Setting Up HSM (Hardware Security Module) for Blockchain

Imagine you launch an Ethereum validator, and the private key is stored in a file on the server. One exploit — and all staked ETH is at risk of slashing. HSM (Hardware Security Module) solves this problem at the physical isolation level: the key is generated and used inside a certified chip; it cannot be extracted. According to the PKCS#11 specification, no software can read the private key from the HSM. Savings from switching to HSM can reach 40-60% compared to cloud KMS over two years — by eliminating licensing fees and reducing leakage risk. For any crypto project handling large sums, HSM is not a luxury but a security standard.

Contact us for a consultation on selecting an HSM for your infrastructure.

Why HSM is Better Than Software Alternatives

FIPS 140-2 Level 3 is the standard for the financial sector. It requires physical protection against tampering (tamper-evident) and device-level authentication. Most enterprise HSMs (Thales Luna, AWS CloudHSM, YubiHSM 2) are certified to this level. HSM is 10 times more secure than software storage because the key is physically inaccessible.

How to Choose an HSM for Blockchain

How to Integrate HSM with Ethereum via PKCS#11

PKCS#11 is a standard C API for working with HSM. Most programming languages have bindings.

Key Generation Inside HSM

import pkcs11 from pkcs11 import Mechanism, KeyType, Attribute # Connect to HSM via PKCS#11 library lib = pkcs11.lib('/usr/lib/libCryptoki2.so') # path to vendor library token = lib.get_token(token_label='MyHSMToken') session = token.open(user_pin='HSM_USER_PIN') # Generate secp256k1 key pair (Ethereum/Bitcoin) # Keys are created and stored INSIDE HSM, they never leave it public_key, private_key = session.generate_keypair( KeyType.EC, public_template={ Attribute.TOKEN: True, # store in HSM (not only in session) Attribute.LABEL: 'eth-signing-key-1', Attribute.EC_PARAMS: encode_named_curve_parameters('secp256k1'), Attribute.VERIFY: True, }, private_template={ Attribute.TOKEN: True, Attribute.LABEL: 'eth-signing-key-1', Attribute.SIGN: True, Attribute.EXTRACTABLE: False, # **CRITICAL**: prohibit private key export Attribute.SENSITIVE: True, } ) # Get public key (it is exportable — that's fine) ec_point = public_key[Attribute.EC_POINT] # Convert to Ethereum address eth_address = ec_point_to_eth_address(ec_point) print(f"Ethereum address: {eth_address}") 

Signing a Transaction via HSM

from eth_account._utils.signing import sign_transaction_dict import rlp def sign_eth_transaction_hsm(session, private_key_label, tx_dict): """ Sign an Ethereum transaction with a key inside HSM. The private key never leaves the HSM. """ # Encode transaction per EIP-155 (with chain_id for replay protection) chain_id = tx_dict['chainId'] unsigned_tx = encode_unsigned_tx(tx_dict) # Compute hash to sign tx_hash = keccak256(unsigned_tx) # Get private key object from HSM (not the key itself!) private_key = session.get_key( label=private_key_label, key_type=KeyType.EC ) # Sign INSIDE HSM — tx_hash goes to HSM, signature comes back # Mechanism ECDSA (raw) — Ethereum needs raw without hashing inside HSM der_signature = private_key.sign(tx_hash, mechanism=Mechanism.ECDSA) # DER -> (r, s) -> v, r, s for Ethereum r, s = decode_der_signature(der_signature) v = recover_v(tx_hash, r, s, chain_id, eth_address) signed_tx = encode_signed_tx(tx_dict, v, r, s) return signed_tx.hex() 

Important detail: Ethereum uses secp256k1 with recoverable signature (the v component is needed to recover the public key). PKCS#11 returns an ECDSA signature without v. v (recovery id) is computed empirically — try 0 and 1, check which one recovers the correct address.

What is Slashing and How HSM Protects the Validator

For Ethereum PoS validators, the key signs attestations and blocks. Key compromise leads to slashing. EIP-3030 (Ethereum Remote Signing) and Web3Signer from Consensys solve the problem of remote signing with HSM. Web3Signer configuration with HSM via PKCS#11:

# web3signer configuration with HSM (PKCS11) type: "pkcs11-signer" pkcs11LibraryPath: "/usr/lib/softhsm/libsofthsm2.so" slashingProtectionDbUrl: "jdbc:postgresql://localhost/web3signer" keystoreFile: "/etc/web3signer/keystore.yaml" 

Web3Signer additionally uses a slashing protection database — if a signing request comes twice, the second one will be rejected. This is critical for avoiding slashing.

Audit and Access Management

HSM logs every operation: who requested the signature, which key, at what time. These are forensically significant logs — they should be exported to a SIEM system and stored with integrity guarantees (append-only, signed).

Access control schema:

• Security Officer (SO) — manages the HSM itself, creates/deletes keys, changes policies
• Operator — can use keys for signing but cannot delete or export them
• Auditor — read-only logs

Role separation + m-of-n authentication for SO operations (e.g., 2 out of 3 smart cards) is the standard for custodial operations.

Key Backup

Keys from HSM can only be copied to another HSM of the same type using key wrapping. The procedure requires the presence of a Security Officer and physical access. We configure regular backup with encryption at the HSM level.

How to Set Up HSM: Step-by-Step Guide

1. Choose HSM based on requirements for throughput, supported curves, and deployment type (on-premise or cloud).
2. Physical installation and initialization of HSM (for on-premise). Connect to the network and configure management.
3. Generate key pairs inside HSM with parameters !EXTRACTABLE=False and !SENSITIVE=True.
4. Integrate PKCS#11 with the application: configure library, test signing.
5. Configure roles and m-of-n authentication for Security Officer operations.
6. Integrate with Web3Signer for use in an Ethereum validator, including slashing protection setup.
7. Backup key material (key wrapping) and test disaster recovery scenarios.

For an individual deployment plan, contact our engineers.

What is Included in Our Work

• Selection of HSM for specific requirements (on-premise vs cloud, throughput, curves)
• Physical installation and initialization of HSM (for on-premise)
• PKCS#11 integration with application: key generation, signing operations
• Configuration of roles and m-of-n authentication
• Integration with Web3Signer for validator use case
• Setup of audit logging with SIEM export
• Key material backup procedures (key wrapping to another HSM)
• Testing of disaster recovery scenarios

Get a consultation on HSM setup for your project. Order turnkey implementation — we will estimate timelines and cost individually.