# Eviden KMS
[](https://github.com/Cosmian/kms/actions/workflows/main.yml) [](https://github.com/Cosmian/kms/actions/workflows/nightly.yml) [](https://github.com/Cosmian/kms/releases) [](https://docs.cosmian.com/key_management_system/) [](https://github.com/Cosmian/kms/pkgs/container/kms) [](SECURITY.md) [](LICENSE) [](./documentation/docs/certifications_and_compliance/fips.md)
> **Note**: Cosmian has become part of [Eviden](https://eviden.com/). The Cosmian KMS is now the **Eviden KMS**.
The **Eviden KMS** is a high-performance, source-available [FIPS 140-3 compliant](./documentation/docs/certifications_and_compliance/fips.md) server application written in [Rust](https://www.rust-lang.org/).
Online [documentation](https://docs.cosmian.com/key_management_system/).
<p align="center"><em>Built-in Web UI for administration and operations.</em></p>
The **Eviden KMS** presents some unique features, such as:
- **Use cases**: [large-scale encryption/decryption](./documentation/docs/use_cases/encrypting_and_decrypting_at_scale.md), [client-side/application-level encryption](./documentation/docs/use_cases/client_side_and_application_level_encryption.md), and [data anonymization/tokenization](./documentation/docs/use_cases/anonymization.md), with support for signature at scale (including secp256k1 in non-FIPS mode).
- **Cloud and enterprise integrations**: [AWS XKS v2](./documentation/docs/integrations/cloud_providers/aws/xks.md), [Azure EKM](./documentation/docs/integrations/cloud_providers/azure/ekm.md), [Google Workspace CSE](./documentation/docs/integrations/cloud_providers/google_workspace_client_side_encryption_cse/getting_started/index.md), and [Microsoft 365 DKE](./documentation/docs/integrations/cloud_providers/microsoft_365_double_key_encryption_dke/index.md).
- **Databases**: [Oracle Database TDE](./documentation/docs/integrations/databases/oracle_tde.md), [Microsoft SQL Server External (EKM)](./documentation/docs/integrations/databases/ms_sql_server.md), [MongoDB](./documentation/docs/integrations/databases/mongodb.md), [MySQL Enterprise](./documentation/docs/integrations/databases/mysql.md), [PostgreSQL Percona](./documentation/docs/integrations/databases/percona.md), and [EDB Postgres Advanced Server TDE](./documentation/docs/integrations/databases/edb_postgres_tde.md).
- **Disk encryption**: [Veracrypt](./documentation/docs/integrations/disk_encryption/veracrypt.md), [LUKS](./documentation/docs/integrations/disk_encryption/luks.md), and [Cryhod](./documentation/docs/integrations/disk_encryption/cryhod.md), all backed by the [PKCS#11 v3.0 provider module](./documentation/docs/integrations/pkcs11_provider.md).
- **Big Data**: [Snowflake Native App](./documentation/docs/integrations/big_data/snowflake_native_app/index.md) and [PySpark/Databricks Python UDF](./documentation/docs/integrations/big_data/user_defined_function_for_pyspark_databricks_in_python/index.md) for large-scale data encryption.
- **Storage integrations**: [VMware vCenter Trust Key Provider](./documentation/docs/integrations/storage/vcenter.md), [Synology DSM](./documentation/docs/integrations/storage/synology_dsm.md), [VAST Data](./documentation/docs/integrations/storage/vast_data.md), and [Veeam Backup & Replication](./documentation/docs/integrations/storage/veeam.md).
- **Container Orchestration**: [Kubernetes KMS Provider Plugin](./documentation/docs/integrations/kubernetes/index.md) — etcd Secrets encrypted at rest via the KMS v2 API.
- **Infrastructure as Code**: [Terraform / OpenTofu Provider](./documentation/docs/integrations/terraform.md) — manage keys, certificates, and access rights as code; published on the [Terraform Registry](https://registry.terraform.io/providers/Cosmian/kms).
- **Other integrations**: [OpenSSH](./documentation/docs/integrations/openssh.md), [S/MIME email encryption](./documentation/docs/integrations/smime.md), [GnuPG / OpenPGP keys](./documentation/docs/integrations/gnupg/openpgp.md) (create, import, export, encrypt, decrypt, sign, verify; non-FIPS builds) and [GnuPG smartcard](./documentation/docs/integrations/gnupg/smartcard.md), [FortiGate / FortiOS](./documentation/docs/integrations/fortigate.md), and [SPIRE / SPIFFE Zero-Trust M2M](./documentation/docs/integrations/spire_spiffe.md).
- **Security and standards**: [FIPS 140-3](./documentation/docs/certifications_and_compliance/fips.md), [KMIP 1.0-2.1 binary and JSON TTLV support](./documentation/docs/kmip_support/introduction/index.md), [state-of-the-art authentication mechanisms](./documentation/docs/configuration/authentication.md), and native compatibility with network appliances such as [FortiGate / FortiOS](./documentation/docs/integrations/fortigate.md).
- **HSM support**: [Utimaco, SmartCard-HSM/Nitrokey HSM 2, Proteccio, Crypt2pay, AWS CloudHSM, and others](./documentation/docs/hsm_support/introduction/index.md), with KMS keys wrapped by HSMs.
- **Operations**: full-featured [CLI and graphical clients](https://docs.cosmian.com/key_management_system/kms_clients/index.html), [high-availability mode](./documentation/docs/installation/high_availability_mode.md), [confidential cloud deployment](./documentation/docs/installation/marketplace_guide.md), [OpenTelemetry integration](./documentation/docs/configuration/logging.md), [OpenAPI 3.1 spec with Swagger UI](./documentation/docs/integrations/openapi.md) for interactive API exploration, and [scheduled key auto-rotation](./documentation/docs/kmip_support/key_rotation/auto_rotation_policy.md).
