I am a beginner on cryptography, I've been reading about PKCS11 and usage of PKCS11 on HSM's

I understand the concept of HSM,

I read about the HD wallets in bitcoin how keys are hashed and combined and hashed again to form a tree, branch, sub branch private + public key list

my question if I use an HSM that has the PKCS11 interface can I do all these key creation, hashing, combining adding on the hsm without exposing private keys to the host machine ?

  • 1
    $\begingroup$ Crypto doesn't have that many cryptocurrency specialists. Listing or referencing some of the algorithms might be a good idea. $\endgroup$
    – Maarten Bodewes
    Commented Apr 5, 2018 at 17:46

1 Answer 1


No, the operations on the key itself are not standardized and not supported by the PKCS#11 standard. There are some key derivation mechanisms, but even the NIST specified ones have hardly any support (which is kind of ironic, as key management is of course one of the main reasons to buy an HSM in the first place).

These operations are pretty specific to BitCoin and are therefore not standardized. It is of course possible to extend the base functionality of PKCS#11 with custom mechanisms. But in general HSM's will not be created with BitCoin wallets in mind.

Probably easier to create a BitCoin specific hardware module interface with your own software support. Some HSM's do allow custom code to be loaded, so you do likely not have to create your own hardware for that. Smart cards can be programmed as well. Prepare for a steep learning curve though.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.