{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "version": 1, "metadata": { "authors": [ { "name": "dz zweigle" } ], "component": { "type": "application", "bom-ref": "hsm-signer", "name": "A3E9 HSM Signing Service", "description": "PKCS#11-based financial signing daemon (signing-server). This CBOM covers the cryptographic algorithms and libraries reachable from this component and its in-tree Craton HSM module; it does not cover optional vendor HSM PKCS#11 .so libraries (Thales, AWS CloudHSM, Utimaco), which are supplied by the client's HSM vendor at deploy time, not by this repository.", "version": "v0.0.0-test4-250-ga0252b7-dirty", "properties": [ { "name": "a3e9:git-commit", "value": "a0252b783245e9c0ea749b8e279ed22728301072" }, { "name": "a3e9:cbom-generator", "value": "scripts/gen_cbom.py" }, { "name": "a3e9:cbom-scope", "value": "Generated from compliance/cbom_manifest.json plus a scan of the source tree. Every cryptographic-asset carries evidence.occurrences pointing at the source lines that prove it is reachable. Regenerate with `make cbom`; `make cbom-check` fails when this file is stale." }, { "name": "a3e9:mechanisms-scanned", "value": "63" }, { "name": "a3e9:scan-roots", "value": "src, tools, vendor/a3e9-audit" } ] }, "timestamp": "2026-08-08T21:46:38Z" }, "components": [ { "type": "library", "bom-ref": "openssl", "name": "OpenSSL", "version": "3.0.13", "description": "Software cryptography provider used directly (license Ed25519 verification, SHA-256 hardware-binding hash, audit-log HMAC-SHA256, PBKDF2 PIN derivation, RAND_bytes for salt generation) and indirectly by every PKCS#11 shim's software fallback paths and by the in-tree Craton HSM module. Version below is probed from the host that generated this CBOM. The production container image (Dockerfile) installs libssl3 from the Ubuntu 22.04 base without a pinned point version, so the exact patch version in a given built image may drift with base-image updates.", "scope": "required", "purl": "pkg:generic/openssl@3.0.13" }, { "type": "library", "bom-ref": "softhsm2", "name": "SoftHSM2", "version": "2.6.1", "description": "Software PKCS#11 token used for local development and the integration test suite (make test-integration) only. NOT present in the production container image -- README_DEPLOYMENT.md explicitly states SoftHSM2 must never be used in production (keys are plaintext on the OS filesystem, no hardware isolation boundary).", "scope": "excluded", "purl": "pkg:generic/softhsm2@2.6.1" }, { "type": "library", "bom-ref": "liboqs", "name": "liboqs (Open Quantum Safe)", "version": "unpinned", "description": "Provides native ML-DSA / ML-KEM support for the in-tree Craton HSM module (src/craton_hsm/, PqcSoftwareEngine) on vendor profiles without hardware PQC support. UNPINNED DEPENDENCY: .github/workflows/cd.yml builds it via `git clone --depth 1` of the upstream main branch with no version tag or commit pin -- the exact algorithm implementation shipped in a given build is not reproducible from this repository alone. Flagged here as a supply-chain gap, not asserted as a specific version.", "scope": "required", "purl": "pkg:github/open-quantum-safe/liboqs" }, { "type": "library", "bom-ref": "craton-hsm", "name": "Craton HSM (in-tree software PKCS#11 module)", "version": "in-tree @ a0252b7", "description": "A3E9's own software PKCS#11 v3.0 module. Baked into the production Docker image (Dockerfile COPY libcraton_hsm.so) and used as the default P11_LIB unless a hardware vendor .so is mounted in at deploy time. Classical primitives via OpenSSL EVP; ML-DSA/ML-KEM via liboqs (see that component). NOT a hardware security boundary -- see docs/Craton_Limitations.md.", "scope": "required" }, { "type": "cryptographic-asset", "bom-ref": "alg-ed25519", "name": "Ed25519 (EdDSA)", "description": "Two distinct uses: (1) software verification (OpenSSL EVP_DigestVerify, no HSM/PKCS#11 session) of A3E9 .license file signatures in src/LicenseFile.cpp and binary self-attestation signatures (DaemonAttestor); (2) HSM-backed financial signing via CKM_EDDSA (src/CryptoOps.cpp signEd25519/verifyEd25519) for client keys generated with the Ed25519 curve OID. RFC 8032. Not a FIPS 140-2/140-3 approved algorithm as of this writing -- the licensing-verification use is explicitly documented (src/LicenseFile.h) as exempt from FIPS scope because the licensing HSM is separate from the financial (FIPS-path) HSM.