- **Supported Database Backends**: [SQLite, PostgreSQL, MySQL / MariaDB / Percona XtraDB Cluster, and Redis with Findex](./documentation/docs/configuration/database/configuration.md) for persistent cryptographic key and metadata storage.
The **Eviden KMS** is both a Key Management System and a Public Key Infrastructure. As a KMS, it is designed to manage the lifecycle of keys and provide scalable cryptographic services such as on-the-fly key generation, encryption, and decryption operations.
The **Eviden KMS** supports all the standard NIST cryptographic algorithms as well as advanced post-quantum cryptography algorithms such as [Covercrypt](https://github.com/Cosmian/cover_crypt), and FF1 format-preserving encryption in non-FIPS mode. Please refer to the list of [supported algorithms](./documentation/docs/certifications_and_compliance/cryptographic_algorithms/algorithms.md).
As a **PKI** it can manage root and intermediate certificates, sign and verify certificates, use their public keys to encrypt and decrypt data. Certificates can be exported under various formats, including _PKCS#12_ modern and legacy flavor, to be used in various applications, such as in _S/MIME_ encrypted emails.
The **Eviden KMS** has extensive online [documentation](https://docs.cosmian.com/key_management_system/).
## 🚀 Quick start
Pre-built binaries [are available](https://package.cosmian.com/kms/5.29.0/) for Linux, MacOS, and Windows, as well as Docker images. To run the server binary, OpenSSL must be available in your path (see "building the KMS" below for details); other binaries do not have this requirement.
Using Docker to quick-start an Eviden KMS server on `http://localhost:9998` that stores its data inside the container, run the following command:
```sh
docker run -p 9998:9998 --name kms ghcr.io/cosmian/kms:latest
```
Then, use the CLI to issue commands to the KMS. The CLI, called `cosmian`, can be either:
- installed with `cargo install ckms`
- downloaded from [Cosmian packages](https://package.cosmian.com/kms/)
- built and launched from the [GitHub project](https://github.com/Cosmian/cli) by running
```sh
cargo build --bin ckms
```
### ▶️ Example
1. Create a 256-bit symmetric key
```sh
➜ ckms sym keys create --number-of-bits 256 --algorithm aes --tag my-key-file
...
The symmetric key was successfully generated.
Unique identifier: 87e9e2a8-4538-4701-aa8c-e3af94e44a9e
Tags:
- my-key-file
```
2. Encrypt the `image.png` file with AES GCM using the key
```sh
➜ ckms sym encrypt --tag my-key-file --output-file image.enc image.png
...
The encrypted file is available at "image.enc"
```
3. Decrypt the `image.enc` file using the key
```sh
➜ ckms sym decrypt --tag my-key-file --output-file image2.png image.enc
...
The decrypted file is available at "image2.png"
```
See the [documentation](https://docs.cosmian.com/key_management_system/) for more.
## ⭐ Why Eviden KMS
- Performance: built in Rust for low-latency crypto and high throughput.
- Trust by design: FIPS 140-3 mode by default; non-FIPS for broader algorithm access when needed.
- Interoperable: full KMIP 1.0–2.1 support, [PKCS#11 integrations](./documentation/docs/integrations/pkcs11_provider.md), rich client tooling, and a built-in [OpenAPI 3.1 spec with Swagger UI](./documentation/docs/integrations/openapi.md).
- HSM-first: optional HSM key-wrapping and vendor modules (Utimaco, SmartCard-HSM, Proteccio, Crypt2pay, AWS CloudHSM…).
- Cloud-native: official Docker image, simple horizontal scaling, and OpenTelemetry observability.
- End-to-end: server, CLI, and web UI for a complete developer and operator experience.
## 🎯 Top Use Cases
- Application‑level encryption at scale (files, objects, datasets) with centralized key lifecycle.
- Database TDE and integration (Oracle TDE, Percona PostgreSQL, MongoDB, MySQL) via KMIP/PKCS#11.
- Enterprise integrations: Google Workspace CSE, Microsoft DKE, Microsoft SQL Server External (EKM), AWS XKS v2, and Azure EKM.
- HSM-backed key protection and policy‑driven access controls.
- PKI operations: issue, sign, validate, and automate certificate lifecycles, including device enrollment over EST (RFC 7030) and SCEP (RFC 8894) ([docs](./documentation/docs/use_cases/pki-enrollment.md)).
## 🔒 Security & Compliance
- FIPS 140-3 mode on by default; switch to `--features non-fips` for extended algorithms.
- Reproducible builds via Nix; release artifacts ship with SHA-256 checksums.
- Software Bill of Materials (SBOM) and vulnerability reports for server and CLI (`ckms`):
- CycloneDX (server): [`sbom/server/fips/static/bom.cdx.json`](sbom/server/fips/static/bom.cdx.json)
- SPDX (server): [`sbom/server/fips/static/bom.spdx.json`](sbom/server/fips/static/bom.spdx.json)
- Vulnerabilities (server): [`sbom/server/fips/static/vulns.csv`](sbom/server/fips/static/vulns.csv)
- CycloneDX (ckms CLI): [`sbom/ckms/fips/static/bom.cdx.json`](sbom/ckms/fips/static/bom.cdx.json)
- Overview: [`sbom/README.md`](sbom/README.md)
- Cryptography Bill of Materials (CBOM): full inventory of cryptographic assets (algorithms, libraries, parameters) in CycloneDX 1.6 format.
- [`cbom/cbom.cdx.json`](cbom/cbom.cdx.json) — generated by `.mise/scripts/sbom/generate_cbom.py`
-
Observability built-in with OpenTelemetry metrics/traces. See [`OTLP_METRICS.md`](monitoring/OTLP_METRICS.md).
