DOCSEARCHbyAlgolia
Submit Docs

Eviden KMS (formerly Cosmian KMS)

repository·develop·Indexed 43 days ago

https://github.com/cosmian/kms

A high-performance, FIPS 140-3 compliant Key Management System and Public Key Infrastructure (PKI) written in Rust. It provides scalable cryptographic services including key lifecycle management, encryption/decryption, and certificate management. Features include a KMIP-based HTTP client, a PKCS#11 provider for integration with applications like LUKS and VeraCrypt, a Windows CNG Key Storage Provider, and support for HSMs and Post-Quantum Cryptography (PQC).

Tokens
454.8K
Snippets
1.1K
Records
1.6K
Agent score
56%

What's inside Eviden KMS

  1. Overview of Cosmian KMS test inventory

    develop

    The Cosmian KMS test suite is distributed across several crates, covering server logic, cryptographic primitives, KMIP protocols, and client implementations:

    • cosmian_kms_server: Covers configuration, core operations (hash, mac, signature, etc.), middleware, and integration tests (Azure EKM, Covercrypt, Google CSE).
    • cosmian_kms_crypto: Validates cryptographic primitives including Elliptic Curves (ECIES, ECDSA, EdDSA), PQC (ML-KEM, ML-DSA, SLH-DSA), RSA, and Symmetric ciphers (AES, ChaCha20).
    • cosmian_kmip: Focuses on KMIP 1.4 and 2.1 serialization, TTLV (Tag-Type-Length-Value) wire formats, and interop with VMware, MongoDB, and MySQL.
    • cosmian_kms_server_database: Tests database connection string redaction, LRU caching, and SQL/Redis storage backends.
    • clients: Includes tests for the ckms CLI, client HTTP client, and pkcs11 providers.
    • test_kms_server: Provides smoke tests and the vector_runner for integration replays.
    • HSM crates: Contains test suites for hardware backends like softhsm2, utimaco, proteccio, smartcardhsm, and crypt2pay (these are marked as #[ignore] and require actual hardware).

  2. Overview of the Base HSM Implementation

    develop
    The cosmian_kms_base_hsm crate provides a PKCS#11 client implementation for Hardware Security Modules (HSMs). It defines the core traits required for HSM operations and provides data structures for managing keys and their associated metadata. This crate acts as an abstraction layer for interacting with HSMs through the PKCS#11 standard.

  3. Overview of Cosmian KMS SBOM generation

    develop

    Cosmian KMS generates Software Bill of Materials (SBOM) reports from Nix build outputs to provide a complete and reproducible view of dependencies. The generation pipeline covers three distinct layers:

    1. System / Nix runtime: Shared libraries linked at runtime (e.g., glibc, openssl, libidn2) using sbomnix.
    2. Rust crates: Approximately 670 third-party crates compiled into the binary (from Cargo.lock), enriched via enrich_sbom_authors.py.
    3. npm/pnpm packages: Approximately 310 third-party UI packages (from ui/pnpm-lock.yaml), enriched via enrich_sbom_authors.py.

    The resulting bom.cdx.json (CycloneDX) and bom.spdx.json (SPDX) files are automatically enriched with supplier/author information and CPE 2.3 identifiers.

  4. Overview of VMware vSphere Integration with Eviden KMS

    develop

    Eviden KMS acts as an external Key Management Server (KMS) for VMware vSphere infrastructure using the KMIP 1.1 protocol over TCP/TLS with mutual certificate authentication (mTLS).

    Integration Details

    • Protocol: KMIP 1.1 over TCP/TLS
    • Port: 5696 (IANA-registered KMIP port)
    • Key Type: AES-256 symmetric key
    • Supported vSphere Versions: vSphere 6.5 and above (Standard Key Provider)
    • Compliance: Supports both FIPS and non-FIPS builds; operates in FIPS 140-3 validated mode.

  5. Overview of Cosmian KMS Client Utilities

    develop

    The cosmian_kms_client_utils crate provides shared utility functions used by both the native client and WASM wasm crates within the Cosmian KMS ecosystem. It centralizes logic for:

    • KMIP Request/Response Handling: Standardized processing for KMIP protocol messages.
    • Data Format Conversion: Utilities to convert between common cryptographic and data formats, including PEM, DER, base64, and JSON.
    • Client Configuration: Shared logic for managing and applying client settings.