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "curve": "ed25519", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "sign", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/SigningMain.cpp" }, { "location": "src/SigningServer.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "src/dora/ComplianceAttestationModule.cpp" }, { "location": "src/engine/CurveValidator.cpp" }, { "location": "tools/hsm_cbom_sign.cpp" }, { "location": "tools/hsm_list_keys.cpp" }, { "location": "tools/hsm_tenant_manifest_sign.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-ecdsa-p256", "name": "ECDSA (NIST P-256)", "description": "General-purpose HSM-backed signing for client keys on the P-256 curve (src/CryptoOps.cpp sign()/verify()). Caller pre-hashes with SHA-256 in software before CKM_ECDSA (SoftHSM2/most vendors); hardware HSMs supporting CKM_ECDSA_SHA256 hash internally.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "curve": "secp256r1", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "sign", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/EVMTransaction.h" }, { "location": "src/MpcCoordinator.h" }, { "location": "src/ShamirShare.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/VendorProfile.cpp" }, { "location": "src/VendorProfile.h" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "src/dora/ComplianceAttestationModule.cpp" }, { "location": "src/engine/MechanismInfoCache.cpp" }, { "location": "src/engine/MechanismInfoCache.h" }, { "location": "tools/poc_vault_attestation.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-ecdsa-secp256k1", "name": "ECDSA (secp256k1)", "description": "HSM-backed signing for Ethereum/EVM (Keccak-256 pre-hash, src/CryptoOps.cpp signEVM/verifyEVM) and Bitcoin (SHA-256d pre-hash, signBitcoin) client keys. Not a NIST-recommended curve; standard choice for these blockchain ecosystems specifically.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "curve": "secp256k1", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "sign", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/A3E9Constants.h" }, { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/Bip340.cpp" }, { "location": "src/Bip340.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/DigitalAssetsServer.cpp" }, { "location": "src/DigitalAssetsServer.h" }, { "location": "src/EVMTransaction.cpp" }, { "location": "src/EVMTransaction.h" }, { "location": "src/HDWallet.cpp" }, { "location": "src/SigningServer.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-rsa-pss", "name": "RSA (2048/4096) with PSS-SHA256", "description": "HSM-backed signing for client RSA keys (src/CryptoOps.cpp signRSA/verifyRSA), CKM_RSA_PKCS_PSS, MGF1-SHA256, salt length 32 bytes. Caller pre-hashes with SHA-256 in software before calling C_Sign. Padding scheme is PSS, which has no dedicated enum value in the CycloneDX padding vocabulary as of the 1.6 schema (pkcs5/pkcs7/pkcs1v15/oaep/raw/other/unknown) -- recorded as 'other'.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "2048/4096", "padding": "other", "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "sign", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.cpp" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/VendorAdapter.h" }, { "location": "src/VendorAdapter_AWS.cpp" }, { "location": "src/VendorAdapter_Craton.cpp" }, { "location": "src/VendorAdapter_SoftHSM2.cpp" }, { "location": "src/VendorAdapter_Thales.cpp" }, { "location": "src/VendorAdapter_Utimaco.cpp" }, { "location": "src/VendorProfile.cpp" }, { "location": "src/VendorProfile.h" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "src/shims/ThalesShim.cpp" }, { "location": "src/shims/ThalesShim.h" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-rsa-pkcs1", "name": "RSA PKCS#1 v1.5 / OAEP (key transport)", "description": "RSA encryption/key-transport mechanisms surfaced through the vendor adapter and attribute-template layers (CKM_RSA_PKCS, CKM_RSA_PKCS_OAEP). PKCS#1 v1.5 encryption is retained only for vendor interoperability -- OAEP is the padding A3E9 selects where the vendor supports it. Distinct from alg-rsa-pss, which covers the signing path.