Thales Luna

Not to be confused with

Thales ProtectServer. Sold by the same company and easy to mistake for each other, but they are unrelated product lines. Luna arrived through Chrysalis and SafeNet. ProtectServer arrived through Eracom. Neither one's documentation describes the other, and where a constant name appears in both it can carry a different number.

Eighty-two roads to CKR_DEVICE_ERROR

The native table has 352 codes and 350 of them name the CKR value the caller sees. The CKR side has 117 distinct values. Sixty of those are Luna’s own vendor codes, so a good part of the mapping is one-to-one and the caller learns as much as the log does. The rest is where it gets lossy. Eighty-two native codes become CKR_DEVICE_ERROR, thirty-two become CKR_DATA_INVALID, twenty-seven CKR_ARGUMENTS_BAD and twenty-five CKR_CALLBACK_ERROR. Only three become CKR_GENERAL_ERROR and two CKR_FUNCTION_FAILED, which is the reverse of the open source libraries here, where the general error is the workhorse. On Luna the device error is. Two native codes map to names the specification no longer has. CKR_FLAGS_INVALID and CKR_SESSION_EXCLUSIVE_EXISTS were in PKCS#11 v1 and the table still says so, which dates the mapping.

One name, two numbers, on one page

The vendor return code page lists CKR_ACCESS_ID_INVALID twice, at 0x80000068 and again at 0x80000400. I kept the first and the table says so. It is the only such case in the 127, and I have no way to tell which one the firmware returns. Two of Luna’s vendor names also exist in ProtectServer’s list, and there they agree: CKR_OBJECT_READ_ONLY at 0x80000114 and CKR_KEY_NOT_ACTIVE at 0x80000136 on both. The five BIP32 codes do not, and that comparison is on the libraries index.

Mechanisms are named, rarely numbered

The firmware 7.9.2 mechanism summary lists 323 mechanisms, 115 of them with names the specification does not have. Only six of the 115 have a number anywhere in the documentation I could find, all in the DES and DUKPT family. Thales publishes the rest as names only, the same policy as ProtectServer, so a vendor-range mechanism value from a Luna log mostly cannot be named from public sources. No Luna client was available to probe, which would have given the numbers without the names.

Return values

Every CKR_ constant the vendor documents above 0x80000000. The base specification defines none of them, so a value in this range means nothing until you know which library returned it.

The source page lists 1 name at more than one value. The first listing is kept above. CKR_ACCESS_ID_INVALID also appears at 0x80000400.

documented · Luna HSM 7 documentation · 2026-09-10

The library's own codes

352 codes the library uses internally and prints in its logs, each with the CKR_ value the caller receives for it. The mapping is the vendor's own table. Where many of these collapse into one CKR_, the log is the only place the real reason survives.

documented · Luna HSM 7 documentation · 2026-09-10

Vendor mechanisms with a published number

6 of the 115 vendor-defined mechanism names in the documentation come with a number somewhere in it. The rest are names only, so they cannot be matched to a value seen in a log.

This library is one column of Same name, different number, the table of constants that carry one name and more than one value.

Return values with a note for this library

• CKR_GENERAL_ERROR · Not a failed call but a broken library. The specification says nothing further will work, so retrying it is wasted effort.
• CKR_FUNCTION_FAILED · A recoverable failure. The library is still usable and the token unchanged, so this one is worth investigating rather than restarting.
• CKR_ARGUMENTS_BAD · A pointer or a count the library will not accept. Sometimes a genuine bug, and sometimes a mechanism that requires an argument to be null.
• CKR_ATTRIBUTE_READ_ONLY · The attribute cannot be changed on this object, or cannot be supplied at creation because the token sets it. Computed flags, identity, or a locked object.
• CKR_ATTRIBUTE_TYPE_INVALID · The object has no such attribute, or this library never stored it. Common when reading fields that only exist for another key type, and in object dumps.
• CKR_DATA_INVALID · Right length, wrong content. A DigestInfo the token cannot parse, an EC point in the wrong encoding, or on a card, a status word with nowhere else to go.
• CKR_DEVICE_ERROR · The PKCS#11 catch-all for a token that has gone wrong. Usually a stale handle after a reset, a dead client link, or a mechanism the firmware refuses.
• CKR_FUNCTION_NOT_SUPPORTED · The library exports the function and will not perform it. Usually a v3.0 message call, a dual-function update, or a wrap on a token that never wraps.
• CKR_KEY_TYPE_INCONSISTENT · The key's type does not fit the mechanism. An EC key on an RSA mechanism, an Edwards key on ECDSA, or a find that returned the certificate instead.
• CKR_OPERATION_NOT_INITIALIZED · Sign, Update or Final with no matching Init on this session. An Init whose failure was ignored, an operation the library reset, or a session shared by threads.
• CKR_PIN_LOCKED · The token has locked the PIN after too many failed attempts. On most HSMs this is not something you can wait out, and on some it destroys the partition.
• CKR_TEMPLATE_INCOMPLETE · The template does not fully specify the object. A missing CKA_CLASS or CKA_KEY_TYPE on create, a missing CKA_VALUE_LEN on generate, or a vendor rule.
• CKR_USER_ALREADY_LOGGED_IN · A login on a token that already has that user logged in through another session. Two components sharing a token, or a retry after a login that succeeded.

How this page was made

Documented only. The three tables come from Thales' published Luna 7 documentation, reduced to names, numbers and the native-to-CKR mapping. The mechanism numbers were searched for in each mechanism's own page, and the count found is stated. No Luna library was available to probe and no SDK file was read.

Scope. Every value here is what the documentation says on the read date, which is not always the same as what a given firmware does. The vendor return code page notes that some codes only appear from firmware 7.8.1 onward. The mechanism summary is for firmware 7.9.2, and earlier firmware lists fewer.

Sources

• Vendor-defined return codes, Luna Network HSM 7, Thales. Read 2026-09-10. Used for the 127 vendor CKR names and values.
• Cryptographic module and token return codes, Luna Network HSM 7, Thales. Read 2026-09-10. Used for the 352 LUNA_RET codes, their values, and the CKR each maps to.
• Firmware 7.9.2 mechanisms, Luna Network HSM 7, Thales. Read 2026-09-10. Used for the mechanism names, and the per-mechanism pages it links for numbers.
• BIP32 mechanism support and implementation, Luna HSM 7, Thales. Read 2026-09-09. Used for the BIP32 constants in the comparison with ProtectServer.
• PTK-C vendor-defined error codes, ProtectToolkit 5.9, Thales. Read 2026-09-10. Used for the ProtectServer side of the BIP32 comparison.

Names and numbers only. No vendor documentation text is reproduced here.