EU FIPS Mechanism Summary

The following table provides a summary of all of the supported mechanisms for all FIPS Luna Cloud HSM Services in the EU region.
MechanismFIPS Approved?Supported FunctionsFunctions Restricted from FIPS UseMin Key Length (bits)Min Key Length for FIPS Use (bits)Min Legacy Key Length for FIPS Use (bits)Max Key Length (bits)Block SizeDigest SizeKey TypesAlgorithmsModesFlags
CKM_AES_CBC.htm">CKM_AES_CBC.htm">CKM_AES_CBC YesEncrypt | Decrypt | Wrap | UnwrapCannot wrap128128N/A256160AESAESCBCExtractable
CKM_AES_CBC_ENCRYPT_DATA.htm">CKM_AES_CBC_ENCRYPT_DATA.htm">CKM_AES_CBC_ENCRYPT_DATA YesDeriveNone128128N/A25600AESNoneNoneNone
CKM_AES_CBC_PAD.htm">CKM_AES_CBC_PAD.htm">CKM_AES_CBC_PAD YesEncrypt | Decrypt | Wrap | UnwrapCannot wrap128128N/A256160AESAESCBC_PADExtractable
CKM_AES_CFB8.htm">CKM_AES_CFB8.htm">CKM_AES_CFB8 YesEncrypt | DecryptNone128128N/A256161AESAESCFBExtractable
CKM_AES_CFB128.htm">CKM_AES_CFB128.htm">CKM_AES_CFB128 YesEncrypt | DecryptNone128128N/A2561616AESAESCFBExtractable
CKM_AES_CMAC.htm">CKM_AES_CMAC.htm">CKM_AES_CMAC YesSign | VerifyNone128128N/A256160AESAESMACExtractable | CMAC
CKM_AES_CMAC_GENERAL.htm">CKM_AES_CMAC_GENERAL.htm">CKM_AES_CMAC_GENERAL YesSign | VerifyNone128128N/A256160AESAESMACExtractable | CMAC
CKM_AES_CTR.htm">CKM_AES_CTR.htm">CKM_AES_CTR YesEncrypt | Decrypt | Wrap | UnwrapCannot wrap128128N/A256160AESAESCTRExtractable
CKM_AES_ECB.htm">CKM_AES_ECB.htm">CKM_AES_ECB YesEncrypt | Decrypt | Wrap | UnwrapCannot wrap128128N/A256160AESAESECBExtractable
CKM_AES_ECB_ENCRYPT_DATA.htm">CKM_AES_ECB_ENCRYPT_DATA.htm">CKM_AES_ECB_ENCRYPT_DATA YesDeriveNone128128N/A25600AESNoneNoneNone
CKM_AES_GCM.htm">CKM_AES_GCM.htm">CKM_AES_GCM YesEncrypt | Decrypt | Wrap | UnwrapNone128128N/A256160AESAESGCMExtractable | Accumulating
CKM_AES_GMAC.htm">CKM_AES_GMAC.htm">CKM_AES_GMAC YesSign | VerifyNone128128N/A256160AESAESGCMExtractable | Accumulating
CKM_AES_KEY_GEN.htm">CKM_AES_KEY_GEN.htm">CKM_AES_KEY_GEN YesGenerate KeyNone128128N/A25600AESNoneNoneNone
CKM_AES_KW.htm">CKM_AES_KW.htm">CKM_AES_KW YesEncrypt | Decrypt | Wrap | UnwrapNone128128N/A25680AESAESKEYWRAPExtractable | Accumulating
CKM_AES_KWP.htm">CKM_AES_KWP.htm">CKM_AES_KWP YesEncrypt | Decrypt | Wrap | UnwrapNone128128N/A25680AESAESKEYWRAP_PADExtractable | Accumulating
CKM_AES_OFB.htm">CKM_AES_OFB.htm">CKM_AES_OFB YesEncrypt | DecryptNone128128N/A256160AESAESOFBExtractable
CKM_AES_XTS.htm">CKM_AES_XTS.htm">CKM_AES_XTS YesEncrypt | DecryptNone128128N/A256160AESAESXTSExtractable
CKM_DSA.htm">CKM_DSA.htm">CKM_DSA YesSign | VerifyNone102420481024307200DSADSANoneNone
