This Crypto Token relies on support for the algorithm in the PKCS#11 standard, the used PKCS#11 driver from the HSM vendor and the supported algorithms in the HSM. A complete list of supported algorithms can thus not be compiled here and the following lists algorithms that are tested and known to work with an HSM supporting it. Also, see the specific SignServer Signer for algorithms that signers can work with and review signer-specific algorithm support pages.

Note that the JackNJI11CryptoToken has been renamed P11NGCryptoToken as of SignServer 6.0.

Signature Algorithms


Algorithm Name

Also Known As

Comment

(bock)

SHA1withRSA

RSASSA-PKCS_v1.5 using SHA1


(bock)

SHA224withRSA

RSASSA-PKCS_v1.5 using SHA224


(bock)

SHA256withRSA

RSASSA-PKCS_v1.5 using SHA256


(bock)

SHA384withRSA

RSASSA-PKCS_v1.5 using SHA384


(bock)

SHA512withRSA

RSASSA-PKCS_v1.5 using SHA512


(bock)

NONEwithRSA

RSASSA-PKCS_v1.5

Depending on the Signer. Generally only supported by Plain Signer.

(bock)

SHA1withRSAandMGF1

RSASSA-PSS using SHA1


(bock)

SHA224withRSAandMGF1

RSASSA-PSS using SHA224


(bock)

SHA256withRSAandMGF1

RSASSA-PSS using SHA256


(bock)

SHA384withRSAandMGF1

RSASSA-PSS using SHA384


(bock)

SHA512withRSAandMGF1

RSASSA-PSS using SHA512


(bock)

NONEwithRSAandMGF1

RSASSA-PSS

Depending on the Signer. Generally only supported by Plain Signer.

(fel)

SHA1withECDSA

ECDSA using SHA1


(bock)

SHA224withECDSA

ECDSA using SHA224


(bock)

SHA256withECDSA

ECDSA using SHA256


(bock)

SHA384withECDSA

ECDSA using SHA384


(bock)

SHA512withECDSA

ECDSA using SHA512


(bock)

NONEwithECDSA

ECDSA

Depending on the signer. Generally only supported by Plain Signer.

(bock)

Ed25519

Pure EdDSA with Edwards25519

Depending on the Signer.

(fel)

Ed25519ph

Hash EdDSA with Edwards25519

Not yet implemented.

(fel)

Ed25519ctx

Context EdDSA with Edwards25519

Not yet implemented.

(bock)

Ed448

Pure EdDSA with Edwards448

Depending on the Signer.

(fel)

Ed448ph

Hash EdDSA with Edwards448

Not yet implemented.

(bock)

LMS


(varning) Experimental. Do not use it in production.

(bock)

Dilithium2


(varning) Experimental. Do not use it in production.

(bock)

Dilithium3


(varning) Experimental. Do not use it in production.

(bock)

Dilithium5


(varning) Experimental. Do not use it in production.

Key Algorithms


Algorithm Name

Key Specification

Comment

(bock)

RSA

Just key length:

  • 1024
  • 2048
  • 4096

Key length and public exponent (some examples):

  • 1024 exp 17
  • 1024 exp 0x11
  • 2048 exp 17
  • 4096 exp 65537

Other key lengths are likely also working.

For RSA it is possible to use a different exponent by suffixing the number with an "exp" followed by the exponent in decimal or prefixed with "0x" for hexadecimal. (see Crypto Token Generate Key Page)

The default value for the exponent is 65537.


(bock)

ECDSA

Named curves:

  • secp256r1 / prime256v1 / P-256
  • secp384r1
  • secp521r1

More named curves are likely working.

(bock)

ECDSA

Explicit parameters

A signer can be configured using the EXPLICTECC parameter (see Other Properties) to encode the EC parameters explicitly in the request. This goes for the supported named curves and a named curve is still needed when generating the key-pair.

Certificates with explicit parameters can be stored in the token.

(bock)

EdDSA

Ed25519
Ed448


(bock)

AES

128
256


(bock)

Dilithium

Dilithium2

Dilithium3

Dilithium5

(varning) Experimental. Do not use it in production.

(bock)

LMS

LMS_SHA256_N32_H5

(varning) Experimental. Do not use it in production.

Related Content

  • Sida:
    (5.8.1) JackNJI11CryptoToken Algorithm Support
  • Sida:
    (5.8.1) PKCS11CryptoToken Algorithm Support
  • Sida:
    (5.8.1) Time Stamp Signer Algorithm Support
  • Sida:
    (5.8.1) Plain Signer Algorithm Support
  • Sida:
    (5.8.1) PDF Signer Algorithm Support
  • Sida:
    (5.8.1) MS Authenticode Signer Algorithm Support
  • Sida:
    (5.8.1) CMS Signer Algorithm Support
  • Sida:
    (5.8.1) AdES Signer Algorithm Support
  • Sida:
    (5.8.1) Signers Algorithm Support
  • Sida:
    (5.8.2) JackNJI11CryptoToken Algorithm Support
  • Sida:
    (5.8.2) PKCS11CryptoToken Algorithm Support
  • Sida:
    (5.8.2) Plain Signer Algorithm Support
  • Sida:
    (5.8.2) MS Authenticode Signer Algorithm Support
  • Sida:
    (5.8.2) CMS Signer Algorithm Support
  • Sida:
    (5.8.2) AdES Signer Algorithm Support