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "pke", "parameterSetIdentifier": "2048/4096", "padding": "oaep", "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "encrypt", "decrypt" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/VendorAdapter.h" }, { "location": "src/VendorAdapter_AWS.cpp" }, { "location": "src/VendorAdapter_Craton.cpp" }, { "location": "src/VendorAdapter_SoftHSM2.cpp" }, { "location": "src/VendorAdapter_Thales.cpp" }, { "location": "src/VendorAdapter_Utimaco.cpp" }, { "location": "src/VendorProfile.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-aes256-gcm", "name": "AES-256-GCM", "description": "HSM-backed authenticated symmetric encryption (src/CryptoOps.cpp encrypt()/decrypt(), CKM_AES_GCM, 12-byte IV, 128-bit tag). CloudHSM shim enforces a 16 KB plaintext ceiling per operation; the plaintext is buffered and chunked above that limit (see src/shims/CloudHsmShim.h normalization 3.13).", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "ae", "parameterSetIdentifier": "256", "mode": "gcm", "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "encrypt", "decrypt" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.cpp" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/VendorAdapter.h" }, { "location": "src/VendorAdapter_AWS.cpp" }, { "location": "src/VendorAdapter_Craton.cpp" }, { "location": "src/VendorAdapter_SoftHSM2.cpp" }, { "location": "src/VendorAdapter_Thales.cpp" }, { "location": "src/VendorAdapter_Utimaco.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "src/craton_hsm/CratonSessionManager.h" }, { "location": "src/shims/CloudHsmShim.cpp" }, { "location": "src/shims/CloudHsmShim.h" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-aes-keywrap", "name": "AES Key Wrap (RFC 3394 / RFC 5649)", "description": "Key transport for the DORA cross-vendor KeySyncEngine wrap/unwrap path (src/dora/KeySyncEngine.cpp) and the WrapKey/UnwrapKey RPCs. CKM_AES_KEY_WRAP / CKM_AES_KEY_WRAP_PAD, with the per-vendor variant selected from VendorProfile (AWS CloudHSM uses CKM_CLOUDHSM_AES_KEY_WRAP_PKCS5_PAD). IMPORTANT SCOPE NOTE: this path can never move a real signing key -- every signing key A3E9 generates is CKA_EXTRACTABLE=CK_FALSE (FIPS 140-2 Level 3) and wrapping requires CKA_EXTRACTABLE=CK_TRUE. It applies only to transportable material (KEKs, and key shares under the MPC vendor-binding model).", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "key-wrap", "parameterSetIdentifier": "256", "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "wrapkey", "unwrapkey" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/VendorAdapter.h" }, { "location": "src/VendorAdapter_AWS.cpp" }, { "location": "src/VendorAdapter_Craton.cpp" }, { "location": "src/VendorAdapter_SoftHSM2.cpp" }, { "location": "src/VendorAdapter_Thales.cpp" }, { "location": "src/VendorAdapter_Utimaco.cpp" }, { "location": "src/VendorProfile.cpp" }, { "location": "src/VendorProfile.h" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "src/dora/KeySyncEngine.cpp" }, { "location": "src/dora/KeySyncEngine.h" }, { "location": "src/dora/LedgerBackend.h" }, { "location": "src/shims/CloudHsmShim.cpp" }, { "location": "src/shims/CloudHsmShim.h" }, { "location": "src/shims/CratonShim.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-aes-cbc-ecb", "name": "AES-CBC / AES-ECB (unauthenticated modes)", "description": "Raw AES block modes exposed through the Encrypt/Decrypt RPCs for interoperability with counterparty systems that mandate them (src/SigningServer.cpp). Neither mode provides integrity -- AES-256-GCM (alg-aes256-gcm) is the mode A3E9 uses for its own envelopes, and these are listed here so the inventory is complete rather than because they are recommended.