Post-Quantum Cryptography

Both Securosys HSMs and OpenSSL have support for post-quantum cryptography (PQC). This page shows how to use PQC via OpenSSL and backed by Primus HSM.

Supported Software Versions

To use PQC with Primus HSM via OpenSSL, you need to have the following minimum software versions. Older versions are not supported.

• HSM firmware 3.0
• Primus PKCS#11 Provider 2.6.2
• OpenSSL 3.5
• OpenSSL pkcs11-provider 1.1

This means that you need to use Debian 14 "forky" or Ubuntu 26.04 "resolute" if you want to use distribution-provided packages. For Debian 13 "trixie", you can install the pkcs11-provider from backports. For other distributions, you may need to compile OpenSSL and/or the provider yourself.

Installation

Install and configure OpenSSL as described in the OpenSSL 3.x/4.x guide.

Once installed, you will see the PQC algorithms (such as ML-DSA) listed for the @ pkcs11 provider:

$ openssl list -signature-algorithms

# some lines omitted ...

ED25519ph @ pkcs11
ED25519ctx @ pkcs11
ED448ph @ pkcs11
ECDSA @ pkcs11
{ 1.2.840.10045.4.1, ECDSA-SHA-1, ECDSA-SHA1, ecdsa-with-SHA1 } @ pkcs11
{ 1.2.840.10045.4.3.1, ECDSA-SHA2-224, ECDSA-SHA224, ecdsa-with-SHA224 } @ pkcs11
{ 1.2.840.10045.4.3.2, ECDSA-SHA2-256, ECDSA-SHA256, ecdsa-with-SHA256 } @ pkcs11
{ 1.2.840.10045.4.3.3, ECDSA-SHA2-384, ECDSA-SHA384, ecdsa-with-SHA384 } @ pkcs11
{ 1.2.840.10045.4.3.4, ECDSA-SHA2-512, ECDSA-SHA512, ecdsa-with-SHA512 } @ pkcs11
{ 2.16.840.1.101.3.4.3.9, ECDSA-SHA3-224, ecdsa_with_SHA3-224, id-ecdsa-with-sha3-224 } @ pkcs11
{ 2.16.840.1.101.3.4.3.10, ECDSA-SHA3-256, ecdsa_with_SHA3-256, id-ecdsa-with-sha3-256 } @ pkcs11
{ 2.16.840.1.101.3.4.3.11, ECDSA-SHA3-384, ecdsa_with_SHA3-384, id-ecdsa-with-sha3-384 } @ pkcs11
{ 2.16.840.1.101.3.4.3.12, ECDSA-SHA3-512, ecdsa_with_SHA3-512, id-ecdsa-with-sha3-512 } @ pkcs11
{ 2.16.840.1.101.3.4.3.17, id-ml-dsa-44, ML-DSA-44, MLDSA44 } @ pkcs11
{ 2.16.840.1.101.3.4.3.18, id-ml-dsa-65, ML-DSA-65, MLDSA65 } @ pkcs11
{ 2.16.840.1.101.3.4.3.19, id-ml-dsa-87, ML-DSA-87, MLDSA87 } @ pkcs11

Usage

To generate an ML-DSA key:

openssl genpkey -propquery "provider=pkcs11" -algorithm ML-DSA-87 \
    -pkeyopt "pkcs11_uri:pkcs11:token=${P11_TOKEN};object=${P11_LABEL}?pin-value=${P11_PIN}"

See the OpenSSL CLI tutorial for more commands, such as exporting the public key and signing data.