Lux Docs

Lux HSM (github.com/luxfi/hsm) provides a single Go interface (Signer) for signing and verification across sixteen backend providers — cloud KMS/HSM, networked and USB HSMs, hardware-wallet secure elements, air-gapped devices, banking key-blocks, and post-quantum ML-DSA. One factory, one interface, many backends. All secrets are managed through Lux KMS — never stored as plaintext.

Core Interfaces

type Signer interface {
    Sign(ctx context.Context, keyID string, message []byte) ([]byte, error)
    Verify(ctx context.Context, keyID string, message, signature []byte) (bool, error)
    Provider() string
}

type PasswordProvider interface {
    GetPassword(ctx context.Context, keyID string) (string, error)
}

Signing Providers

All sixteen are registered in one factory — hsm.NewSigner(provider, config).

Cloud KMS / HSM

Provider	Backend	Algorithm
`aws`	AWS KMS / CloudHSM	ECDSA P-256 (SigV4, no SDK)
`gcp`	Google Cloud KMS	EC_SIGN_P256_SHA256
`azure`	Azure Key Vault / Managed HSM	ES256
`kmip`	Any KMIP 1.x HSM (Thales, Entrust, …)	KMIP `Sign` (requires cgo)

Networked / USB HSM

Provider	Backend	Notes
`pkcs11`	Any PKCS#11 token (Thales Luna, SoftHSM, …)	Universal HSM standard (requires cgo)
`yubihsm`	YubiHSM 2	aliases `yubico`, `yubi`
`nitrokey`	Nitrokey HSM	OpenPGP/PKCS#11 secure element
`zymbit`	Zymbit SCM / HSM6	Edge/IoT; native threshold (`ThresholdHSM`)

Hardware-wallet secure elements

Provider	Device
`ledger`	Ledger (Nano S/X/Stax)
`trezor`	Trezor
`coldcard`	Coldcard
`keystone`	Keystone (air-gap QR)
`gridplus` / `lattice`	GridPlus Lattice1 (SafeCard)
`ngrave`	NGRAVE ZERO
`foundation`	Foundation Passport

Software, banking & post-quantum

Provider	Algorithm	Use
`mldsa` / `pq` / `post-quantum`	ML-DSA-44 / 65 / 87 (FIPS 204)	Post-quantum signing
`tr31`	ANSI X9.143 / TR-31 key blocks	Banking / payments key wrapping
`local` / `""`	ECDSA P-256 in-memory	Development and testing only

FIPS posture. hsm.RequireFIPSProvider admits only the FIPS-validated backends: aws, gcp, azure, yubihsm, pkcs11, kmip. Wire it before constructing a signer to fail closed on a non-FIPS provider. local is development only — never production.

Build notes: pkcs11 and kmip link a native library and require cgo (a no-cgo build falls back to a stub that refuses to sign). The GridPlus Lattice1 Connect-API path is partial — track its status before production use.

Password Providers

Provider	Source	Use Case
`aws`	AWS KMS Decrypt	ZapDB password from KMS
`gcp`	GCP Cloud KMS Decrypt	ZapDB password from KMS
`azure`	Azure Key Vault unwrapKey	ZapDB password from Key Vault
`env`	Environment variable	Development only (never production)
`file`	File on disk	K8s mounted secrets (via KMS operator)

Quick Example

package main

import (
    "context"
    "fmt"
    "github.com/luxfi/hsm"
)

func main() {
    // Create a signer
    signer, _ := hsm.NewSigner("aws", map[string]string{
        "region": "us-east-1",
    })

    ctx := context.Background()
    keyID := "arn:aws:kms:us-east-1:123456789:key/my-signing-key"

    // Sign
    sig, _ := signer.Sign(ctx, keyID, []byte("hello world"))

    // Verify
    ok, _ := signer.Verify(ctx, keyID, []byte("hello world"), sig)
    fmt.Println("Valid:", ok) // true
}

Architecture

┌─────────────────────────────────────────────┐
│                  Manager                     │
│  ┌──────────────────┐  ┌──────────────────┐ │
│  │  PasswordProvider │  │     Signer       │ │
│  └────────┬─────────┘  └────────┬─────────┘ │
│           │                     │            │
│  ┌────────▼─────────────────────▼─────────┐ │
│  │         Factory (NewSigner / etc)       │ │
│  └────┬───────────┬───────────┬───────────┘ │
│       │           │           │              │
│   Cloud KMS   Networked/    Hardware-wallet  │
│   AWS·GCP·    USB HSM       secure elements  │
│   Azure·KMIP  PKCS11·Yubi·  Ledger·Trezor·   │
│               Nitro·Zymbit  Coldcard·...     │
│                                              │
│            + mldsa (PQ) · tr31 · local       │
└─────────────────────────────────────────────┘

Lux HSM

On this page