Skip to main content

Authorized use only. Use this tool solely on systems, tokens, and assets you own or are explicitly permitted to test — credential extraction, signature forging, and unauthorized access are prohibited by our Acceptable Use Policy.

CloudHSM Key List & EVM Address

List keys in AWS CloudHSM, inspect their attributes, and derive the EVM wallet address from an secp256k1 public key. 100% client-side.

Step 1 - How to list keys in CloudHSM

Option A: cloudhsm-cli (Client SDK 3)

cloudhsm-cli key list
cloudhsm-cli key list --attribute label,key-class,key-type,curve
cloudhsm-cli key describe --handle <handle>

key list outputs JSON - paste it in Step 2 below.

Option B: key_mgmt_tool (Client SDK command line)

./key_mgmt_tool listKeys
./key_mgmt_tool listAttributes -handle <handle>
./key_mgmt_tool exportPubKey -handle <handle> -f pem

Option C: PKCS#11 with opensc

pkcs11-tool --module /opt/cloudhsm/lib/libcloudhsm_pkcs11.so --list-objects
pkcs11-tool --module ... --read-object --type pubkey --id <id> -o pub.der
openssl ec -pubin -inform DER -in pub.der -out pub.pem

Generating an EVM-compatible key in the HSM

cloudhsm-cli key generate-pair key-type ecc curve secp256k1 label evm-custody-key \
  public-usage verify private-usage sign

EVM uses the secp256k1 curve - the same one as Ethereum. RSA or P-256 keys cannot produce EVM addresses.

Step 2 - Key attributes (paste key list JSON output)

Step 3 - Derive the EVM address from the public key

The private key never leaves the HSM - the address is computed from the public key only (keccak-256 of the uncompressed point, last 20 bytes). Signing must happen inside the HSM via PKCS#11 or JCE.

About

AWS CloudHSM holds keys in FIPS-validated hardware; private keys are non-extractable. For EVM custody you generate an secp256k1 pair in the HSM, list it to find the handle and attributes, export only the public key, and derive the on-chain address from it locally. This page does both inspection steps in your browser - no data leaves this tab.