Supported Algorithms

The algorithms available to a signing tool depend on the interface through which it accesses Signum keys:

For interface overview, see Interoperability.

RSA Keys

Signum supports RSA key sizes of 2048, 3072, and 4096 bits across all interfaces and platforms. RSA 2048 is the minimum accepted key size. It meets current code signing baseline requirements and is compatible with all supported signing tools. RSA 3072 and RSA 4096 provide higher security margins and are appropriate for long-lived certificates or deployments with extended validity requirements.

ECDSA Keys

ECDSA keys are particularly relevant for IoT device signing, container image signing, and other use cases where smaller key sizes and lower computational overhead are requirements.

Tools that access Signum through a PKCS#11 interface on Windows, Linux, or macOS can use an ECDSA certificate instead of an RSA certificate. To use an ECDSA certificate, assign the certificate to the signing user through a Signum policy. Tools using the Windows KSP or macOS CryptoTokenKit can also use ECDSA keys.

Digest Algorithms

Supported digest algorithms:

• SHA-256

• SHA-384

• SHA-512

SHA-256 is the standard hash algorithm used across all supported signing tools. The specific digest algorithm used for a given signature is determined by the signing tool and its configuration, not by Signum directly.