Key protection
Active backend: luna — software (SoftHSM — PKCS#11, non-extractable)
Private keys are PKCS#11 objects in a SoftHSM token, marked sensitive + non-extractable so the API cannot export them — but SoftHSM is a SOFTWARE HSM (its token DB is on disk), so this is software protection, not hardware. It is the validation stand-in for the Luna T-Series.
keystore: /etc/tailnumber/keys
⚠ Not hardware-backed. Keys are software-protected — a PFX file, or a SoftHSM token (a software HSM: non-extractable via PKCS#11, but its DB is on disk). Production is the Thales TCT Luna T-Series (T3000): keys born in tamper-resistant hardware, never extractable.
Signing keys (protection posture)
| label | type | protection | valid to |
|---|---|---|---|
| tailnumber-codesign-01 | rsa3072 | software — SoftHSM, non-extractable via PKCS#11 | Jul 10 17:26:17 2076 GMT |
Configured HSM backend
| type | luna (PKCS#11) | |
| module | /usr/lib/softhsm/libsofthsm2.so | ✓ present |
| token / partition | tailnumber | |
| status | active |
PKCS#11 modules
| module | path | status |
|---|---|---|
| Thales Luna client | /usr/lib/softhsm/libsofthsm2.so | ✓ present Cryptoki 2.40 · Implementation of PKCS11 (ver 2.6) |
| SoftHSM2 (validation stand-in) | /usr/lib/softhsm/libsofthsm2.so | ✓ present Cryptoki 2.40 · Implementation of PKCS11 (ver 2.6) |
Signing mechanisms (PKCS#11)
Each TailNumber algorithm and its PKCS#11 mechanism, with support on the Luna T-Series target — classical RSA/ECDSA are P2, ML-DSA is P3 (firmware 7.15.0). ✓ live means confirmed in a reachable token.
| algorithm | CKM mechanism | pkcs11-tool | HSM support |
|---|---|---|---|
| rsa3072-pss-sha256 | CKM_SHA256_RSA_PKCS_PSS | SHA256-RSA-PKCS-PSS | ✓ live |
| rsa3072-pkcs1-sha256 | CKM_SHA256_RSA_PKCS | SHA256-RSA-PKCS | ✓ live |
| rsa4096-pss-sha384 | CKM_SHA384_RSA_PKCS_PSS | SHA384-RSA-PKCS-PSS | ✓ live |
| rsa4096-pkcs1-sha384 | CKM_SHA384_RSA_PKCS | SHA384-RSA-PKCS | ✓ live |
| ecdsa-p384-sha384 | CKM_ECDSA_SHA384 | ECDSA-SHA384 | ✓ Luna (P2) |
| ml-dsa-65 | CKM_ML_DSA | — | Luna FW 7.15.0 (P3) |
| ml-dsa-87 | CKM_ML_DSA | — | Luna FW 7.15.0 (P3) |
Production target — Thales TCT Luna T-Series HSM (T3000)
| certification | FIPS 140-2 Level 3 |
| keys | generated in-HSM; sensitive + never-extractable — the private half never leaves the token |
| post-quantum | ML-DSA is a P3 capability — Luna firmware 7.15.0 |
| validated with | SoftHSM2 as a Luna T-Series stand-in (classical RSA / ECDSA) |
With the Luna backend enabled, this page shows live token status, partition capacity, and per-key hardware attributes (CKA_SENSITIVE / CKA_NEVER_EXTRACTABLE).