[TOC]
## 🔐 HSM support
| HSM | Status |
| ------------------------------------------ | ------ |
| Proteccio (Bull Atos) | ✅ |
| Crypt2pay | ✅ |
| Utimaco SecurityServer | ✅ |
| CardContact SmartCard-HSM / Nitrokey HSM 2 | ✅ |
| SoftHSM2 (testing) | ✅ |
| AWS CloudHSM | ✅ |
| Azure Cloud HSM | ✅ |
| GCP Cloud HSM | ✅ |
## 🔗 Integrations
> Legend: ✅ implemented · 🚧 not yet implemented
### ☁️ Cloud Provider — External Key Management
Cloud providers offer mechanisms that let you hold cryptographic keys outside their infrastructure.
There are three distinct delegation models:
| Term | Meaning |
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **XKS** | AWS External Key Store — every encrypt/decrypt is proxied live to your KMS; the key material never enters AWS. |
| **EKM** | GCP External Key Manager — same live-proxy model; Google never holds the key material. |
| **DKE** | Microsoft Double Key Encryption — one key lives in Azure/M365, the second key lives exclusively in your KMS; both are required to decrypt. |
| **HYOK** | Hold Your Own Key (Oracle) — OCI Vault External KMS; every encrypt/decrypt is proxied live to your KMS; the key material never enters OCI. |
| **BYOK** | Bring Your Own Key — you generate key material and import it into the provider's KMS; the provider then holds a copy. |
| **CMK** | Customer-Managed Key — the provider generates and stores the key in their KMS, but you control lifecycle (rotate, disable, delete). |
#### Amazon Web Services (AWS)
AWS XKS is a **single proxy API** that AWS KMS calls on behalf of every service — S3, EBS, RDS, DynamoDB, Secrets Manager, etc. all route through the same endpoint. Implementing the [XKS Proxy API](https://docs.aws.amazon.com/kms/latest/developerguide/xks.html) once gives Eviden KMS live-proxy coverage for all XKS-capable AWS services with no per-service work.
| Delegation model | Description | Status |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| **XKS** (live proxy) | Key material never enters AWS; every encrypt/decrypt is proxied to Eviden KMS — covers all AWS services that support KMS encryption (S3, EBS, RDS, DynamoDB, Secrets Manager, SQS, SNS, Redshift, OpenSearch, EMR, Glue, Lambda…) — [docs](./documentation/docs/integrations/cloud_providers/aws/xks.md) | ✅ |
| **BYOK** | Key material generated by you and imported once into AWS KMS; AWS holds a copy | ✅ |
| **CMK** | Key generated and stored inside AWS KMS; you control lifecycle only | 🚧 |
#### Microsoft Azure
Unlike AWS XKS or GCP EKM, Azure has no single proxy gateway — each service integrates with Azure Key Vault independently. Both EKM and DKE are live-proxy models where key material never leaves Eviden KMS; DKE is unique in requiring both your key and Microsoft's key to decrypt.
| Delegation model | Description | Status |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ |
| **EKM** (live proxy) | Key material never leaves Eviden KMS; Azure services proxy encrypt/decrypt operations to Eviden KMS via mTLS — [docs](./documentation/docs/integrations/cloud_providers/azure/ekm.md) | ✅ |
| **DKE** (live proxy) | Key material never leaves Eviden KMS; M365 / Purview requires both your key and Microsoft's key to decrypt | ✅ |
| **BYOK** | Key material generated by you, imported once into Azure Key Vault; Azure holds a copy — applies to Azure Information Protection (AIP) | ✅ |
| **BYOK / CMK** | Key imported or generated inside Azure Key Vault; applies to all remaining Azure data services (Storage, Disk Encryption, SQL/Managed Instance TDE, Cosmos DB, Synapse, Databricks, Container Registry, Monitor, Service Bus, ASK etcd, Backup…) | ✅ |
| **CNG KSP** | Windows CNG Key Storage Provider — device certificate private keys (e.g. Intune SCEP) stored exclusively in Eviden KMS — [docs](./documentation/docs/integrations/cloud_providers/microsoft/windows_cng_ksp.md) | ✅ |
#### Google Cloud Platform (GCP)
GCP EKM is a **single proxy gateway** — like AWS XKS, implementing EKM once covers all CMEK-capable GCP services automatically (Cloud Storage, BigQuery, Cloud SQL, GKE, Pub/Sub, Spanner, Vertex AI, Cloud Functions, Artifact Registry, Secret Manager, Cloud Logging…). Workspace CSE uses the same live-proxy model.
| Delegation model | Description | Status |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------ |
| **EKM** (live proxy) | Key material never enters GCP; every encrypt/decrypt is proxied to Eviden KMS — covers all CMEK-capable GCP services | ✅ |
| **Workspace CSE** (live proxy) | Google Workspace Client-Side Encryption; keys held exclusively in Eviden KMS | ✅ |
| **CSEK** | Customer-Supplied Encryption Key: symmetric key generated in Eviden KMS, wrapped with Google's CSEK certificate and supplied per-request — [docs](./documentation/docs/integrations/cloud_providers/google_gcp/csek.md) | ✅ |
| **BYOK / CMEK** | Key material generated in Eviden KMS, wrapped with Google's import wrapping key, and imported into Cloud KMS — [docs](./documentation/docs/integrations/cloud_providers/google_gcp/cmek.md) | ✅ |
| **CMK** | Key generated and stored in Cloud KMS; you control lifecycle only | 🚧 |
#### Oracle Cloud Infrastructure (OCI)
OCI Vault **External KMS** (HYOK) is a **single proxy gateway** — implementing it once covers all OCI services that support customer-managed keys (Block Volumes, Object Storage, File Storage, Autonomous Database, Oracle Database Service, Kubernetes Secrets in OKE, Streaming, Functions…).
