Supported Algorithms and PQC
This page lists the algorithms that the Smart Key Attributes (SKA) feature supports. It can be separated into two categories:
-
The SKA key itself. This is the key that ultimately signs the requested message (for example, a cryptocurrency transaction or a document). An SKA key has a policy attached.
-
The approver key pair. Approvers sign approval tokens to allow the use of an SKA key. The approver public keys are listed in the SKA policy.
These keys can use different algorithms, they don't need to be the same.
Asymmetric (Classical)
SKA keys and approver keys support the following algorithms:
- RSA
- DSA
- ECDSA
- EdDSA
- BLS (JCE and TSB only)
Asymmetric (Post-Quantum)
SKA keys support the following algorithms:
| Algorithm | Minimum HSM version | Minimum JCE version | Minimum TSB version | Minimum PKCS#11 version |
|---|---|---|---|---|
| ML-DSA | 3.1.0 | 2.4.4 | 2.4.0 | 2.8.0 |
| SLH-DSA | 3.1.0 | 2.4.4 | 2.4.0 | 2.8.0 |
| HSS-LMS | 3.1.0 | 2.4.3 | 2.1.0 | 2.8.0 |
| XMSS | 3.1.0 | 2.4.3 | 2.8.5 | 2.8.0 |
| ML-KEM | 3.2.13, 3.3.6 | 2.6.4 | 2.8.16 | 2.8.0 |
Approver keys support the following algorithms:
| Algorithm | Minimum HSM version | Minimum JCE version | Minimum TSB version |
|---|---|---|---|
| ML-DSA | 3.2.13, 3.3.6 | 2.6.5 | 2.8.16 |
| SLH-DSA | 3.2.13, 3.3.6 | 2.6.6 | 2.8.16 |
| HSS-LMS | unsupported | - | - |
| XMSS | unsupported | - | - |
| ML-KEM | not a signing algorithm | - | - |
The PKCS#11 provider opaquely handles SKA policies and approval signatures. Therefore, any PKCS#11 version should work. It was tested with 2.8.0.
Symmetric
SKA keys and approver keys do not support symmetric algorithms (such as AES).
References
- List of algorithms supported by Primus HSM
- PKCS#11 releases
- JCE releases
- TSB releases