Supported Algorithms | Keyfactor Docs

The algorithms available to a signing tool depend on the interface through which it accesses Signum keys:

Interface	Platform	Key Algorithm
CSP	Windows	RSA
KSP	Windows	RSA
PKCS#11	Windows	RSA
PKCS#11	Linux	RSA, ECDSA
PKCS#11	macOS	RSA, ECDSA
CryptoTokenKit	macOS	RSA, ECDSA

For interface overview, see Interoperability.

RSA Keys

Signum supports RSA key sizes of 2048, 3072, and 4096 bits across all interfaces and platforms. RSA 2048 is the minimum accepted key size. It meets current code signing baseline requirements and is compatible with all supported signing tools. RSA 3072 and RSA 4096 provide higher security margins and are appropriate for long-lived certificates or deployments with extended validity requirements.

RSA key sizes are ultimately dependent on the HSM support.

ECDSA Keys

ECDSA keys are particularly relevant for IoT device signing, container image signing, and other use cases where smaller key sizes and lower computational overhead are requirements. Any tool that accesses Signum through a PKCS#11 interface on Linux or macOS may use an ECDSA certificate in place of an RSA certificate, provided the certificate has been assigned to the signing user through a Signum policy.

Supported ECDSA Curves

The following ECDSA curves are supported on the Signum backend:

Curve	Common Name	Security
NIST P-256 / secp256r1	prime256v1	128-bit
NIST P-384 / secp384r1	-	192-bit
NIST P-521 / secp521r1	-	256-bit
secp256k1	Bitcoin / Ethereum curve	128-bit
Brainpool P-256	brainpoolP256r1	128-bit
Brainpool P-384	brainpoolP384r1	192-bit
Brainpool P-512	brainpoolP512r1	256-bit

ECDSA key sizes are ultimately dependent on the HSM support.

Digest Algorithms

Supported digest algorithms:

SHA-256
SHA-384
SHA-512

SHA-256 is the standard hash algorithm used across all supported signing tools. The specific digest algorithm used for a given signature is determined by the signing tool and its configuration, not by Signum directly.