# Thales

Ripple Custody supports on-premise Thales Luna Network HSM 7 deployments, with the following specifications:

- Firmware 7.7.1 or higher
- PKCS11
- The following HSM policy settings enabled:
  - **6**: Allow masking
  - **12**: Allow non-FIPS algorithms
- The following partition policies enabled:
  - **22**: Allow activation
  - **23**: Allow auto-activation
  - **41**: Partition version
  - **43**: Allow non-FIPS algorithms


For more information, see the Thales Luna Network HSM 7 documentation.

You must ensure all policies listed above are enabled before you begin to use your Thales Luna HSM, as some of these policies are destructive — that is, they will destroy any existing data when enabled.

## On-premise

The current Luna HSM is FIPS 140-2 Level 3 certified and supports the BIP32 derivation scheme. As such, you can create blockchain keys using deterministic derivation from a seed.

For more information, see the BIP32 Mechanism Support and Implementation documentation.

The Luna HSM is deployed to a client with the following:

- Scalable Key Storage (SKS)
- A user with **Limited Crypto Officer** role
- HSM policy **12**, required for vault operations
- HSM policy **6**, required for SKS


The vault needs to be deployed to a separate server, since Luna only provides the HSM functionality. We recommend a server with a secure enclave for confidential computing, such as AMD EPYC. You can deploy the other parts of the Ripple Custody stack to general computing nodes, or consume them as part of the Ripple Cloud offering.

You are fully in control of your keys. You can implement a connected hot vault or a disconnected cold vault.

## Key generation

After HSM initialization, every new account creation generates a new set of private keys. These keys are encrypted with the HSM master key and safely stored in the database.

BIP32 only supports the secp256k1 elliptic curve. This means that the creation of derived accounts is only supported for chains that use this curve. Currently, this includes Bitcoin, Ethereum, and XRPL. Support is also extended to all chains that are of the same type, such as chains like Litecoin or Polygon, that are also supported by BIP32.

Alternatively, for all ledgers that use Ed25519 (such as Tezos and Polkadot), you can only generate blockchain keys for new accounts in a random manner.

## Backups

For SKS partitions, you only need to back up the SKS master key (SMK) to a backup HSM.

For more information, see the Thales Luna Partition Administration Guide.