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "block-cipher", "parameterSetIdentifier": "256", "mode": "cbc", "classicalSecurityLevel": 256, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "encrypt", "decrypt" ] } }, "evidence": { "occurrences": [ { "location": "src/SigningServer.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-aes-cmac", "name": "AES-CMAC", "description": "HSM-backed payment message authentication code (src/CryptoOps.cpp computeMAC()/verifyMAC(), CKM_AES_CMAC, ISO 16609) -- the modern replacement for legacy retail-MAC schemes in the payment-MAC module (Module 9A).", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "mac", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "tag", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-sha256", "name": "SHA-256", "description": "Three distinct uses: (1) LicenseFile::computeBindingHash() -- SHA-256(salt || tenant_id || token_serial) for Privacy-Preserving Hardware Binding (Part 1 licensing); (2) pre-hash for ECDSA P-256 signing and SHA-256d for Bitcoin; (3) the underlying PRF for PBKDF2 PIN derivation and the audit-log HMAC chain (see alg-pbkdf2 and alg-hmac-sha256).", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "256", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "digest" ] } }, "evidence": { "occurrences": [ { "location": "src/Bip340.cpp" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/Hash160.cpp" }, { "location": "src/LicenseFile.cpp" }, { "location": "src/MpcParticipationGraph.cpp" }, { "location": "src/OpenSslTypes.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/attestation/NetworkAttestationBinder.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonSlotTable.cpp" }, { "location": "src/dora/KeySyncEngine.cpp" }, { "location": "src/dora/LedgerHmac.cpp" }, { "location": "src/dora/LedgerHmac.h" }, { "location": "src/engine/MechanismInfoCache.cpp" }, { "location": "src/engine/MechanismInfoCache.h" }, { "location": "src/engine/ObjectIdMapper.cpp" }, { "location": "src/policy/ContinuityRecord.cpp" }, { "location": "tools/poc_vault_attestation.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-hmac-sha256", "name": "HMAC-SHA256", "description": "Tamper-evident HMAC chain over the audit log (vendor/a3e9-audit AuditLogger::buildJson()) -- each entry's hmac field covers the previous entry's hmac (prev_hmac), so deleting or editing any entry breaks the chain. Key supplied via HSM_AUDIT_HMAC_KEY (CI/CD-injected secret, never stored in a config file). Uses OpenSSL's one-shot HMAC() convenience function -- no manually-managed HMAC_CTX in this codebase.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "mac", "parameterSetIdentifier": "256", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "tag", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/HDWallet.cpp" }, { "location": "src/craton_hsm/CratonSlotTable.cpp" }, { "location": "src/dora/LedgerHmac.cpp" }, { "location": "src/dora/LedgerHmac.h" }, { "location": "src/policy/ContinuityRecord.cpp" }, { "location": "tools/hsm_audit_verify.cpp" }, { "location": "vendor/a3e9-audit/src/AuditLogger.cpp" }, { "location": "vendor/a3e9-audit/tests/test_Ffi.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-pbkdf2", "name": "PBKDF2-HMAC-SHA256", "description": "Password-based key derivation for Craton SO/user PIN storage (src/craton_hsm/CratonSlotTable.cpp): 16-byte RAND_bytes salt, 100,000 iterations, 32-byte derived key, persisted as '::' and verified with a constant-time CRYPTO_memcmp. Meets NIST SP 800-132 (random salt, key stretching). This replaced the bare unsalted SHA-256(pin) that earlier revisions of this CBOM described as an open hardening gap -- the gap is closed.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "kdf", "parameterSetIdentifier": "100000 iterations, 32-byte output", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "keyderive" ] } }, "evidence": { "occurrences": [ { "location": "src/craton_hsm/CratonSlotTable.