| Delegation model | Description | Status |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| **HYOK / External KMS** (live proxy) | Key material never enters OCI; every encrypt/decrypt is proxied to Eviden KMS — covers all OCI services that support Vault External KMS (Block Volumes, Object Storage, File Storage, Autonomous DB, OKE secrets…) | 🚧 |
| **BYOK** | Key material generated by you and imported once into OCI Vault; Oracle holds a copy | 🚧 |
| **CMK** | Key generated and stored in OCI Vault; you control lifecycle only | 🚧 |
---
### 🗄️ Database Integrations
| Product | Integration | KMIP Version | Status |
| -------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------ | ------ |
| Oracle Database | TDE via PKCS#11 ([docs](./documentation/docs/integrations/databases/oracle_tde.md)) | — | ✅ |
| MongoDB | CSFLE / Queryable Encryption via KMIP ([docs](./documentation/docs/integrations/databases/mongodb.md)) | 1.0 | ✅ |
| MySQL Enterprise | TDE via KMIP ([docs](./documentation/docs/integrations/databases/mysql.md)) | 1.1 | ✅ |
| Percona PostgreSQL | TDE via KMIP ([docs](./documentation/docs/integrations/databases/percona.md)) | 1.4 | ✅ |
| Microsoft SQL Server | External Key Management (EKM) via EKM Provider DLL ([docs](./documentation/docs/integrations/databases/ms_sql_server.md)) | — | ✅ |
| EDB Postgres Adv. Server | TDE via KMIP ([docs](./documentation/docs/integrations/databases/edb_postgres_tde.md)) | 2.1 | ✅ |
| SAP ASE | TDE via PKCS#11 ([docs](./documentation/docs/integrations/databases/sap_ase_tde.md)) | — | ✅ |
| IBM Db2 LUW | TDE via KMIP 1.1 ([docs](./documentation/docs/integrations/databases/ibm_db2_luw_tde.md)) | 1.1 | ✅ |
### 💿 Disk Encryption
| Product | Integration | Status |
| --------- | ------------------------------------------------------------------------------------------------------------ | ------ |
| VeraCrypt | Virtual disk encryption via PKCS#11 ([docs](./documentation/docs/integrations/disk_encryption/veracrypt.md)) | ✅ |
| LUKS | Linux disk encryption via PKCS#11 ([docs](./documentation/docs/integrations/disk_encryption/luks.md)) | ✅ |
| Cryhod | Disk encryption ([docs](./documentation/docs/integrations/disk_encryption/cryhod.md)) | ✅ |
### 💾 Storage Integrations
| Product | Integration | KMIP Version | Status |
| -------------- | ------------------------------------------------------------------------------------------------------ | ------------ | ------ |
| VMware vCenter | Trust Key Provider ([docs](./documentation/docs/integrations/storage/vcenter.md)) | 1.1 | ✅ |
| Synology DSM | NAS volume encryption via KMIP ([docs](./documentation/docs/integrations/storage/synology_dsm.md)) | 1.2 | ✅ |
| VAST Data | Storage encryption EKM via KMIP ([docs](./documentation/docs/integrations/storage/vast_data.md)) | 1.4 | ✅ |
| Veeam Backup | Backup encryption key management via KMIP ([docs](./documentation/docs/integrations/storage/veeam.md)) | 1.4 | ✅ |
### 🗃️ Big Data
| Product | Integration | KMIP Version | Status |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | ------ |
| Snowflake | Native App — column-level encryption ([docs](./documentation/docs/integrations/big_data/snowflake_native_app/index.md)) | 2.1 | ✅ |
| Big Data / Python UDFs | Bulk encrypt/decrypt for PySpark / Databricks ([docs](./documentation/docs/integrations/big_data/user_defined_function_for_pyspark_databricks_in_python/index.md)) | — | ✅ |
### ☸️ Container Orchestration
| Product | Integration | Status |
| ---------- | --------------------------------------------------------------------------------------------------------------------- | ------ |
| Kubernetes | etcd Secrets encryption via KMS v2 provider API ([docs](./documentation/docs/integrations/kubernetes/index.md)) | ✅ |
### 🏗️ Infrastructure as Code
| Product | Integration | Status |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ |
| Terraform / OpenTofu | Keys, key pairs, certificates, and access rights as IaC ([docs](./documentation/docs/integrations/terraform.md), [registry](https://registry.terraform.io/providers/Cosmian/kms)) | ✅ |
### 🔗 Other Integrations
| Product | Integration | KMIP Version | Status |
| ------------------- | -------------------------------------------------------------------------------------------------------------- | ------------ | ------ |
| FortiGate / FortiOS | External KMS via KMIP 1.0–1.4 ([docs](./documentation/docs/integrations/fortigate.md)) | 1.0 | ✅ |
| OpenSSH | Certificate-based authentication ([docs](./documentation/docs/integrations/openssh.md)) | — | ✅ |
| S/MIME | Email encryption ([docs](./documentation/docs/integrations/smime.md)) | — | ✅ |
| GnuPG / OpenPGP | OpenPGP keys (`PGPKey`): create, import, export, encrypt, decrypt, sign, verify; non-FIPS only ([docs](./documentation/docs/integrations/gnupg/openpgp.md)) | 2.1 | ✅ |
| GnuPG smartcard | KMS RSA keys as a GnuPG smartcard via gnupg-pkcs11-scd ([docs](./documentation/docs/integrations/gnupg/smartcard.md)) | — | ✅ |
| PyKMIP | PyKMIP-compatible interface for testing and Synology DSM ([docs](./documentation/docs/integrations/pykmip.md)) | 1.2 | ✅ |
---
---
<!-- KMIP_SUPPORT_START -->
<!-- This section is auto-generated from documentation/docs/kmip/support.md by scripts/update_readme_kmip.py. Do not edit manually. -->
## KMIP support by Eviden KMS
This page summarizes the KMIP coverage in Eviden KMS. The support status is
derived from the actual implementation in `crate/server/src/core/operations`.
