Craton HSM
Compatibility Matrix
Compatibility Matrix
This page is the authoritative reference for which combinations of Craton HSM Core, Craton HSM Enterprise, crypto backends, PKCS#11 vendor libraries, and hardware SDKs are supported. It complements tested-platforms, which covers OS and toolchain coverage.
Versions on this page track craton-hsm-core 0.9.1 and
craton-hsm-enterprise 0.1.1. The matrix applies to the latest 0.1.x
Enterprise release only; see the Enterprise support policy
for the full statement.
Status labels (Tested, Supported, Best-effort, Unsupported) are defined in tested-platforms.
Core and Enterprise Version Pairing
Enterprise crates are built against a pinned Core version and do not support mixing across minor releases.
| Core | Enterprise | Status | Notes |
|---|---|---|---|
| 0.9.1 | 0.1.1 | Tested | Current supported pair. |
| 0.9.0 | 0.1.0 | Supported | Prior pair; upgrade path documented in the Enterprise MIGRATION.md. |
| 0.9.0 | 0.1.1 | Unsupported | 0.1.1 Cluster adds HMAC replay protection incompatible with 0.1.0 peers. |
| 0.8.x | any 0.1.x | Unsupported | Enterprise requires the 0.9.x CryptoBackend trait surface. |
| any 0.9.x | Core alone (no Enterprise) | Tested | Core is fully standalone; the Enterprise crates are additive. |
Mixing 0.1.0 and 0.1.1 nodes in the same craton-hsm-cluster is
unsupported because the HMAC replay-protection addition in 0.1.1 changed
the wire format.
Crypto Backends
Craton HSM exposes a CryptoBackend trait with three in-tree
implementations. Each is tied to a specific use case and a specific
minimum platform surface.
| Backend | Crate | Library | Pinned version | Primary use | Status |
|---|---|---|---|---|---|
| RustCrypto | craton-hsm-core (default) | pure Rust | workspace | Default, no system deps | Tested |
| aws-lc-rs | craton-hsm-awslc | aws-lc-rs | =1.16.2 | FIPS mode, CMVP track | Tested |
| OpenSSL | craton-hsm-openssl | system OpenSSL 3.0.x / 3.2.x | runtime-linked | Ops integration with existing OpenSSL deployments | Tested on Ubuntu 22.04 / 24.04 |
| OpenSSL | craton-hsm-openssl | OpenSSL 1.1.1 | runtime-linked | Legacy only | Best-effort (upstream EOL) |
| Windows CNG | craton-hsm-cng | Windows BCrypt | OS-provided | Windows-native deployments | Tested on Windows Server 2022 |
See the FAQ entry on OpenSSL 1.1 before wiring the OpenSSL backend to a 1.1.1 system library.
Backend × Operating System
| Backend | Linux (glibc) | Linux (musl) | Windows | macOS |
|---|---|---|---|---|
| RustCrypto (default) | Tested | Supported | Tested | Dev only |
| aws-lc-rs | Tested | Best-effort (needs cmake, gcc) | Supported (needs LLVM) | Dev only |
| OpenSSL 3.x | Tested | Best-effort | Best-effort | Unsupported |
| Windows CNG | Unsupported | Unsupported | Tested | Unsupported |
craton-hsm-nxp and craton-hsm-infineon build as software stubs on any
platform supported by the rest of the workspace when the hw feature is
off. With hw enabled they are Linux-only and require vendor SDKs (see
below).
FIPS Mode
FIPS mode is a property of the deployed backend, not a cross-cutting
switch. The certified build artefacts and approved-algorithm enforcement
live in craton-hsm-certified.
| Backend | FIPS 140-3 Level 1 scope | Status |
|---|---|---|
aws-lc-rs (fips feature) | Validated crypto primitives + Craton FSM, POST, zeroization, integrity check | Design-complete; module not yet submitted to a CMVP lab. See ../fips/overview. |
Windows CNG (new_fips ctor) | Delegates to BCrypt FIPS provider; requires Windows FIPS mode enabled via Group Policy | Design-complete; OS-gated |
| RustCrypto | Not in scope | N/A — not a submission target |
| OpenSSL 3.x | Not in scope | N/A — not a submission target |
PKCS#11 Vendor Libraries (craton-hsm-pkcs11)
The passthrough crate has no version gate of its own; compatibility is against the vendor library's conformance to PKCS#11 v2.40 or v3.0.
| Vendor / Library | Version | Status | Notes |
|---|---|---|---|
| SoftHSM | 2.6.0+ | Tested | Default PKCS#11 fixture in CI |
| SoftHSM | 2.5.x | Best-effort | — |
| YubiHSM2 SDK | 2023.08+ | Supported | Requires yubihsm-connector running |
| Thales Luna Client | 10.x | Supported | HSM firmware 7.x series; mTLS to appliance |
| Utimaco CryptoServer | Se-Series (CP5) | Supported | CryptoServer SDK 4.40+ |
| nCipher nShield | Security World 13.x | Best-effort | Requires hardserver |
| AWS CloudHSM | Client 5.x | Best-effort | — |
Only SoftHSM is exercised by CI. Other vendor libraries are validated pre-release against the listed versions; regression risk between our releases is low but not zero.
