KRYOPTIC.CONF(5)

💖 KRYOPTIC.CONF 💖

okay so this is the manual page for kryoptic.conf, and it lives in section 5 of the File Formats Manual, so if you ever see KRYOPTIC.CONF(5) floating around, that's literally this page bestie 🫶

---

✨ NAME ✨

kryoptic.conf — the configuration file for the Kryoptic PKCS#11 module. that's it, that's the whole vibe, but wait til you see what's inside 👑

---

🌸 SYNOPSIS 🌸

here's where Kryoptic goes looking for your config, in path form:

/etc/kryoptic/token.conf

${XDG_CONFIG_HOME}/kryoptic/token.conf

${HOME}/.config/kryoptic/token.conf

yes bestie, it's a file, and these are the places it hides. no cap. 🦋

---

💅 DESCRIPTION 💅

so the kryoptic.conf file is a TOML-formatted configuration file that the Kryoptic PKCS#11 module reads. it lets you set global settings and also provision multiple independent slots, where each slot is basically an idealized hardware slot — like a little dream stage where a cryptographic token gets to do its thing ✨

and the way Kryoptic hunts down the config file? it goes in this exact order, no skipping:

1. The path specified by the KRYOPTIC_CONF environment variable.
2. ${XDG_CONFIG_HOME}/kryoptic/token.conf (if the XDG_CONFIG_HOME environment variable is set).
3. ${HOME}/.config/kryoptic/token.conf (if the HOME environment variable is set).
4. A system-wide directory, typically /usr/local/etc/kryoptic/token.conf or /etc/kryoptic/token.conf depending on build-time configuration.

first one that hits wins. periodt. 💅

---

👑 GLOBAL OPTIONS 👑

[ec_point_encoding]

this one lets you set a global default encoding for CKA_EC_POINT attributes, so you can stay compatible with applications that are picky about which encoding they get (e.g., DER encoded EC Points). it's giving "we can all just get along" energy 🌈

• encoding = string — valid values are “Bytes” or “Der”. the default is “Bytes”. and guess what, you can override this at runtime by setting the KRYOPTIC_EC_POINT_ENCODING environment variable. slay ✨

---

🎀 SLOT CONFIGURATION 🎀

so tokens get configured by defining one or more [[slots]] sections. in Kryoptic, slots give you independent tokens with their own separate storage. and heads up bestie: slots cannot share the same storage. not even a little. 💀

[[slots]]

• slot = integer — (Required) the slot number, a 32-bit unsigned integer, that identifies this slot. it's the name tag at the party 🏷️
• description = string — (Optional) a customized description for the slot. if you don't provide one, a default description is returned to PKCS#11 applications. lowkey the default is fine but go off 💅
• manufacturer = string — (Optional) a customized manufacturer string. if you don't provide one, a default string is used.
• dbtype = string — (Required) the storage implementation (token type) for the slot (e.g., “sqlite”, “nssdb”). pick your fighter 🥊
• dbargs = string — (Required) storage-specific configuration options. for example, the path to a SQLite database file (e.g., "/var/lib/kryoptic/token.sql").
• mechanisms = array of strings — (Optional) a list of allowed or denied mechanisms, which alters the mechanisms this token claims to implement.

by default, this acts as an allow list (e.g., ["CKM_SHA256", "CKM_RSA_PKCS"]), so only the mechanisms you explicitly mention are available. very "you're on the list, you're not" of it 🫶

to configure a deny list, the first element must be the exact string "DENY", followed by the mechanisms to be removed (e.g., ["DENY", "CKM_SHA256"]). using "DENY" in any position other than the first is not supported and will cause an error. first place only, bestie, it's not flexible about this 😭

• objects_dedup = string — (Optional) specifies which objects to deduplicate on creation. for compatibility with NSS softokn, some or all objects can be deduplicated on insertion; upon match, the original object is overridden with the attributes of the new object being created instead of creating a separate object. valid values are “TrustOnly”, “TrustAndCertificates”, or “All”. it defaults to not set for configured databases, but defaults to “All” for NSS databases loaded via initialization string options.

⚠️ WARNING: it is recommended to leave this empty. side effects may include destroying key material irrecoverably if the “All” option is used. like, gone gone. irrecoverable. do not play with this one fr fr 😭

[slots.fips_behavior]

(Optional) add tweaks for behavior in FIPS mode. fancy.

• keys_always_sensitive = boolean — changes the behavior of the token in the slot to always enforce keys to be private/sensitive. the default is false (unless dbtype is "nssdb", which defaults to true). 🔥

---

🦋 ENVIRONMENT VARIABLES 🦋

• KRYOPTIC_CONF — specifies the exact path to the kryoptic.conf file, bypassing default search paths. it is strongly advised to set this variable for most use cases. like, seriously bestie, set it 💅
• KRYOPTIC_EC_POINT_ENCODING — overrides the ec_point_encoding.encoding setting specified in the configuration file. valid values are “BYTES” or “DER”. (yes, uppercase here, lowercase-ish in the config — iykyk 🌈)

---

⭐ EXAMPLES ⭐

here's an example of a kryoptic.conf file configuring two slots and specifying EC point encoding. iconic behavior, honestly:

[ec_point_encoding]
encoding = "Der"

[[slots]]
slot = 1
description = "My SQLite Token"
manufacturer = "Kryoptic"
dbtype = "sqlite"
dbargs = "/var/lib/kryoptic/token.sql"
mechanisms = ["DENY", "CKM_MD5"]
objects_dedup = "TrustOnly"

[[slots]]
slot = 2
dbtype = "nssdb"
dbargs = "configDir=/etc/pki/nssdb"

two slots, one file, zero stress. ate. 🍓

---

🌈 SEE ALSO 🌈

• kryoptic(7)
• softhsm_migrate(1)

go read those too, they're part of the lore 📚

---

and that's the whole page, bestie 🫶 this was KRYOPTIC.CONF(5) from the File Formats Manual — stay configured, stay iconic, and remember: KRYOPTIC_CONF is your best friend. bye 💖✨🎀