**Eviden KMS Server supports KMIP versions:** 2.1, 2.0, 1.4, 1.3, 1.2, 1.1, 1.0
Legend:
- ✅ Fully supported
- ❌ Not implemented
- 🚫 Deprecated
- N/A Not applicable (operation/attribute not defined in that KMIP version)
### KMIP Baseline Profile Compliance
**Baseline Server:** ✅ Compliant (all 9 required + 18/18 optional)
The Baseline Server profile (defined in KMIP Profiles v2.1 Section 4.1) requires:
- **Required operations:** Discover Versions, Query, Create, Register, Get, Destroy, Locate, Activate, Revoke
- **Optional operations:** Many additional operations for extended functionality
### KMIP Coverage
#### Messages
| Message | Support |
| ---------------- | ------: |
| Request Message | ✅ |
| Response Message | ✅ |
#### Operations by KMIP Version
The following table shows operation support across all KMIP versions.
| Operation | 1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 2.0 | 2.1 |
| --------- | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: |
| Activate | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Add Attribute | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Archive | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Cancel | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Certify | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Check | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Create | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Create Key Pair | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Create Split Key | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Decrypt | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Delegated Login | N/A | N/A | N/A | N/A | N/A | ❌ | ❌ |
| Delete Attribute | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| DeriveKey | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Destroy | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Discover Versions | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Encrypt | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Export | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Get | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Get Attribute List | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Get Attributes | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Get Constraints | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Get Usage Allocation | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Hash | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Import | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Join Split Key | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Locate | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Login | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Logout | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| MAC | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| MAC Verify | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Notify | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Obtain Lease | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Poll | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Put | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Query | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| RNG Retrieve | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| RNG Seed | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Re-certify | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Re-key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Re-key Key Pair | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Recover | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Register | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Revoke | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Set Attribute (Modify) | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Set Constraints | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Sign | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Signature Verify | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Validate | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
#### Login tickets and constraints
- **Login** issues a 32-byte random ticket (Ticket Type `Login`) bound to the user that the
transport authenticated (TLS client certificate, JWT, API token or default user). A Request
Message whose header carries a `Ticket` credential is processed only if the ticket is known,
unexpired and issued to that same user (else `Invalid Ticket`) and has requests left (else
`Usage Limit Exceeded`); each message consumes one request. Tickets never replace transport
authentication.
- Lease Time: an Interval in seconds; 0 or absent selects 1 hour; capped at 24 hours. The
Date Time form is not supported.
- Request Count: absent means unlimited within the lease; zero or negative is
`Invalid Field`. Usage Limits are not supported (`Feature Not Supported`).
- At most 10,000 live tickets, 64 per user (`Server Limit Exceeded` beyond).
- **Logout** invalidates a ticket issued to the same user, whatever requests it has left
(else `Invalid Ticket`). Delegated Login (rights-restricted tickets) is not supported.
- A Request Message carrying a Hashed Password credential is refused with `Feature Not Supported`:
the server holds no client password and cannot return the Server Hashed Password.
- **Set Constraints** replaces the server-wide constraint set; a request without Constraints
clears it. **Get Constraints** returns it as set. When roles are configured, only Crypto
Officers may set constraints; otherwise any authenticated user may.
- While constraints are set, every object stored by Create, Create Key Pair, Register,
Import, Derive Key, Re-key, Re-key Key Pair (including automatic rotation), Re-certify,
Certify, Create Split Key and Join Split Key must satisfy at least one constraint (Object
Type listed, Object Group listed, every listed attribute value present), otherwise the
operation fails with `Constraint Violation`. Attribute changes on existing objects are not
checked.
- Tickets and constraints are held in memory only: they are lost on restart and not shared
between server instances.
PKCS#11 needs an HSM and a configured Crypto Officer; Query lists it only when both are configured.
#### Methodology
- Operations marked ✅ are backed by a Rust implementation file under `crate/server/src/core/operations`.
- Operations marked ❌ are defined in the KMIP specification but not implemented in Eviden KMS.
- Operations marked N/A do not exist in that particular KMIP version.
- This documentation is auto-generated by analyzing source code and KMIP specifications.
If you spot a mismatch or want to extend coverage, please open an issue or PR.
#### Managed Objects
The following table shows managed object support across all KMIP versions.
| Managed Object | 1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 2.0 | 2.1 |
| -------------- | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: |
| Certificate | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Symmetric Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Public Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Private Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Split Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Template | 🚫 | 🚫 | 🚫 | 🚫 | 🚫 | N/A | N/A |
| Secret Data | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Opaque Data | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| PGP Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Notes:
- Opaque Object import support is present (see `import.rs`).
- PGP Key objects are supported (Create, Import, Export, Encrypt, Decrypt, Sign, SignatureVerify) in non-FIPS mode.
- Template objects are deprecated in newer KMIP versions.
#### Base Objects
The following table shows base object support across all KMIP versions.
| Base Object | 1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 2.0 | 2.1 |
| ----------- | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: |
| Attribute | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Credential | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Key Block | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Key Value | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| Key Wrapping Data | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Key Wrapping Specification | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Transparent Key Structures | ✅ | ✅ | ✅ | ✅ | ✅ | N/A | N/A |
| Template-Attribute Structures | N/A | ✅ | ✅ | ✅ | ✅ | N/A | N/A |
| Server Information | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Extension Information | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Data | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Data Length | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Signature Data | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| MAC Data | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Nonce | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Correlation Value | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Init Indicator | N/A | N/A | N/A | ✅ | ✅ | ✅ | ✅ |
| Final Indicator | N/A | N/A | N/A | ✅ | ✅ | ✅ | ✅ |
| RNG Parameters | N/A | N/A | N/A | ✅ | ✅ | ✅ | ✅ |
| Profile Information | N/A | N/A | N/A | ❌ | ❌ | ❌ | ❌ |
| Validation Information | N/A | N/A | N/A | ❌ | ❌ | ❌ | ❌ |
| Capability Information | N/A | N/A | N/A | ❌ | ❌ | ❌ | ❌ |
| Authenticated Encryption Additional Data | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Authenticated Encryption Tag | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
Notes:
- AEAD Additional Data and Tag are supported in encrypt/decrypt APIs.
- Nonce and RNG Parameter are used by symmetric encryption paths.
- Base objects are fundamental structures present across all KMIP versions.
