Algorithm Support

This Crypto Token relies on support for different algorithms in Java and the SunPKCS11 provider/wrapper as well as support in the PKCS#11 standard, the used PKCS#11 driver from the HSM vendor, and the supported algorithms in the HSM. A complete list of supported algorithms can thus not be compiled here and the following lists algorithms that are tested and known to work with an HSM supporting it. Also, see the specific SignServer Signer for algorithms that signers can work with and review signer-specific algorithm support pages.

Signature Algorithms

Algorithm Name	Also Known As	Comment
SHA1withRSA	RSASSA-PKCS_v1.5 using SHA1
SHA224withRSA	RSASSA-PKCS_v1.5 using SHA224
SHA256withRSA	RSASSA-PKCS_v1.5 using SHA256
SHA384withRSA	RSASSA-PKCS_v1.5 using SHA384
SHA512withRSA	RSASSA-PKCS_v1.5 using SHA512
NONEwithRSA	RSASSA-PKCS_v1.5	Depending on the Signer. Generally only supported by Plain Signer.
SHA1withRSAandMGF1	RSASSA-PSS using SHA1
SHA224withRSAandMGF1	RSASSA-PSS using SHA224
SHA256withRSAandMGF1	RSASSA-PSS using SHA256
SHA384withRSAandMGF1	RSASSA-PSS using SHA384
SHA512withRSAandMGF1	RSASSA-PSS using SHA512
NONEwithRSAandMGF1	RSASSA-PSS	Not supported by Java/SunPKCS11.
SHA1withECDSA	ECDSA using SHA1
SHA224withECDSA	ECDSA using SHA224
SHA256withECDSA	ECDSA using SHA256
SHA384withECDSA	ECDSA using SHA384
SHA512withECDSA	ECDSA using SHA512
NONEwithECDSA	ECDSA	Depending on the Signer. Generally only supported by Plain Signer.

Key Algorithms

Algorithm Name	Key Specification	Comment
RSA	1024 2048 4096	Other key lengths are likely also working.
ECDSA	Named curves: secp256r1 / prime256v1 / P-256 secp384r1 secp521r1	More named curves are likely working.
ECDSA	Explicit Parameters	A signer can be configured using the `EXPLICTECC` parameter (see Other Properties) to encode the EC parameters explicitly in the request. This goes for the supported named curves but a named curve is still needed when generating the key-pair. Certificates with explicit EC parameters cannot be read from the token. If the token contains certificates with explicit parameters, the token can not be used by this crypto token until those certificates have been removed. Instead, store the certificates with explicit EC parameters in the worker configuration, which allows them to be used that way.
AES	128 256