特色
給維運人員與整合工程師的 Luna HSM 命令列工具
一支工具涵蓋日常金鑰作業
列出 slot 與物件、產生金鑰、改屬性、加解密、衍生金鑰、匯出入與格式轉換。每個指令單次執行，不留 session，適合直接放進腳本與維運流程。
單一執行檔，免安裝
Linux x86-64 與 Windows x86-64 各一個檔案，複製過去即可執行，不需額外的 runtime。只要主機上有 Luna Client。
每個指令都有 --json
輸出結構化資料給腳本使用，不必解析給人看的文字。完整參數隨時可由 kmu <指令> --help 查詢。
PIN 不外洩
支援 PED 認證、環境變數、檔案與互動式輸入，PIN 在記憶體中用完即清除，也不會出現在任何輸出或錯誤訊息中。
刪除先確認
刪除物件前先顯示要刪的內容並要求輸入 yes；非互動環境必須明確加上 --yes，避免腳本誤刪。
指令一覽
功能與原廠 luna-kmu 對等，另有少數新增
| 類別 | 指令 |
|---|---|
| 查詢 | listslot、list、getattribute、getcapabilities、login |
| 產生金鑰 | generatekey：AES、SM4、DES、HMAC、RSA、DSA、DH、ECDSA、EdDSA、SM2、ML-DSA、ML-KEM、HSS；支援以多份明文分量組成金鑰 |
| 物件管理 | createdo、setattribute、readattribute、writeattribute、computekcv、digestkey、delete |
| 密碼運算 | encrypt、decrypt（AES ECB/CBC/CFB/OFB/GCM/KW、RSA PKCS 與 OAEP）、derive（SHA 系列、Luna KDF、AES-ECB） |
| 匯出與匯入 | export、import：公鑰（DER／十六進位／PEM）、金鑰包裹、PKCS#8 密碼保護（PBES2）、TR-31；convert 做檔案編碼轉換，不連線 HSM |
| payShield 整合 | remotemzmk：以 ECDH 與 payShield TMD 協商 MZMK，並產生上傳 TMD 的 CSV；金鑰不離開任何一端 |
# 看有哪些 slot
kmu listslot
# PIN 放環境變數，不要寫在命令列
export HSM_PIN='your-pin'
kmu list --slot 0 --pin-env HSM_PIN
# 產生 AES-256 金鑰
kmu generatekey --slot 0 --pin-env HSM_PIN --key-type aes --key-size 32 --label my-aes使用前須知
- 與原廠的差異：參數改用 GNU 風格（--slot 0）、會讀 Luna Client 設定檔找 PKCS#11 函式庫、delete 需要確認，另新增 TR-31 匯出與 Ed448。逐項說明見手冊。
- 只支援單次執行，沒有互動式 console；login 是驗證憑證的指令，不保留登入狀態。
- PED 認證已依規格實作，但尚未在 PED partition 上做端對端實機驗證。
- 本工具是雲杉科技以原廠開源的 luna-kmu（MIT 授權）為行為基準另行實作，並非 Thales 官方產品。
luna-kmu in English
kmu is a key management command-line tool for Thales Luna HSMs. Generate and manage keys, encrypt and decrypt, move key material in and out, and negotiate a key with a payShield TMD.
Everyday key operations in one tool
List slots and objects, generate keys, edit attributes, encrypt and decrypt, derive keys, export and import, and convert formats. Every command runs once and holds no session, so it drops straight into scripts and operations.
Single executable, no install
One file each for Linux x86-64 and Windows x86-64. Copy it over and run it; no extra runtime. A Luna Client on the host is all it needs.
--json on every command
Structured output for scripts instead of text meant for people. Full parameters are always available from kmu <command> --help.
PINs stay private
PED authentication, environment variable, file or interactive prompt. The PIN is wiped from memory after use and never appears in output or error messages.
Confirmation before delete
delete shows the object and asks for yes. Non-interactive runs must pass --yes explicitly, so a script cannot delete by accident.
| Area | Commands |
|---|---|
| Inspect | listslot, list, getattribute, getcapabilities, login |
| Generate keys | generatekey: AES, SM4, DES, HMAC, RSA, DSA, DH, ECDSA, EdDSA, SM2, ML-DSA, ML-KEM, HSS; keys can be assembled from clear-text components |
| Object management | createdo, setattribute, readattribute, writeattribute, computekcv, digestkey, delete |
| Cryptographic operations | encrypt, decrypt (AES ECB/CBC/CFB/OFB/GCM/KW, RSA PKCS and OAEP), derive (SHA family, Luna KDF, AES-ECB) |
| Export and import | export, import: public keys (DER, hex, PEM), key wrapping, password-protected PKCS#8 (PBES2), TR-31; convert re-encodes files without connecting to an HSM |
| payShield integration | remotemzmk: negotiate an MZMK with a payShield TMD over ECDH and produce the CSV to upload; no key ever leaves either side |
Before you start
- Differences from the vendor tool: GNU-style options (--slot 0), the PKCS#11 library is located through the Luna Client configuration file, delete asks for confirmation, and TR-31 export and Ed448 are added. The manual lists each one.
- Single-run only, no interactive console; login verifies credentials and keeps no session.
- PED authentication is implemented to specification but has not been verified end to end on a PED partition.
- Spruce Technology wrote this tool independently, using the open-source Thales luna-kmu (MIT) as the behavioral reference. It is not a Thales product.
Documentation and getting the program
Read the User Manual online or download it asPDF orWord (.docx). The program itself is not offered for public download:request it through the contact formand tell us your platform and Luna Client version.
需要 luna-kmu？
程式不開放公開下載，請透過聯絡表單索取，並註明使用平台與 Luna Client 版本。Need the program? Request it through the contact form.