Hi everyone,
I wanted to share a new open-source project I've been working on. It is a pure Python PKCS#11 utility built specifically to fill a critical gap: native support for the new PKCS#11 v3.2 specification and Post-Quantum Cryptography (PQC) algorithms.
Why I built this:
The cryptographic landscape is actively transitioning to quantum-safe standards, and OASIS recently introduced critical updates in PKCS#11 v3.2 to handle these new primitives. However, legacy tools (like OpenSC's pkcs11-tool) are heavily bound to older spec versions, and adding experimental or cutting-edge PQC mechanisms to compiled C toolchains is slow and rigid.
I built this tool from the ground up to give developers, security engineers, and researchers an immediate, production-ready way to interact with next-generation Hardware Security Modules (HSMs) and tokens using the latest v3.2 standards and PQC mechanisms.
Key Features:
- 🔐 Built for PKCS#11 v3.2: Implements the latest standard features, attributes, and mechanism definitions out of the box.
- ⚛️ Post-Quantum Ready: Native support for quantum-resistant algorithms (like ML-DSA, ML-KEM, Falcon, and XMSS/LMS) as the industry migrates away from RSA and ECC.
- 🔄 Drop-in OpenSC Compatibility: Fully reproduces the existing
pkcs11-tooloption surface, option ordering, and output formats. Your existing automation scripts, arguments, and expectations will continue working perfectly out of the box. - 🐍 Pure Python & Zero Boilerplate: Written entirely in Python with no underlying C binary dependencies. It is instantly portable, easy to audit, and simple to install across any pipeline.
Get started:
You can pull the tool directly from PyPI:
pip install pypkcs11-tool
- GitHub Repository: https://github.com
- PyPI Project Page: https://pypi.org
I would love to hear your feedback, especially regarding how it performs against different HSM vendor implementations or software tokens currently testing PQC!
Top comments (0)