This section provides integration guides for all key management systems (KMSs) supported by Ripple Custody. Choose the KMS that best fits your security requirements, infrastructure, and operational capabilities.
Before you begin: Review Key management planning to understand the differences between HSM and MPC approaches and choose the right option for your organization.
Starting in version 1.34, Ripple Custody supports s390x (IBM) architecture for secure components only, including the notary and vault. Non-secure components are not supported on s390x architecture. Contact your Ripple liaison if you have an existing deployment that includes non-secure components on s390x architecture.
Ripple Custody supports the following KMS platforms:
| Platform | FIPS Level | Description | Guide |
|---|---|---|---|
| AWS CloudHSM | Level 3 | AWS-managed cloud HSM with FIPS 140-2 Level 3 validation. Deployed in your AWS VPC with Nitro Enclave isolation. | AWS CloudHSM integration |
| Securosys CloudHSM | Level 3 | Securosys-hosted CloudHSM option available through the Securosys/Ripple partnership. | Documentation in progress. Contact your Ripple account team. |
| Platform | FIPS Level | Description | Guide |
|---|---|---|---|
| BlockSafe HSM | Level 3 | Blockchain-optimized on-premises HSM with PKCS#11 interface. | BlockSafe HSM integration |
| IBM LinuxONE | Level 4 | On-premises HSM on LinuxONE with GREP11 API for vault and notary components. Non-secure components are not supported on s390x architecture from version 1.34 onward. | IBM LinuxONE integration |
| Securosys Primus HSM | Level 3 | On-premises HSM with scalable key storage (SKS), SLIP10 key derivation, and clustering and HA support. | Securosys Primus HSM integration |
| Thales Luna HSM | Level 3 | On-premises HSM with scalable key storage (SKS), BIP32/SLIP10 key derivation, and HA group support. Available as Luna Network HSM 7 appliance or Luna PCIe HSM 7 (A700) card. | Thales Luna HSM integration |
| Platform | Description | Guide |
|---|---|---|
| MPC | Distributed key management using 3-of-4 threshold signing. Keys are split across 4 nodes (2 Ripple + 2 customer). Customer MPC nodes can be deployed in supported cloud environments, including AWS and Azure. | MPC integration |
The following table lists the HSM hardware that Ripple Custody is validated against, and the minimum compatibility requirements for each vendor. The Ripple Custody KMS providers rely on vendor-specific key-derivation extensions, so the supported hardware for each vendor is the family that exposes those extensions.
| Vendor | KMS provider | Supported hardware | Minimum requirements | Certification |
|---|---|---|---|---|
| IBM | ibm (GREP11 — EP11 over gRPC) | IBM Crypto Express (CEX) adapters running EP11/XCP firmware: CEX8S (IBM 4770) and CEX7S (IBM 4769). Older CEX6S (IBM 4768) and CEX5S (IBM 4767) adapters are also compatible. | Firmware with the CKM_IBM_BTC_DERIVE extension. | FIPS 140-2 Level 4 |
| Thales | luna (libCryptoki2.so) | Thales Luna 7 generation: Luna Network HSM 7 models A700/A750/A790 and S700/S750/S790. | SLIP-10 derivation (secp256k1, ed25519, P-256) requires firmware 7.8.7 or later and Luna client 10.7.1 or later. | FIPS 140-2 and 140-3 Level 3 |
| Securosys | primus (libprimusP11.so) | Primus HSM X-Series and E-Series, and the Securosys CloudHSM service. All share one firmware line that exposes the required extensions. | Firmware exposing C_DeriveKeyPair and persistent-external-object support. | FIPS 140-2 Level 3, Common Criteria EAL4+ |