fmcrypto

A cryptographic and PKI service for secure key management, encryption, and certificate operations — written in Go, served over REST and gRPC.

overview

• crypto service: key generation (AES/TDES/RSA/ECC), encryption/decryption, digital signatures, CMAC, PIN translation, key wrapping/export (TR-31/TR-34), IPEK derivation, ECDH, random generation
• pki (merged): certificate creation/renewal and CRL management under /v1/serv
• Both exposed over REST (/v1/crypto/*, /v1/serv/*) and gRPC (crypto.v1.CryptoService)

architecture

The service is written in Go on the crud service framework — lean and stdlib-first:

services/
  common/       # shared stdlib-only framework (auth, errs, respond, middleware)
  crypto_svc/   # this service
    internal/
      handlers/     # REST transport
      routers/      # route registration
      grpcserver/   # gRPC transport (API-key auth)
      services/     # usecase layer
      hsm/          # HSM seam: GP (software) + future PS/AT (real HSMs)
      crypto/       # pure-Go crypto engine (stdlib crypto/*)
      dukpt/        # ANSI X9.24-3 DUKPT (subpackage)
      apikey/ authz/ dto/ config/ middleware/ health/

• Stdlib-first: net/http, log/slog, crypto/*, encoding/asn1. The only third-party runtime deps are grpc + protobuf (gRPC transport). No database, no web framework, no crypto libraries.
• HSM abstraction: all symmetric-key and PKI operations flow through the hsm.HSM interface. GP (software, LMK-wrapped TR-31 key blocks) is the local development default; a real customer HSM (PS/AT) plugs in at the composition root (CRYPTO_HSM) with no usecase changes.
• Key hygiene: ordinary operations return keys wrapped under the LMK. The clear-key unwrap command is an opt-in internal operation with a dedicated role and audit boundary.

quick start

cd services/crypto_svc && make run    # REST :8001, gRPC :50051
docker compose up --build             # containerized, from repo root

The service is headless (service-to-service): auth is API-key based and fails closed. An explicit insecure override exists for local development only. See docs/setup.md.

testing

cd services/crypto_svc && make test    # go test ./...

See docs/testing.md.

Production-hardening and Python migration-parity work is tracked in todo.md.

license

MIT — see LICENSE and LICENSES.md for third-party notices (incl. the ASC X9 DUKPT attribution).