Supported Algorithms and PQC
This page lists the algorithms that the Smart Key Attributes (SKA) feature supports. It can be separated into two categories:
-
The SKA key itself. This is the key that ultimately signs the requested message (for example, a cryptocurrency transaction or a document). An SKA key has a policy attached.
-
The approver key pair. Approvers sign approval tokens to allow the use of an SKA key. The approver public keys are listed in the SKA policy.
These keys can use different algorithms, they don't need to be the same.
Asymmetric (Classical)
SKA keys and approver keys support the following algorithms (in any HSM firmware 3.x and corresponding API providers):
- RSA
- ECDSA
- EdDSA (Ed25519, Ed448)
- Ed448 approver keys require HSM 3.2.13, 3.3.6
- BLS (JCE and TSB only)
Asymmetric (Post-Quantum)
SKA keys support the following algorithms:
| Algorithm | Minimum HSM version | Minimum JCE version | Minimum TSB version | Minimum PKCS#11 version |
|---|---|---|---|---|
| ML-DSA | 3.1.0 | 2.4.4 | 2.4.0 | 2.8.0 |
| SLH-DSA | 3.1.0 | 2.4.4 | 2.4.0 | 2.8.0 |
| HSS-LMS | 3.1.0 | 2.4.3 | 2.1.0 | 2.8.0 |
| XMSS | 3.1.0 | 2.4.3 | 2.8.5 | 2.8.0 |
| ML-KEM | 3.2.13, 3.3.6 | 2.6.4 | 2.8.16 | 2.8.0 |
Approver keys support the following algorithms:
| Algorithm | Minimum HSM version | Minimum JCE version | Minimum TSB version |
|---|---|---|---|
| ML-DSA¹ | 3.2.13, 3.3.6 | 2.6.5 | 2.8.16 |
| SLH-DSA¹ | 3.2.13, 3.3.6 | 2.6.6 | 2.8.16 |
| HSS-LMS | unsupported | - | - |
| XMSS | unsupported | - | - |
| ML-KEM | not a signing algorithm | - | - |
The PKCS#11 provider opaquely handles SKA policies and approval signatures. Therefore, for the approver keys, any PKCS#11 version should work. It was tested with 2.8.0.
¹For PQC approver keys, only pure certificates are supported (no composite certificates).
Symmetric
SKA keys and approver keys do not support symmetric algorithms (such as AES).
SAM Mode
The SAM mode allows using Primus HSM as a Signature Activation Module, to create eIDAS-compliant qualified signatures. It modifies normal SKA to require approver certificates to be signed by one of the CAs that are allowlisted in the Partition Security Config.
The following algorithms are supported for the SAM CA certificates:
| Algorithm | Minimum HSM version |
|---|---|
| RSA | 3.1.0 |
| ECDSA | 3.1.0 |
| Ed25519 | 3.1.0 |
| Ed448 | 3.2.13, 3.3.6 |
| ML-DSA² | 3.2.13, 3.3.6 |
| SLH-DSA² | 3.2.13, 3.3.6 |
²For PQC SAM certificates, only pure certificates are supported (no composite certificates).
Even though the SAM mode can be enabled on any firmware version, certifiable SAM deployments require the use of a certified firmware version. As of March 2026, only 3.1.0 is certified.
FIPS Mode
Any HSM firmware version can be operated in FIPS mode, which restricts the available algorithms. These restrictions also apply to SKA. Please check the Supported Algorithms list to learn whether a specific algorithm is available in FIPS mode.
References
- List of algorithms supported by Primus HSM
- PKCS#11 releases
- JCE releases
- TSB releases