Supported keys¶
LAAVAT PKI and Signing Platform supports following keys and hash algorithms.
| Key Type | Key Size/Curve | Hash Algorithm | NIST Recommended | Notes |
|---|---|---|---|---|
| AES | 128 bits | N/A | Yes | |
| AES | 256 bits | N/A | Yes | |
| Passphrase | 32 bytes | N/A | N/A | Used for firmware update encryption |
| RSA | 1024 bits | SHA-256 | No | Legacy, not recommended |
| RSA | 1024 bits | SHA-512 | No | Legacy, not recommended |
| RSA | 2048 bits | SHA-256 | No | |
| RSA | 2048 bits | SHA-512 | No | |
| RSA | 3072 bits | SHA-256 | Yes | |
| RSA | 3072 bits | SHA-512 | Yes | |
| RSA | 4096 bits | SHA-256 | Yes | |
| RSA | 4096 bits | SHA-512 | Yes | |
| EC | secp224r1 | SHA-256 | No | |
| EC | secp224r1 | SHA-512 | No | |
| EC | secp256r1 | SHA-256 | Yes | |
| EC | secp256r1 | SHA-512 | Yes | |
| EC | secp384r1 | SHA-256 | No | |
| EC | secp384r1 | SHA-512 | Yes | |
| EC | secp521r1 | SHA-256 | No | |
| EC | secp521r1 | SHA-512 | Yes |
Hash algorithms
The platform schema defines SHA-256 and SHA-512 as supported hash algorithms. SHA-384 may be available at the implementation level for specific signing operations (CMS, JAR, Windows signing) but is not part of the core schema enum.