# IBM LinuxONE integration

The IBM LinuxONE Ripple Custody implementation uses:

- **IBM LinuxONE**: A dedicated computing server with integrated HSM adapters
- **IBM Crypto Express (CEX) adapters**: The cryptographic hardware modules, accessed through the GREP11 API (EP11 over gRPC)


The supported adapters are **FIPS 140-2 Level 4** certified and fully support the **BIP32** and **SLIP-10** derivation schemes.

## Supported hardware

| Requirement | Detail |
|  --- | --- |
| Adapters | IBM Crypto Express CEX8S (IBM 4770) and CEX7S (IBM 4769). Older CEX6S (IBM 4768) and CEX5S (IBM 4767) adapters are also compatible. |
| Firmware | EP11/XCP firmware with the `CKM_IBM_BTC_DERIVE` extension, which the Ripple Custody `ibm` KMS provider requires for BIP32/SLIP-10 key derivation. |
| Interface | GREP11 — EP11 over gRPC. |
| Certification | FIPS 140-2 Level 4. |


s390x support
Starting in version 1.34, Ripple Custody supports s390x (IBM) architecture for secure components only (the notary and vault). Non-secure components are not supported on s390x architecture.

For IBM LinuxONE deployments, contact your Ripple liaison for assistance with onboarding and configuration.

## Architecture

The notary and vault are securely deployed to HPVS (Hyper Protect Virtual Server) instances on IBM LinuxONE. Deploy the core platform and other non-secure Ripple Custody components outside the s390x secure-component environment.

With IBM LinuxONE, you are fully in control of your own data and keys. You can deploy the notary and one or multiple vaults to several logical partitions of LinuxONE. You can implement both connected hot vaults and disconnected cold vaults.

## Key generation

Initialize the HSM with a trusted key entry (TKE) ceremony.

For more information, see What is TKE?

The standard key generation process is as follows:

1. On configuration of the vault to use the HSM, the vault requests the HSM to securely generate a seed.
2. The HSM generates the seed, encrypts the seed, and returns the encrypted seed to the vault. You can store the encrypted seed in a location of your choice, since it's not readable outside the HSM.
3. On creation of a new account, the HSM securely generates account keys through a deterministic derivation from the seed, using the SLIP-10 algorithm.


You can also request generation of account keys in a completely random manner, with no seed. We do not recommend this approach.

For more information, see [Key derivation](/products/custody/v1.37/accounts-and-assets/accounts/account-key-derivation-and-ledger-compatibility).

## Database backups

We highly recommend that you synchronously replicate the database backup right from the beginning, as the database is the source of truth.

## Key rotation

For information on reasons and procedures for wrapping key rotation with IBM on-premise vaults, see [IBM HSM wrapping key rotation](/products/custody/v1.37/identity-and-access/vault-management/vault-wrapping-key-rotation-ibm-hsm).

## Next steps

1. **Complete installation**: Continue with [Installation and initialization](/products/custody/v1.37/deployment/install/first-time-installation).
2. **Configure blockchain indexers**: Set up blockchain connections.
3. **Review [Production best practices](/products/custody/v1.37/deployment/integrate-kms/production-best-practices)** for namespace segmentation, HA patterns, and monitoring