configuring-hsm-for-key-storage

Use C_GenerateKeyPair through the PKCS#11 API so the key is created on-device and never exists in plaintext outside the HSM. Set CKA_EXTRACTABLE=False, CKA_SENSITIVE=True, and CKA_TOKEN=True, then confirm CKA_LOCAL=True to prove on-device generation.

SoftHSM2 is a software implementation of an HSM that speaks the PKCS#11 interface, intended for development and testing. Use it to build and validate HSM-integrated applications before deploying against physical FIPS-certified hardware in production.

Run pkcs11-tool --list-objects --type privkey and confirm the key shows Access: sensitive, always sensitive, never extractable. A sign/verify round-trip must succeed while any key-export attempt via C_GetAttributeValue or pkcs11-tool --read-object is rejected by the token.

Yes, the Skill covers interfacing with cloud HSM services including AWS CloudHSM and Azure. These services expose PKCS#11-compatible interfaces, so the same key generation and cryptographic operation patterns apply.

Level 1 suits development, Level 2 adds tamper evidence and role-based authentication for general production, Level 3 provides tamper resistance and identity-based authentication for financial or government use, and Level 4 adds physical tamper response for classified environments.

Importing means the plaintext key existed outside the HSM boundary, defeating its protection guarantees. Always generate keys on-device with C_GenerateKeyPair and verify CKA_LOCAL=True to confirm the key was created inside the HSM.