#### Transparent Key Structures
The following table shows transparent key structure support across all KMIP versions.
| Structure | 1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 2.0 | 2.1 |
| --------- | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: | :-----: |
| Symmetric Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| DSA Private Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| DSA Public Key | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| RSA Private Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| RSA Public Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| DH Private Key | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| DH Public Key | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| EC Private Key | N/A | N/A | N/A | ✅ | ✅ | ✅ | ✅ |
| EC Public Key | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| ECDSA Private Key | ✅ | ✅ | ✅ | ✅ | ✅ | N/A | N/A |
| ECDSA Public Key | ✅ | ✅ | ✅ | ✅ | ✅ | N/A | N/A |
| ECDH Private Key | ✅ | ✅ | ✅ | ✅ | ✅ | N/A | N/A |
| ECDH Public Key | ✅ | ✅ | ✅ | ✅ | ✅ | N/A | N/A |
| ECMQV Private Key | ❌ | ❌ | ❌ | ❌ | ❌ | N/A | N/A |
| ECMQV Public Key | ❌ | ❌ | ❌ | ❌ | ❌ | N/A | N/A |
Note: EC/ECDSA/ECDH support is present; DH/DSA/ECMQV are not implemented.
#### Attributes
| Attribute | 1.0 | 1.1 | 1.2 | 1.3 | 1.4 | 2.0 | 2.1 |
| ---------------------------------------- | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| Activation Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Alternative Name | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Always Sensitive | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Application Specific Information | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Archive Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Attribute Index | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 |
| Certificate Attributes | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Certificate Length | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Certificate Type | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Comment | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Compromise Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Compromise Occurrence Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Contact Information | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Critical | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 |
| Cryptographic Algorithm | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Cryptographic Domain Parameters | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Cryptographic Length | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Cryptographic Parameters | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Cryptographic Usage Mask | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Deactivation Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Description | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Destroy Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Digest | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Digital Signature Algorithm | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Extractable | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Fresh | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Initial Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Key Format Type | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Key Value Location | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Key Value Present | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| Last Change Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Lease Time | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Link | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Name | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Never Extractable | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Nist Key Type | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Object Group | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Object Group Member | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 | 🔧 |
| Object Type | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Opaque Data Type | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Original Creation Date | N/A | N/A | ✅ | ✅ | ✅ | ✅ | ✅ |
| PKCS#12 Friendly Name | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Process Start Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Protect Stop Date | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Protection Level | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Protection Period | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Protection Storage Mask | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Quantum Safe | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| Random Number Generator | N/A | N/A | N/A | ✅ | ✅ | ✅ | ✅ |
| Revocation Reason | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Rotate Automatic | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Rotate Date | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Rotate Generation | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Rotate Interval | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Rotate Latest | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Rotate Name | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Rotate Offset | N/A | N/A | N/A | N/A | N/A | N/A | ✅ |
| Sensitive | N/A | N/A | N/A | N/A | ✅ | ✅ | ✅ |
| Short Unique Identifier | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| State | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Unique Identifier | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Usage Limits | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| Vendor Attribute | N/A | N/A | N/A | N/A | N/A | ✅ | ✅ |
| X.509 Certificate Identifier | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| X.509 Certificate Issuer | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
| X.509 Certificate Subject | N/A | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
Notes:
- ✅ = attribute defined in that KMIP version **and** implemented by this server.
- ❌ = attribute defined in that KMIP version but **not yet implemented**.
- N/A = attribute was **not defined** in that KMIP version (protocol gap, not a server limitation).
- 🔧 = **Cosmian-specific extension** — attribute is absent from all standard KMIP versions.
- GetAttributes returns a union of metadata attributes and those embedded in KeyBlock structures.
- "Vendor Attributes" are available via the Cosmian vendor namespace and are accessible via GetAttributes.
- `AlwaysSensitive`, `NeverExtractable`, `Extractable`, and `Sensitive` were introduced in **KMIP 1.4**
and must not appear in responses to KMIP 1.0–1.3 clients (the server enforces this automatically).
- `Rotate*` attributes were introduced in **KMIP 2.1**.
- A key registered without its Key Value gets `Key Value Present` = false and keeps its
`Key Value Location` (one instance); Get returns it as registered, and a Get or Export asking
for a Key Format Type or key wrapping fails with `Key Value Not Present`.
<!-- KMIP_SUPPORT_END -->
## 🗄️ Repository content
The **Eviden KMS** is written in [Rust](https://www.rust-lang.org/) and organized as a Cargo workspace with multiple crates. The repository contains the following main components:
### 🧰 Binaries
- **KMS Server** (`cosmian_kms`) - The main KMS server binary built from `crate/server`
### 🧱 Core Crates
#### 🖧 Server Infrastructure
- **`server`** - Main KMS server implementation with REST API, KMIP protocol support, and web UI
- **`server_database`** - Database abstraction layer supporting SQLite, PostgreSQL, MySQL/MariaDB/Percona, and Redis with Findex ([documentation](./documentation/docs/configuration/database/configuration.md))
- **`access`** - Permission and access control management system
Cosmian-only crate dependencies for the server crate (`crate/server`):
```mermaid
flowchart TD
server[server]
server --> access
server --> base_hsm
server --> server_database
base_hsm --> hsm_loaders
hsm_loaders --> smartcardhsm
hsm_loaders --> crypt2pay
hsm_loaders --> proteccio
hsm_loaders --> softhsm2
hsm_loaders --> utimaco
hsm_loaders --> aws_cloudhsm
hsm_loaders --> other
server_database --> kmip
server_database --> crypto
server_database --> interfaces
```
#### 🧑💻 Client Libraries
- **`kms_client`** - High-level Rust client library for KMS server communication
- **`client_utils`** - Shared utilities for client implementations
- **`wasm`** - WebAssembly bindings for browser-based clients
#### 🔐 Cryptographic Components
- **`crypto`** - Core cryptographic operations and algorithm implementations
- **`kmip`** - Complete implementation of the KMIP (Key Management Interoperability Protocol) standard versions 1.0-2.1
- **`kmip-derive`** - Procedural macros for KMIP protocol serialization/deserialization
#### 🔐 Hardware Security Module (HSM) Support
- **`hsm/base_hsm`** - Base HSM abstraction layer
- **`hsm/smartcardhsm`** - Nitrokey HSM 2 resp. CardContact SmartCard-HSM
- **`hsm/crypt2pay`** - Crypt2pay HSM integration
- **`hsm/proteccio`** - Proteccio HSM integration
- **`hsm/softhsm2`** - SoftHSM2 integration for testing and development
- **`hsm/utimaco`** - Utimaco HSM integration
- **`hsm/other`** - Other HSMs support
#### 🗄️ Database Interfaces
- **`interfaces`** - Database and storage backend abstractions
#### 🧪 Development and Testing
- **`test_kms_server`** - Library for programmatic KMS server instantiation in tests
- **`cli`** - Legacy CLI crate (now primarily used for testing)
### 📁 Additional Directories
- **`documentation/`** - Comprehensive project documentation built with mdBook
- **`examples/`** - Code examples and integration samples
- **`scripts/`** - Build and deployment scripts
- **`test_data/`** - Test fixtures and sample data
- **`ui/`** - Frontend web interface source code
- **`pkg/`** - Packaging configurations for Debian and RPM distributions
**Note:** Each crate contains its own README with detailed information. Please refer to these files for specific implementation details and usage instructions.
