Initial commit - 611 cybersecurity skills across all subdomains

2026-08-28 12:19:41 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,46 @@
+# Standards and References - HSM for Key Storage
+
+## Primary Standards
+
+### PKCS#11 v3.0 (Cryptoki)
+- **URL**: https://docs.oasis-open.org/pkcs11/pkcs11-base/v3.0/pkcs11-base-v3.0.html
+- **Description**: Standard API for cryptographic token interface
+
+### FIPS 140-2 / FIPS 140-3
+- **URL**: https://csrc.nist.gov/publications/detail/fips/140/3/final
+- **Description**: Security requirements for cryptographic modules
+- **CMVP**: https://csrc.nist.gov/projects/cryptographic-module-validation-program
+
+### NIST SP 800-57 Part 1 Rev. 5
+- **URL**: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
+- **Description**: Key management recommendations (HSM storage for high-value keys)
+
+## HSM Products
+
+### SoftHSM2 (Development/Testing)
+- **URL**: https://www.opendnssec.org/softhsm/
+- **GitHub**: https://github.com/opendnssec/SoftHSMv2
+- **Description**: Software-only PKCS#11 implementation for testing
+
+### AWS CloudHSM
+- **URL**: https://docs.aws.amazon.com/cloudhsm/
+- **FIPS**: 140-2 Level 3
+- **PKCS#11**: https://docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-library.html
+
+### Azure Dedicated HSM
+- **URL**: https://docs.microsoft.com/en-us/azure/dedicated-hsm/
+- **FIPS**: 140-2 Level 3 (Thales Luna)
+
+### Thales Luna HSM
+- **URL**: https://cpl.thalesgroup.com/encryption/hardware-security-modules
+- **FIPS**: 140-2 Level 3
+
+## Python Libraries
+
+### python-pkcs11
+- **URL**: https://python-pkcs11.readthedocs.io/
+- **PyPI**: https://pypi.org/project/python-pkcs11/
+
+### PyKCS11
+- **URL**: https://github.com/LudovicRousseau/PyKCS11
+- **PyPI**: https://pypi.org/project/PyKCS11/
@@ -0,0 +1,78 @@
+# Workflows - HSM for Key Storage
+
+## Workflow 1: SoftHSM2 Initialization
+
+```bash
+# Install SoftHSM2
+# Ubuntu: apt install softhsm2
+# macOS: brew install softhsm
+
+# Initialize a token
+softhsm2-util --init-token --slot 0 --label "MyToken" --pin 1234 --so-pin 5678
+
+# List tokens
+softhsm2-util --show-slots
+```
+
+## Workflow 2: Key Generation via PKCS#11
+
+```
+[Connect to HSM]
+(open session, login with PIN)
+      |
+[Generate Key]:
+  Symmetric: AES-256 (CKM_AES_KEY_GEN)
+  Asymmetric: RSA-4096 (CKM_RSA_PKCS_KEY_PAIR_GEN)
+  Asymmetric: EC P-256 (CKM_EC_KEY_PAIR_GEN)
+      |
+[Set Key Attributes]:
+  CKA_EXTRACTABLE = False
+  CKA_SENSITIVE = True
+  CKA_TOKEN = True (persistent)
+  CKA_LABEL = "my-key-001"
+      |
+[Key Stored in HSM]
+(returns handle, not key material)
+```
+
+## Workflow 3: Cryptographic Operations
+
+```
+[Application Request]
+      |
+[Open PKCS#11 Session]
+      |
+[Find Key by Label/ID]
+      |
+[Perform Operation on HSM]:
+  Sign:    C_SignInit + C_Sign
+  Verify:  C_VerifyInit + C_Verify
+  Encrypt: C_EncryptInit + C_Encrypt
+  Decrypt: C_DecryptInit + C_Decrypt
+      |
+[Return Result to Application]
+(key never leaves HSM)
+      |
+[Close Session]
+```
+
+## Workflow 4: HSM Key Ceremony (Root CA)
+
+```
+[Prepare Air-Gapped HSM Station]
+      |
+[Multi-Person Authentication]
+(M-of-N key custodians present)
+      |
+[Generate Root CA Key in HSM]
+(CKA_EXTRACTABLE=False)
+      |
+[Sign Root CA Certificate]
+(self-signed, 20-year validity)
+      |
+[Export Root CA Certificate]
+(public certificate only)
+      |
+[Secure HSM in Safe/Vault]
+(offline until next signing ceremony)
+```