The Sovereign Infrastructure Mandate

Modern enterprise architectures cannot outsource their foundational cryptographic trust to third-party hosted black-boxes or custodial intermediaries. Custodial dependency introduces counterparty solvency risk, regulatory exposure, and single points of operational failure.

Crypto Service Suite is open-source software you can run on your own infrastructure, on-premises or in a private cloud. It does not integrate with hardware security modules (HSMs): the crypto-kms PKCS#11 provider is an in-memory software simulation for tests.

The Four-Layer Monorepo Architecture

The suite is divided into 18 specialized, decoupled packages maintained in a strict monorepo moving in lockstep semantic versioning:

LAYER 1 // FOUNDATION

Core Primitives

@sebastienrousseau/crypto-lib implements FIPS 203/204/205 algorithms (via @noble/post-quantum; not a validated cryptographic module) and classical ciphers built on the @noble/* libraries and OpenPGP.js. @sebastienrousseau/crypto-wasm is a placeholder and contains no WebAssembly code yet.

LAYER 2 // INFRASTRUCTURE & ORM

KMS, Edge & Database Field Encryption

@sebastienrousseau/crypto-kms, crypto-edge, crypto-prisma, and crypto-typeorm provide a unified KMS interface (AWS and local providers implemented; GCP, Azure and Vault are stubs), edge runtime support (Cloudflare Workers, Vercel Edge, Deno, Bun, browsers), and transparent database column encryption.

LAYER 3 // PROTOCOLS & CLIENTS

Servers, APIs, SDK & UI Integrations

@sebastienrousseau/crypto-server, crypto-api, crypto-cli, crypto-sdk, crypto-react, and crypto-vue expose a Fastify REST service, a zero-dependency fetch-based SDK client, an interactive CLI, and reactive frontend hooks.

LAYER 4 // ASSURANCE & AI

Regulatory Auditing, IDE Static Analysis & AI Tooling

@sebastienrousseau/crypto-cbom, crypto-lsp, crypto-mcp, crypto-benchmarks, and crypto-testing deliver CycloneDX 1.6 and SPDX 3.0 cryptographic bills of materials, Language Server Protocol linting, Model Context Protocol server tools, benchmarking harnesses, and test fixtures.

Engineering Discipline & Verification Gates

Quality Gates and Known Limits

Coverage gates: CI enforces 100% line and function coverage in every package (mocha and c8), and 100% branch coverage in every package except crypto-lib (99.5%).
Memory zeroization is limited: crypto-lib exports wipeMemory() and SecureBuffer, but its own APIs do not call them, and keys passed as hex strings cannot be wiped.
No constant-time guarantee: The implementations have not been formally verified against timing side channels. @noble/post-quantum does not guarantee constant-time execution.
Licensing and supply chain: Dual-licensed under Apache 2.0 and MIT. CI generates a software bill of materials (SBOM) and runs pnpm audit and CodeQL.
Regulation: The suite provides building blocks, such as a CycloneDX CBOM generator, that can support DORA (EU 2022/2554) work. Using it does not make a system DORA compliant.

Engage with the Maintainers

Learn how fintechs, banks, and enterprise engineering teams leverage Crypto Service Suite for sovereign cryptographic operations.

Request Architecture Briefing → GitHub Specifications →