Find the [public documentation](https://docs.cosmian.com) of the KMS in the `documentation`
directory.
### 🏗️ Building and running the KMS
Two paths are supported:
- For production use, use Nix build: use the unified script `.mise/scripts/nix.sh` (via `mise run`) for a pinned toolchain,
reproducible FIPS builds (non-FIPS builds are tracked for consistency), and packaging.
- For development purpose, use traditional `cargo` command: `cargo build...`, `cargo test`
#### GLIBC Support
The following table shows the GLIBC versions and distribution support for **Eviden KMS**:
| Distribution | Version | GLIBC | Support | End of Support |
| --------------- | ------------------ | ----- | ------- | -------------- |
| **Debian** | 13 (Trixie) | 2.40 | ✅ | TBD |
| **Debian** | 12 (Bookworm) | 2.36 | ✅ | ~2028 (LTS) |
| **Debian** | 11 (Bullseye) | 2.31 | ❌ | ~2026 (LTS) |
| **Debian** | 10 (Buster) | 2.28 | ❌ | Jun 2024 (LTS) |
| **Debian** | 9 (Stretch) | 2.24 | ❌ | Jun 2022 (LTS) |
| **Rocky Linux** | 10 | 2.40 | ✅ | TBD |
| **Rocky Linux** | 9 | 2.34 | ✅ | May 2032 |
| **Rocky Linux** | 8 | 2.28 | ❌ | May 2029 |
| **Ubuntu** | 25.04 (Plucky) | 2.40 | ✅ | Jan 2026 |
| **Ubuntu** | 24.04 LTS (Noble) | 2.39 | ✅ | Apr 2029 |
| **Ubuntu** | 22.04 LTS (Jammy) | 2.35 | ✅ | Apr 2027 |
| **Ubuntu** | 20.04 LTS (Focal) | 2.31 | ❌ | Apr 2025 |
| **Ubuntu** | 18.04 LTS (Bionic) | 2.27 | ❌ | Apr 2023 |
**Note:** Cosmian KMS requires **GLIBC 2.34** or higher (available in Debian 12+, Rocky Linux 9+, and Ubuntu 22.04+).
#### Alpine Linux (musl)
In addition to the GLIBC packages above, Cosmian KMS publishes Alpine **`.apk`** packages
(musl builds) for `cosmian_kms` (server, with an OpenRC service) and `ckms` (CLI) that run natively on Alpine Linux — tested against
Alpine 3.20, 3.21, and `latest` — with no `gcompat` shim required. See the
[Getting started guide](documentation/docs/installation/installation_getting_started.md)
for install instructions and a Dockerfile example.
| Variant | musl linking | Alpine requirement | Notes |
| -------- | ----------------------------- | -------------------------- | ---------------------------------------------------------------------- |
| FIPS | Dynamic (`ld-musl-<arch>.so.1`) | `libgcc` (pulled in automatically by `apk`) | Full feature parity with the GLIBC build (FIPS provider loads via `dlopen`). |
| non-FIPS | Fully static (`+crt-static`) | None — zero extra packages | Old PKCS#12/RC2 import is unsupported (musl's static libc cannot `dlopen` the legacy OpenSSL provider); all other algorithms, including PQC and Covercrypt, are unaffected. |
**Note:** HSM backends (Utimaco, Proteccio, SmartCard HSM, Crypt2Pay) are **not supported**
on the Alpine packages — vendor PKCS#11 drivers are glibc-only shared libraries.
#### OpenSSL prerequisite
The following table shows the OpenSSL versions used by **Cosmian KMS** variants:
| OpenSSL Linkage | FIPS | Non‑FIPS |
| --------------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------- |
| Static | Linkage: OpenSSL 3.6.5; runtime loads FIPS provider from OpenSSL 3.1.2 | Linkage: OpenSSL 3.6.5; runtime uses default/legacy providers |
| Dynamic | Linkage: OpenSSL 3.1.2; ships FIPS configs and provider OpenSSL 3.1.2 | Linkage: OpenSSL 3.6.5; ships `libssl`/`libcrypto` and providers |
Notes:
- FIPS builds include `fipsmodule.cnf` and the FIPS provider
#### ✨ Features
From version 5.4.0, the KMS runs in FIPS mode by default.
The non-FIPS mode can be enabled by passing the `--features non-fips` flag to `cargo build` or `cargo run`.
The `interop` feature enables KMIP interoperability test operations, which are disabled by default for security reasons.
