About

Imported from mukul975/anthropic-cybersecurity-skills (skills/configuring-hsm-for-key-storage/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill configuring-hsm-for-key-storage. Copyright stays with the author (Apache-2.0).

Configuring HSM for Key Storage

Name: configuring-hsm-for-key-storage
Author: mukul975

Overview

Hardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never leave the device boundary, providing the highest level of key protection. This skill covers configuring HSMs using the PKCS#11 standard interface, including key generation, signing, encryption, and key management using both physical HSMs and SoftHSM2 for development.

When to Use

When deploying or configuring configuring hsm for key storage capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Configure SoftHSM2 as a development PKCS#11 provider
Generate and manage keys inside the HSM via PKCS#11
Perform cryptographic operations (sign, verify, encrypt, decrypt) using HSM-resident keys
Implement HSM-backed certificate authority operations
Configure key access policies and user authentication
Interface with cloud HSM services (AWS CloudHSM, Azure)

Key Concepts

HSM Compliance Levels

FIPS Level	Protection	Use Case
FIPS 140-2 Level 1	Software only	Development
FIPS 140-2 Level 2	Tamper-evident, role-based auth	General production
FIPS 140-2 Level 3	Tamper-resistant, identity-based auth	Financial, government
FIPS 140-2 Level 4	Physical tamper response	Military, classified

PKCS#11 Architecture

Application --> PKCS#11 API --> HSM Provider --> Hardware HSM
                                    |
                              (SoftHSM2 for dev)

Key Objects in PKCS#11

Object Type	Description	Operations
CKO_SECRET_KEY	Symmetric keys (AES)	Encrypt, Decrypt, Wrap
CKO_PUBLIC_KEY	Public keys (RSA, EC)	Verify, Encrypt, Wrap
CKO_PRIVATE_KEY	Private keys (RSA, EC)	Sign, Decrypt, Unwrap
CKO_CERTIFICATE	X.509 certificates	Storage, retrieval

Security Considerations

Never export private keys from HSM (use CKA_EXTRACTABLE=False)
Use separate slots/partitions for different applications
Implement multi-person key ceremony for CA root keys
Enable audit logging for all HSM operations
Implement HSM backup and disaster recovery
Use strong PINs and enable SO (Security Officer) PIN

Validation Criteria

SoftHSM2 initializes with token and user PIN
AES key generates inside HSM
RSA key pair generates inside HSM
Encryption/decryption uses HSM-resident keys
Signing/verification uses HSM-resident keys
Keys cannot be exported (non-extractable)
Key listing shows all HSM-stored objects

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-configuring-hsm-88cc68/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-configuring-hsm-88cc68.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-configuring-hsm-88cc68",
  "kind": "skill",
  "name": "configuring-hsm-for-key-storage",
  "description": "Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2 for development. Use when protecting cryptographic keys so they never leave a hardened device boundary, or when building and testing PKCS#11-based key management workflows.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cryptography",
      "hsm",
      "key-management",
      "pkcs11",
      "hardware-security",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Configures Hardware Security Modules for cryptographic key storage using the PKCS#11 standard interface, covering key generation, signing, encryption, and key management on physical HSMs and SoftHSM2 for development. Use when protecting cryptographic keys so they never leave a hardened device boundary, or when building and testing PKCS#11-based key management workflows."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/configuring-hsm-for-key-storage/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/configuring-hsm-for-key-storage/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/configuring-hsm-for-key-storage/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Configuring HSM for Key Storage\n\n## Overview\n\nHardware Security Modules (HSMs) are tamper-resistant physical devices that safeguard cryptographic keys and perform cryptographic operations in a hardened environment. Keys stored in an HSM never leave the device boundary, providing the highest level of key protection. This skill covers configuring HSMs using the PKCS#11 standard interface, including key generation, signing, encryption, and key management using both physical HSMs and SoftHSM2 for development.\n\n\n## When to Use\n\n- When deploying or configuring configuring hsm for key storage capab",
  "cost": {
    "context_tokens": 783
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-configuring-hsm-88cc68/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.