# Thales Luna HSM

The Thales Luna HSM is FIPS 140-2 Level 3 certified and supports BIP32 and SLIP10 derivation schemes. You can use the HSM to create blockchain keys with deterministic derivation from a seed.

Ripple Custody supports on-premise Thales Luna Network HSM 7 deployments, with the following specifications:

- For BIP32 derivation:
  - HSM Firmware 7.7.1 or higher
- For SLIP10 derivation:
  - HSM Firmware 7.8.7 or higher
  - Application software 7.8.5-300
  - Ripple Custody version 1.16 or higher
- The following HSM policy settings enabled:
  - **6**: Allow masking
  - **12**: Allow non-FIPS algorithms
- The following partition policies enabled:
  - **22**: Allow activation
  - **23**: Allow auto-activation
  - **41**: Partition version
  - **43**: Allow non-FIPS algorithms


You cannot upgrade vaults that were registered with a version of Thales Luna earlier than 7.8.7 to perform SLIP10 derivation. To use SLIP10 derivation, deploy a new vault.

For more information, see the Thales Luna Network HSM 7 documentation.

**Warning**
You must ensure all policies listed above are enabled before you begin to use your Thales Luna HSM. Some of these policies are destructive and **will destroy existing data when enabled**. 

## Implementation

For more information, see the BIP32 Mechanism Support and Implementation documentation.

The Luna HSM is deployed to a client with the following:

- Scalable Key Storage (SKS)
- A user with **Limited Crypto Officer** role
- HSM policy **12**, required for vault operations
- HSM policy **6**, required for SKS


The vault needs to be deployed to a separate server, since Luna only provides the HSM functionality. We recommend a server with a secure enclave for confidential computing, such as AMD EPYC. You can deploy the other parts of the Ripple Custody stack to general computing nodes, or consume them as part of the Ripple Cloud offering.

You are fully in control of your keys. You can implement a connected hot vault or a disconnected cold vault.

### Key generation

After the HSM is initialized, every new account that's created generates a new set of private keys using either a deterministic key derivation strategy or a random key generation strategy. These private keys are then encrypted using the HSM master key and safely stored in the Ripple Custody database.

If you specify a deterministic key derivation strategy during account creation, key derivation is performed using the derivation scheme specified in your HSM configuration.

#### SLIP10 derivation

If you're using the SLIP10 derivation scheme, both Ed25519 and secp256k1 elliptic curves are supported for key derivation. You can create accounts on any blockchain that uses either of these elliptic curves to derive keys upon account creation.

#### BIP32 derivation

If you're using the BIP32 scheme, only the secp256k1 curve is supported. Using this scheme, you can create accounts only on chains that use this curve. The chains that currently support the secp256k1 curve are Bitcoin, Ethereum, and XRPL. You can also create accounts on chains that are of the same type and support the BIP32 scheme, such as Litecoin and Polygon.

Alternatively, you can create accounts with a random key generation strategy on any chain supported by the HSM.

### Backups

For SKS partitions, you only need to back up the SKS master key (SMK) to a backup HSM.

For more information, see the Thales Luna Partition Administration Guide.