View a markdown version of this page

Supported mechanisms for JCE provider for AWS CloudHSM Client SDK 5 - AWS CloudHSM
Generate key and key pair functionsCipher functionsSign and verify functionsDigest functionsHash-based message authentication code (HMAC) functionsCipher-based message authentication code (CMAC) functionsKey Agreement FunctionsConvert keys to key specifications using key factoriesMechanism annotations

Supported mechanisms for JCE provider for AWS CloudHSM Client SDK 5

This topic provides information about supported mechanisms for JCE provider with AWS CloudHSM Client SDK 5. For information about the Java Cryptography Architecture (JCA) interfaces and engine classes supported by AWS CloudHSM, see the following topics.

Generate key and key pair functions

The AWS CloudHSM software library for Java allows you to use the following operations for generate key and key pair functions.

  • RSA

  • EC

  • EdDSA (Ed25519)see note 2

  • ML-DSA

  • AES

  • DESede (Triple DES)see note 1

  • GenericSecret

Cipher functions

The AWS CloudHSM software library for Java supports the following algorithm, mode, and padding combinations.

Algorithm Mode Padding Notes
AES CBC

AES/CBC/NoPadding

AES/CBC/PKCS5Padding

Implements Cipher.ENCRYPT_MODE and Cipher.DECRYPT_MODE.

Implements Cipher.UNWRAP_MODE for AES/CBC NoPadding
AES ECB

AES/ECB/PKCS5Padding

AES/ECB/NoPadding

Implements Cipher.ENCRYPT_MODE and Cipher.DECRYPT_MODE.
AES CTR

AES/CTR/NoPadding

Implements Cipher.ENCRYPT_MODE and Cipher.DECRYPT_MODE.
AES GCM

AES/GCM/NoPadding

Implements Cipher.WRAP_MODE, Cipher.UNWRAP_MODE, Cipher.ENCRYPT_MODE, and Cipher.DECRYPT_MODE.

When performing AES-GCM encryption, the HSM ignores the initialization vector (IV) in the request and uses an IV that it generates. When the operation completes, you must call Cipher.getIV() to get the IV.
AESWrap ECB

AESWrap/ECB/NoPadding

AESWrap/ECB/PKCS5Padding

AESWrap/ECB/ZeroPadding

Implements Cipher.WRAP_MODE and Cipher.UNWRAP_MODE.
DESede (Triple DES) CBC

DESede/CBC/PKCS5Padding

DESede/CBC/NoPadding

Implements Cipher.ENCRYPT_MODE and Cipher.DECRYPT_MODE. See note 1 below for an upcoming change.
DESede (Triple DES) ECB

DESede/ECB/NoPadding

DESede/ECB/PKCS5Padding

Implements Cipher.ENCRYPT_MODE and Cipher.DECRYPT_MODE. See note 1 below for an upcoming change.
RSA ECB

RSA/ECB/PKCS1Padding see note 1

RSA/ECB/OAEPPadding

RSA/ECB/OAEPWithSHA-1ANDMGF1Padding

RSA/ECB/OAEPWithSHA-224ANDMGF1Padding

RSA/ECB/OAEPWithSHA-256ANDMGF1Padding

RSA/ECB/OAEPWithSHA-384ANDMGF1Padding

RSA/ECB/OAEPWithSHA-512ANDMGF1Padding

Implements Cipher.WRAP_MODE, Cipher.UNWRAP_MODE, Cipher.ENCRYPT_MODE, and Cipher.DECRYPT_MODE.
RSA ECB

RSA/ECB/NoPadding

Implements Cipher.ENCRYPT_MODE and Cipher.DECRYPT_MODE.
RSAAESWrap ECB

RSAAESWrap/ECB/OAEPPadding

RSAAESWrap/ECB/OAEPWithSHA-1ANDMGF1Padding

RSAAESWrap/ECB/OAEPWithSHA-224ANDMGF1Padding

RSAAESWrap/ECB/OAEPWithSHA-256ANDMGF1Padding

RSAAESWrap/ECB/OAEPWithSHA-384ANDMGF1Padding

RSAAESWrap/ECB/OAEPWithSHA-512ANDMGF1Padding

Implements Cipher.WRAP_MODE and Cipher.UNWRAP_MODE.