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-keccak256", "name": "Keccak-256", "description": "Ethereum address derivation and EVM transaction/message pre-hash (src/Keccak256.cpp). Note: this is the original Keccak padding as used by Ethereum, NOT the standardized FIPS 202 SHA3-256 (different padding byte) -- the two produce different digests for the same input and must not be confused.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "256", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "digest" ] } }, "evidence": { "occurrences": [ { "location": "src/Bip340.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/EVMTransaction.h" }, { "location": "src/HDWallet.cpp" }, { "location": "src/Hash160.h" }, { "location": "src/Keccak256.cpp" }, { "location": "src/Keccak256.h" }, { "location": "src/RLPEncoder.cpp" }, { "location": "src/RLPEncoder.h" }, { "location": "src/SigningServer.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-ripemd160", "name": "RIPEMD-160 (via Hash160 = RIPEMD-160(SHA-256(x)))", "description": "Bitcoin address fingerprinting (src/Hash160.cpp): SHA-256 the public key, then RIPEMD-160 the result. RIPEMD-160 alone provides materially less security margin than SHA-256/Keccak-256 above; used here only because it is the fixed, standardized Bitcoin address format, not a general-purpose choice.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "hash", "parameterSetIdentifier": "160", "classicalSecurityLevel": 80, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "digest" ] } }, "evidence": { "occurrences": [ { "location": "src/Bech32Encoder.h" }, { "location": "src/Bip340.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/HDWallet.cpp" }, { "location": "src/HDWallet.h" }, { "location": "src/Hash160.cpp" }, { "location": "src/Hash160.h" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-3des-dukpt", "name": "2-key Triple DES (TDEA, EDE mode)", "description": "DUKPT key derivation and PIN block encryption/translation (src/DUKPT.cpp, ANSI X9.24-1:2009) for payment-terminal PIN handling (Module 9B). LEGACY ALGORITHM: NIST SP 800-131A deprecated 3DES for new use after 2023; retained here only for interoperability with the existing installed base of retail payment terminals (VX-series, most ATMs globally) that only speak classic 3DES DUKPT. AES-DUKPT (ANSI X9.24-3:2017) is documented as the modern successor in src/DUKPT.h but is not implemented in this codebase.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "block-cipher", "mode": "ecb", "classicalSecurityLevel": 112, "nistQuantumSecurityLevel": 0, "cryptoFunctions": [ "encrypt", "decrypt", "keyderive" ] } }, "evidence": { "occurrences": [ { "location": "src/A3E9Constants.h" }, { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/PINBlock.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "tools/hsm_load_gen.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-mldsa65", "name": "ML-DSA-65 (FIPS 204)", "description": "Post-quantum signature half of the hybrid dual-signature scheme (src/pqc/HybridEnvelope.cpp: classical ECDSA + ML-DSA -> ASN.1 CompositeSignatureValue). Native CKM_ML_DSA on PKCS#11 v3.0-capable hardware; liboqs software fallback (see that component) on vendor profiles without hardware PQC. Thales exposes it as the proprietary CKM_LUNA_DILITHIUM_3; the Utimaco CKM_CS_DILITHIUM_3 constant is declared in VendorProfile but that shim has no real override yet (pqc_capability NONE). CKP_ML_DSA_65 is A3E9's default parameter set.