Does EJBCA CE support all the PQC algorithms validated ?

[fco-code-org]

Hello,

Is there some PQC algorithms only supported in EJBCA Enterprise ?
Is there somewhere a list of the PQC algorithms supported by EJBCA CE ?

Best Regards.

[primetomas]

You can find documentation here: https://docs.keyfactor.com/ejbca/latest/post-quantum-cryptography-keys-and-signatures

HSM support is as described in the documentation an Enterprise feature. HSM support is custom per each supported HSM, where there is PQC support at all of course.
Your post reminded me of one thing, LMS, which is supported in EJBCA but only using an HSM as per NIST requirements. Therefore LMS is only available in Enterprise.

Cheers,
Tomas

[primetomas]

Maybe I should summarize here. In EJBCA Community version 9.1 ML-DSA (FIPS 203) and Falcon (draft algorithm) is supported. There will be support for SLH-DSA is the next feature release. And LMS is supported in Enterprise only, due to HSM requirements.

[Piorun2002]

Do you plan to enable support for CKM_ML_DSA via PKCS#11 for HSMs in EJBCA CE edition?
Microsoft already supports ML-DSA / ML-KEK in certificates, Thales and Entrust also provide access to CKM_ML_DSA via PKCS#11.

[primetomas]

This is a different topic that this thread asks. I think it has been answered before?

CE uses the Java PKCS#11 provider, so that would be a question for Oracle...

We have support for that in EJBCA Enterprise support the P11NG Crypto Token. https://docs.keyfactor.com/ejbca/latest/post-quantum-cryptography-keys-and-signatures#id-(9.3.6)Post-QuantumCryptographyKeysandSignatures-UsingPost-QuantumalgorithmswithanHSMUsing_ECDSA_with_an_HSM

What do you mean with Microsoft? Azure Key vault doesn't list ML-DSA. https://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys-details

[Piorun2002]

CE_ uses the Java PKCS#11 provider, so that would be a question for Oracle.

I know that EJCB Ent support ML-DSA via P11NG, my question was related to EJBCA CE no Oracle.
Main HSM vendors (Thales and Entrust) provide access to CKM_ML_DSA via PKCS#11.
So why can't EJCBA CE use the regular PKCS#11 provided by HSM manufacturers?

What do you mean with Microsoft?

https://techcommunity.microsoft.com/blog/microsoft-security-blog/post-quantum-cryptography-apis-now-generally-available-on-microsoft-platforms/4469093

[primetomas]

Yeah, we've seen that. I colleague actually demonstrated it for me today. It's in toe core crypto but not integrated with the higher level tools yet so you can't actually create a CSR. It's great that Microsoft starts including PQC algorithms of course. There's a lot happening every month now on the PQC migration front.

[Piorun2002]

So we have to wait until JAVA SunPKCS11 will support ML-DSA - did I understand correctly ?
https://docs.oracle.com/en/java/javase/24/security/pkcs11-reference-guide1.html

[primetomas]

For PQC with HSM in CE yes. Without HSM support no (this thread is not about HSMs so I want to be clear about that), without HSMs it's been supported for a long time already.

In EE there is HSM support, it's a lot of custom development for different HSMs as PKCS#11v3.2 is not finalized yet so CKM_ML_DSA support actually differ a bit in different HSMs, although it is now synchronizing into the P11v3.2 values as the specification is very near final release now.
Here's a presentation I held at the PKIC PQC Conference in Austin in January. https://www.youtube.com/watch?v=UfL4Qm5yk_0&list=PL-BLLaXQJAfTLuRXJYwAAiJmZRGzhOvFd&index=9

[Piorun2002]

Thank you for the explanation, of course ML-DSA works great in the CE edition (SOFT Token) ... my question was related to PQC support by HSM... sorry for writing in the wrong thread

[primetomas]

No problem.

[Piorun2002]

And by the way, thank you for the link to the presentation - great job!

[Piorun2002]

ML-DSA appears to be supported in JAVA 24 SunPKCS11 Provider https://docs.oracle.com/en/java/javase/24/security/oracle-providers.html