Hardware Vendor SDKs
The craton-hsm-nxp and craton-hsm-infineon crates ship as software
stubs by default. The hw feature enables the hardware path and brings in
the vendor SDK dependency.
| Crate | Vendor | Hardware | SDK / Firmware | Status |
|---|---|---|---|---|
craton-hsm-nxp | NXP | S32G2 (S32G274A, GoldBox) | HSE firmware 1.x | Supported with hw |
craton-hsm-nxp | NXP | S32G3 (S32G399A) | HSE firmware 1.x | Supported with hw |
craton-hsm-nxp | NXP | S32K3 (S32K344, S32K358) | HSE firmware 1.x | Supported with hw |
craton-hsm-nxp | NXP | S32G1, legacy S32K | — | Unsupported |
craton-hsm-infineon | Infineon | SLB 9670 (discrete TPM 2.0) | tpm2-tss 4.0+ | Supported with hw |
craton-hsm-infineon | Infineon | SLB 9672 (firmware TPM 2.0) | tpm2-tss 4.0+ | Supported with hw |
craton-hsm-infineon | Infineon | OPTIGA Trust M | vendor SDK | Supported with hw |
craton-hsm-infineon | Infineon | SLB 9665 (TPM 1.2) | — | Unsupported (TPM 1.2 out of scope) |
With hw enabled, these crates are Linux-only. On Windows/macOS with hw
they will fail to build.
KMIP Protocol (craton-hsm-kmip)
| Spec | Version | Status |
|---|---|---|
| OASIS KMIP | 2.1 | Tested; default protocol version in responses |
| OASIS KMIP | 1.4 | Best-effort (subset of operations) |
| OASIS KMIP | 3.0 | Unsupported in 0.1.x |
Implemented operations: Create, Register, Get, GetAttributes,
Activate, Revoke, Destroy, Locate, Query. Split keys, PGP, and
certificate-chain profiles are on the Enterprise roadmap for KMIP 2.1 —
see ../project/roadmap.
Authentication Providers (craton-hsm-auth)
| Provider | Requirement | Status |
|---|---|---|
| LDAP / LDAPS | LDAPv3, TLS 1.2+ | Supported (ldap-auth feature) |
| OIDC | OIDC Core 1.0; RS256/384/512, ES256/384 | Supported (oidc-auth feature) |
| X.509 certificate | PKCS#7 / PEM / DER, static CRL | Supported (cert-auth feature) |
| TOTP (MFA) | RFC 6238; SHA-1 and SHA-256 | Supported |
| Local PIN store | — | Dev/test only; not supported in production |
OCSP and HTTP CRL-distribution-point fetching are not implemented in
0.1.x. Operators must refresh CRLs out-of-band. See the Enterprise
SECURITY.md and faq.
Cluster (craton-hsm-cluster)
| Component | Requirement |
|---|---|
| Raft peers | Minimum 3 for fault tolerance; odd counts recommended |
| Message integrity | HMAC-SHA256 (mandatory unless allow_insecure: true) |
| Wire encryption | Out of scope; deploy on isolated network or tunnel via mTLS |
| Clock skew tolerance | ±30 s default (configurable via max_message_age_ms) |
Cluster cluster_secret is required in all release builds. The
insecure-no-cluster-secret feature exists for tests and demos only and
will refuse to compile a release binary without it.
Cloud Integrations (craton-hsm-cloud)
| Integration | API version | Status |
|---|---|---|
| Kubernetes CSI | CSI v1.8+ | Supported |
| AWS KMS shim | AWS SDK for Rust | Shim only; no production validation |
| Azure Key Vault shim | Azure SDK for Rust | Shim only; no production validation |
| HashiCorp Vault shim | KV v2, Transit | Shim only; no production validation |
Mock implementations are gated behind mock-insecure-do-not-ship and
additionally require CRATON_HSM_ALLOW_MOCK=1 in the environment. They
are not for production use.
Language and Runtime Clients
| Client | Version | Status | Notes |
|---|---|---|---|
| Java SunPKCS11 | JDK 17, JDK 21 | Tested | Interop script in tests/interop/java_sunpkcs11.sh |
| OpenSSL pkcs11 engine / provider | 1.1.1, 3.0+, 3.2+ | Tested (3.x) | See faq |
GnuTLS p11tool | 3.7+ | Supported | — |
OpenSC pkcs11-tool | 0.21+ | Tested | — |
| ssh-agent via PKCS#11 | OpenSSH 8.x, 9.x | Supported | Documented in the installation guide |
Container and Orchestrator Targets
| Platform | Versions | Status |
|---|---|---|
| Docker Engine | 24.x, 25.x | Supported |
| Podman | 4.x, 5.x | Best-effort |
| Kubernetes | 1.28 – 1.31 | Supported |
| Kubernetes | ≤ 1.27 | Unsupported (upstream EOL) |
| OpenShift | 4.14+ | Best-effort |
What "Unsupported" Means
Issues filed against Unsupported configurations are closed with a pointer
to this document. Commercial support contracts (support@craton.io) can,
case-by-case, expand the supported set for a specific customer environment.