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "signature", "parameterSetIdentifier": "ML-DSA-65", "classicalSecurityLevel": 0, "nistQuantumSecurityLevel": 3, "cryptoFunctions": [ "keygen", "sign", "verify" ] } }, "evidence": { "occurrences": [ { "location": "src/A3E9Constants.h" }, { "location": "src/AttributeTemplates.cpp" }, { "location": "src/AttributeTemplates.h" }, { "location": "src/CryptoOps.cpp" }, { "location": "src/CryptoOps.h" }, { "location": "src/SigningServer.cpp" }, { "location": "src/VendorProfile.cpp" }, { "location": "src/VendorProfile.h" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.h" }, { "location": "src/craton_hsm/CratonMechanismTable.cpp" }, { "location": "src/craton_hsm/CratonMechanismTable.h" }, { "location": "src/craton_hsm/CratonPqcBridge.h" }, { "location": "src/shims/ThalesShim.cpp" }, { "location": "src/shims/ThalesShim.h" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-mlkem768", "name": "ML-KEM-768 (FIPS 203)", "description": "Post-quantum key encapsulation (MlKemEncapsulate/MlKemDecapsulate RPCs, Module 9E). Native CKM_ML_KEM on capable hardware; liboqs software fallback otherwise (see that component).", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "kem", "parameterSetIdentifier": "ML-KEM-768", "classicalSecurityLevel": 0, "nistQuantumSecurityLevel": 3, "cryptoFunctions": [ "keygen", "encapsulate", "decapsulate" ] } }, "evidence": { "occurrences": [ { "location": "src/VendorProfile.h" }, { "location": "src/shims/Shim.h" } ] } }, { "type": "cryptographic-asset", "bom-ref": "alg-drbg", "name": "OpenSSL default DRBG (RAND_bytes)", "description": "Random salt generation for the Privacy-Preserving Hardware Binding protocol (tools/hsm_bind_token.cpp, 16-byte salt), Craton PIN salts, and other software-path randomness needs outside the HSM boundary. Implementation is whatever OpenSSL 3.0's default RAND provider supplies (CTR-DRBG per NIST SP 800-90A on a standard OpenSSL 3.0 build); not independently verified as FIPS-validated in this deployment.", "cryptoProperties": { "assetType": "algorithm", "algorithmProperties": { "primitive": "drbg", "classicalSecurityLevel": 128, "nistQuantumSecurityLevel": 1, "cryptoFunctions": [ "generate" ] } }, "evidence": { "occurrences": [ { "location": "src/MpcCoordinator.cpp" }, { "location": "src/RealMpcSessionManager.cpp" }, { "location": "src/ShamirShare.cpp" }, { "location": "src/SigningServer.cpp" }, { "location": "src/craton_hsm/CratonHsmModule.cpp" }, { "location": "src/craton_hsm/CratonSlotTable.cpp" }, { "location": "tools/hsm_bind_token.cpp" } ] } }, { "type": "cryptographic-asset", "bom-ref": "proto-tls", "name": "TLS (gRPC mutual TLS)", "description": "gRPC channel security for test/prod environments (src/SigningMain.cpp: grpc::SslServerCredentials, GRPC_SSL_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY). Dev environment uses grpc::InsecureServerCredentials (loopback only, no TLS). Exact TLS version negotiated is whatever the linked gRPC/BoringSSL or gRPC/OpenSSL build defaults to; not pinned to a specific version in this codebase.", "cryptoProperties": { "assetType": "protocol", "protocolProperties": { "type": "tls", "version": "1.2/1.3 (negotiated by gRPC's TLS stack; not version-pinned here)" } }, "evidence": { "occurrences": [ { "location": "src/RpcAuditHelpers.h" }, { "location": "src/SigningMain.cpp" }, { "location": "src/SigningServer.cpp" }, { "location": "src/attestation/NetworkAttestationBinder.h" } ] } } ], "dependencies": [ { "ref": "hsm-signer", "dependsOn": [ "openssl", "liboqs", "craton-hsm" ] }, { "ref": "softhsm2", "dependsOn": [] }, { "ref": "openssl", "provides": [ "alg-ed25519", "alg-ecdsa-p256", "alg-ecdsa-secp256k1", "alg-rsa-pss", "alg-rsa-pkcs1", "alg-aes256-gcm", "alg-aes-keywrap", "alg-aes-cbc-ecb", "alg-sha256", "alg-hmac-sha256", "alg-pbkdf2", "alg-3des-dukpt", "alg-drbg", "proto-tls" ] }, { "ref": "liboqs", "provides": [ "alg-mldsa65", "alg-mlkem768" ] }, { "ref": "craton-hsm", "dependsOn": [ "openssl", "liboqs" ], "provides": [ "alg-ed25519", "alg-ecdsa-p256", "alg-ecdsa-secp256k1", "alg-rsa-pss", "alg-aes256-gcm", "alg-aes-keywrap", "alg-aes-cmac", "alg-sha256", "alg-pbkdf2", "alg-3des-dukpt", "alg-mldsa65", "alg-mlkem768" ] }, { "ref": "alg-keccak256", "dependsOn": [] }, { "ref": "alg-ripemd160", "dependsOn": [] }, { "ref": "alg-aes-cmac", "dependsOn": [] } ], "serialNumber": "urn:uuid:76232cb1-afbb-585f-a131-90ac61ac18bb" }