  6. Overview of Cosmian KMIP implementation

    develop

    Cosmian KMIP provides a complete implementation of the KMIP 1.0–2.1 protocols. It supports both TTLV (Tag-Type-Length-Value) binary serialization and JSON serialization. The crate defines all KMIP objects, operations, attributes, and enumerations as native Rust types.

    In a typical server architecture, cosmian_kms_server uses this crate to deserialize incoming KMIP requests and route them to the appropriate operation implementations.

  7. Overview of the REST Native Crypto API

    develop

    The Eviden KMS provides a lightweight REST Native Crypto API accessible via the /v1/crypto path. This API is designed around JOSE (JSON Object Signing and Encryption) conventions, adhering to:

    A critical security property of this API is that key material never leaves the KMS. Network transmissions are limited to ciphertexts, signatures, and MACs.

  8. Overview of Cosmian KMS Crypto primitives

    develop

    The crypto crate provides a cryptographic primitives wrapper around OpenSSL 3.6.0. It supports a wide range of algorithms for encryption, signing, hashing, and key derivation.

    Supported algorithms include:

    • Symmetric Encryption: AES, ChaCha20-Poly1305
    • Asymmetric Encryption/Signing: RSA, EC (Elliptic Curve)
    • Hashing: SHA-2, SHA-3
    • Message Authentication: HMAC
    • Key Derivation: Various KDFs, including Argon2
    • Post-Quantum Cryptography (PQC): When the non-fips feature is enabled, the crate supports ML-KEM, ML-DSA, SLH-DSA, and Covercrypt.

  9. Use Eviden KMS as a Public Key Infrastructure (PKI)

    develop

    Eviden KMS acts as an X.509 certificate authority (CA) capable of issuing, storing, validating, and revoking certificates. It supports both classical (RSA, EC, EdDSA) and post-quantum (ML-DSA, SLH-DSA, ML-KEM) algorithms.

    Supported Standards

    • RFC 5280: X.509 PKI Certificate and CRL Profile
    • RFC 8017: PKCS #1 v2.2 (RSA)
    • RFC 5480: ECC Subject Public Key Information
    • RFC 8032: EdDSA (Ed25519/Ed448)
    • RFC 9881: ML-DSA in X.509 (FIPS 204)
    • RFC 9909: SLH-DSA in X.509 (FIPS 205)
    • RFC 9935: ML-KEM in X.509 (FIPS 203)
    • RFC 6960/9654: OCSP support

    Certificate Export Formats

    Certificates and private keys can be exported in:

    • PEM (.pem): Base64-encoded.
    • DER (.der): Binary ASN.1.
    • PKCS#12 (.p12 / .pfx): Password-protected bundle of certificate and private key.

  10. Use the Cosmian KMS CNG Key Storage Provider

    develop
    The Cosmian KMS CNG Key Storage Provider is a Windows CNG (Cryptography Next Generation) Key Storage Provider (KSP) DLL. It allows Windows applications to store and manage private keys inside Cosmian KMS instead of the local Windows machine store. This enables centralized key management and hardware-backed security for Windows-native cryptographic operations.

  11. Use Cosmian KMS as a PKCS#11 provider

    develop

    The Cosmian KMS PKCS#11 provider allows you to use the cloud-based Cosmian KMS as a cryptographic device via the PKCS#11 standard (v2.40). This enables integration with any application that supports PKCS#11.

    Common use cases include:

    • Providing keyfiles for VeraCrypt.
    • Providing keys for LUKS (Linux Unified Key Setup).
    • General cryptographic operations for any PKCS#11 compliant software.

  12. Use the Cosmian KMS Client for KMIP operations

    develop

    The cosmian_kms_client is an HTTP client library designed for communicating with the Cosmian KMS server. It provides type-safe, asynchronous KMIP (Key Management Interoperability Protocol) operations.

    It supports multiple authentication mechanisms, including:

    • API keys
    • OAuth 2.0
    • Certificate-based authentication

    This client is the core library used by the Cosmian KMS CLI and is intended for use in any custom integrations requiring direct communication with the KMS server.