These operations should only be enabled during testing: `cargo build --features interop` or `cargo test --features interop`.
All builds link against OpenSSL 3.6.5. FIPS variants ship the FIPS provider and `fipsmodule.cnf`; non‑FIPS variants use the default/legacy providers. For non‑Nix development, ensure OpenSSL 3.6.5+ is available.
#### 🖥️ Linux or macOS
Nix-based (reproducible FIPS builds):
```sh
# Run tests (defaults to sqlite; DB backends require services)
mise run test:db:sqlite
# Package artifacts (Linux → deb+rpm, macOS → dmg)
mise run package
```
Simple (Cargo-only):
```sh
cargo build
cargo test --lib --workspace
cargo test --lib --workspace --features non-fips
```
#### 🪟 Windows
Follow the prerequisites below, or use the provided PowerShell helpers.
Prerequisites (manual):
1. Install Visual Studio (C++ workload + clang), Strawberry Perl, and `vcpkg`.
2. Install OpenSSL 3.6.5 with vcpkg:
In this project root directory, run:
```powershell
vcpkg install --triplet x64-windows-static # arm64-windows-static for ARM64
$env:OPENSSL_DIR=(Get-Item .).FullName+"\vcpkg_installed\vcpkg\pkgs\openssl_x64-windows-static"
```
For FIPS builds (to build fips.dll):
```powershell
Copy-Item -Path "vcpkg_fips.json" -Destination "vcpkg.json"
vcpkg install
vcpkg integrate install
```
PowerShell helpers (non-FIPS by default):
```powershell
. .mise/scripts/windows/cargo_build.ps1
BuildProject -BuildType release # or debug
. .mise/scripts/windows/cargo_test.ps1
TestProject -BuildType release # or debug
```
#### 📦 Packaging (DEB/RPM/DMG) and hashes
Use the Nix entrypoint to build packages:
```sh
# Linux
mise run package # builds deb + rpm
mise run package:deb # build deb only
mise run package:rpm # build rpm only
# macOS
mise run package:dmg
```
On success, a SHA-256 checksum file (.sha256) is written next to each generated package
(.deb/.rpm/.dmg) to ease verification and artifact distribution.
### 🧪 Running the unit and integration tests
Pull the test data using:
```sh
git submodule update --init --recursive
```
By default, tests are run using `cargo test` and an SQLCipher backend (called `sqlite`).
This can be influenced by setting the `KMS_TEST_DB` environment variable to
- `sqlite`, for plain SQLite
- `mysql` (requires a running MySQL or MariaDB server connected using a
`"mysql://kms:kms@localhost:3306/kms"` URL)
- `postgresql` (requires a running PostgreSQL server connected using
a `"postgresql://kms:kms@127.0.0.1:5432/kms"`URL)
- `redis` (requires a running Redis server connected using a
`"redis://localhost:6379"` URL)
Example: testing with a plain SQLite and some logging
```sh
RUST_LOG="error,cosmian_kms_server=info,cosmian_kms_cli=info" KMS_TEST_DB=sqlite cargo test
```
Alternatively, when writing a test or running a test from your IDE, the following can be inserted
at the top of the test:
```rust
unsafe {
set_var("RUST_LOG", "error,cosmian_kms_server=debug,cosmian_kms_cli=info");
set_var("RUST_BACKTRACE", "1");
set_var("KMS_TEST_DB", "redis");
}
log_init(option_env!("RUST_LOG"));
```
### ⚙️ Development: running the server with cargo
To run the server with cargo, you need to set the `RUST_LOG` environment variable to the desired
log level and select the correct backend (which defaults to `sqlite`).
```sh
RUST_LOG="info,cosmian_kms_server=debug" \
cargo run --bin cosmian_kms --features non-fips -- \
--database-type redis-findex --database-url redis://localhost:6379 \
--redis-master-password secret --redis-findex-label label
```
### 🔧 Server parameters
If a configuration file is provided, parameters are set following this order:
- conf file (env variable `COSMIAN_KMS_CONF` set by default to `/etc/cosmian/kms.toml`)
- default (set on struct)
Otherwise, the parameters are set following this order:
- args in the command line
- env var
- default (set on struct)
## ☁️ Use the KMS inside a Cosmian VM on SEV/TDX
See the [Marketplace guide](documentation/docs/installation/marketplace_guide.md) for more details about Cosmian VM.
## 🏷️ Releases
All releases can be found in the public URL [package.cosmian.com](https://package.cosmian.com/kms/).
## 📈 Benchmarks
To run benchmarks, go to the `crate/test_kms_server` directory and run:
```sh
cargo bench
```
Typical values for single-threaded HTTP KMIP 2.1 requests
(zero network latency) are as follows
```text
- RSA PKCSv1.5:
- encrypt
- 2048 bits: 128 microseconds
- 4096 bits: 175 microseconds
- decrypt
- 2048 bits: 830 microseconds
- 4096 bits: 4120 microseconds
- RSA PKCS OAEP:
- encrypt
- 2048 bits: 134 microseconds
- 4096 bits: 173 microseconds
- decrypt
- 2048 bits: 849 microseconds
- 4096 bits: 3823 microseconds
- RSA PKCS KEY WRP (AES):
- encrypt
- 2048 bits: 142 microseconds
- 4096 bits: 198 microseconds
- decrypt
- 2048 bits: 824 microseconds
- 4096 bits: 3768 microseconds
- RSA Keypair creation (saved in KMS DB)
- 2048 bits: 33 milliseconds
- 4096 bits: 322 milliseconds
```
## 🤝 Community & Support
- Docs: `documentation/` and online docs at <https://docs.cosmian.com/key_management_system/>
- Issues: use GitHub Issues to report bugs and request features
- Contributing: see [`CONTRIBUTING.md`](CONTRIBUTING.md)
- Security disclosures: see [`SECURITY.md`](SECURITY.md)
- License: see [`LICENSE`](LICENSE)