES_CBC, AES_GCM, SHA256, SHA384, SHA512

Common PKCS#11 Libraries

Dependencies

• python-pkcs11 >= 0.7.0
• PKCS#11 shared library for target HSM
• Initialized token with user PIN

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.