Sign and verify functions

The AWS CloudHSM software library for Java supports the following types of signature and verification. With Client SDK 5 and signature algorithms with hashing, the data is hashed locally in software before being sent to the HSM for the signature/verification. This means there is no limit on the size of the data that can be hashed by the SDK.

RSA signature types

  • NONEwithRSA

  • RSASSA-PSS

  • SHA1withRSA

  • SHA1withRSA/PSS

  • SHA1withRSAandMGF1

  • SHA224withRSA

  • SHA224withRSAandMGF1

  • SHA224withRSA/PSS

  • SHA256withRSA

  • SHA256withRSAandMGF1

  • SHA256withRSA/PSS

  • SHA384withRSA

  • SHA384withRSAandMGF1

  • SHA384withRSA/PSS

  • SHA512withRSA

  • SHA512withRSAandMGF1

  • SHA512withRSA/PSS

ECDSA signature types

  • NONEwithECDSA

  • SHA1withECDSA

  • SHA224withECDSA

  • SHA256withECDSA

  • SHA384withECDSA

  • SHA512withECDSA

ML-DSA signature types

  • ML-DSA

  • ML-DSA-44

  • ML-DSA-65

  • ML-DSA-87

  • ML-DSA-EXTERNAL-MU

EdDSA Signature Typessee note 2

  • Ed25519 or EdDSA (Maximum data size: 16,000 bytes)

  • Ed25519ph

Digest functions

The AWS CloudHSM software library for Java supports the following message digests. With Client SDK 5, the data is hashed locally in software. This means there is no limit on the size of the data that can be hashed by the SDK.

  • SHA-1

  • SHA-224

  • SHA-256

  • SHA-384

  • SHA-512

Hash-based message authentication code (HMAC) functions

The AWS CloudHSM software library for Java supports the following HMAC algorithms.

  • HmacSHA1 (Maximum data size in bytes: 16288)

  • HmacSHA224 (Maximum data size in bytes: 16256)

  • HmacSHA256 (Maximum data size in bytes: 16288)

  • HmacSHA384 (Maximum data size in bytes: 16224)

  • HmacSHA512 (Maximum data size in bytes: 16224)

Cipher-based message authentication code (CMAC) functions

CMACs (Cipher-based message authentication codes) create message authentication codes (MACs) using a block cipher and a secret key. They differ from HMACs in that they use a block symmetric key method for the MACs rather than a hashing method.

The AWS CloudHSM software library for Java supports the following CMAC algorithms.

  • AESCMAC

Key Agreement Functions

The AWS CloudHSM software library for Java supports ECDH with Key Derivation Functions (KDF). The following KDF types are supported:

  • ECDHwithX963SHA1KDF Supports X9.63 KDF SHA1 algorithm3

  • ECDHwithX963SHA224KDF Supports X9.63 KDF SHA224 algorithm3

  • ECDHwithX963SHA256KDF Supports X9.63 KDF SHA256 algorithm3

  • ECDHwithX963SHA384KDF Supports X9.63 KDF SHA384 algorithm3

  • ECDHwithX963SHA512KDF Supports X9.63 KDF SHA512 algorithm3

Convert keys to key specifications using key factories

You can use key factories to convert keys to key specifications. AWS CloudHSM has two types of key factories for JCE:

SecretKeyFactory: Used to import or derive symmetric keys. Using SecretKeyFactory, you can pass a supported Key or a supported KeySpec to import or derive symmetric keys into AWS CloudHSM. Following are the supported specs for KeyFactory:

  • For SecretKeyFactory's generateSecret method following