Supported keys¶
LAAVAT PKI and Signing Platform supports following keys and hash algorithms.
| Key Type | Key Size/Curve | Hash Algorithm | NIST Recommended | Notes |
|---|---|---|---|---|
| AES | 128 bits | N/A | Yes | |
| AES | 256 bits | N/A | Yes | |
| Passphrase | 32 bytes | N/A | N/A | Used for firmware update encryption |
| RSA | 1024 bits | SHA-256 | No | Legacy, not recommended |
| RSA | 1024 bits | SHA-512 | No | Legacy, not recommended |
| RSA | 2048 bits | SHA-256 | No | |
| RSA | 2048 bits | SHA-512 | No | |
| RSA | 3072 bits | SHA-256 | Yes | |
| RSA | 3072 bits | SHA-512 | Yes | |
| RSA | 4096 bits | SHA-256 | Yes | |
| RSA | 4096 bits | SHA-512 | Yes | |
| EC | secp224r1 | SHA-256 | No | |
| EC | secp224r1 | SHA-512 | No | |
| EC | secp256r1 | SHA-256 | Yes | |
| EC | secp256r1 | SHA-512 | Yes | |
| EC | secp384r1 | SHA-256 | No | |
| EC | secp384r1 | SHA-512 | Yes | |
| EC | secp521r1 | SHA-256 | No | |
| EC | secp521r1 | SHA-512 | Yes |
Post-quantum: ML-DSA
ML-DSA-44, ML-DSA-65 and ML-DSA-87 (FIPS 204) are implemented for signing and certificate issuance and are being enabled on the platform. They are not listed in the table yet because they are not yet generally available. See the FAQ.
Hash algorithms
The platform schema defines SHA-256 and SHA-512 as supported hash algorithms. SHA-384 may be available at the implementation level for specific signing operations (CMS, JAR, Windows signing) but is not part of the core schema enum.