CKM_DSA_KEY_PAIR_GEN.htm">CKM_DSA_KEY_PAIR_GEN.htm">CKM_DSA_KEY_PAIR_GEN YesGenerate Key PairNone102420481024307200DSANoneNoneNone
CKM_DSA_PARAMETER_GEN.htm">CKM_DSA_PARAMETER_GEN.htm">CKM_DSA_PARAMETER_GEN YesGenerate KeyNone102420481024307200DSANoneNoneNone
CKM_DSA_SHA1.htm">CKM_DSA_SHA1.htm">CKM_DSA_SHA1 YesSign | VerifyCannot sign10242048102430726420DSASHANoneExtractable
CKM_DSA_SHA224.htm">CKM_DSA_SHA224.htm">CKM_DSA_SHA224 YesSign | VerifyNone10242048102430726428DSASHA224NoneExtractable
CKM_DSA_SHA256.htm">CKM_DSA_SHA256.htm">CKM_DSA_SHA256 YesSign | VerifyNone10242048102430726432DSASHA256NoneExtractable
CKM_EC_KEY_PAIR_GEN.htm">CKM_EC_KEY_PAIR_GEN.htm">CKM_EC_KEY_PAIR_GEN YesGenerate Key PairNone10522416057100ECDSANoneNoneNone
CKM_EC_KEY_PAIR_GEN_W_EXTRA_BITS.htm">CKM_EC_KEY_PAIR_GEN_W_EXTRA_BITS.htm">CKM_EC_KEY_PAIR_GEN_W_EXTRA_BITS YesGenerate Key PairNone10522416057100ECDSANoneNoneExtra bits
CKM_EC_MONTGOMERY_KEY_PAIR_GEN.htm">CKM_EC_MONTGOMERY_KEY_PAIR_GEN.htm">CKM_EC_MONTGOMERY_KEY_PAIR_GEN YesGenerate Key PairNone256256N/A25600EC_MONTNoneNoneNone
CKM_ECDH1_COFACTOR_DERIVE.htm">CKM_ECDH1_COFACTOR_DERIVE.htm">CKM_ECDH1_COFACTOR_DERIVE YesDeriveNone10522416057100ECDSA | BIP32NoneNoneNone
CKM_ECDH1_DERIVE.htm">CKM_ECDH1_DERIVE.htm">CKM_ECDH1_DERIVE YesDeriveNone10522416057100ECDSA | EC_MONT | BIP32NoneNoneNone
CKM_ECDSA.htm">CKM_ECDSA.htm">CKM_ECDSA YesSign | VerifyNone10522416057100ECDSA | BIP32ECDSANoneNone
CKM_ECDSA_SHA1.htm">CKM_ECDSA_SHA1.htm">CKM_ECDSA_SHA1 YesSign | VerifyCannot sign1052241605716420ECDSA | BIP32SHANoneExtractable
CKM_ECDSA_SHA224.htm">CKM_ECDSA_SHA224.htm">CKM_ECDSA_SHA224 YesSign | VerifyNone1052241605716428ECDSA | BIP32SHA224NoneExtractable
CKM_ECDSA_SHA256.htm">CKM_ECDSA_SHA256.htm">CKM_ECDSA_SHA256 YesSign | VerifyNone1052241605716432ECDSA | BIP32SHA256NoneExtractable
CKM_ECDSA_SHA384.htm">CKM_ECDSA_SHA384.htm">CKM_ECDSA_SHA384 YesSign | VerifyNone10522416057112848ECDSA | BIP32SHA384NoneExtractable
CKM_ECDSA_SHA512.htm">CKM_ECDSA_SHA512.htm">CKM_ECDSA_SHA512 YesSign | VerifyNone105224160571128(ECDSA | BIP32SHA512NoneExtractable
CKM_ECIES.htm">CKM_ECIES.htm">CKM_ECIES YesEncrypt | DecryptNone10522416057100ECDSA | EC_MONT | BIP32NoneNoneAccumulating
CKM_GENERIC_SECRET_KEY_GEN.htm">CKM_GENERIC_SECRET_KEY_GEN.htm">CKM_GENERIC_SECRET_KEY_GEN YesGenerate KeyNone8112N/A409600NoneNoneNoneNone
CKM_HMAC_SHA3_224.htm">CKM_HMAC_SHA3_224.htm">CKM_HMAC_SHA3_224 YesSign | VerifyNone811280409614428SymmetricSHA3_224HMACExtractable
CKM_HMAC_SHA3_256.htm">CKM_HMAC_SHA3_256.htm">CKM_HMAC_SHA3_256 YesSign | VerifyNone811280409613632SymmetricSHA3_256HMACExtractable
CKM_HMAC_SHA3_384.htm">CKM_HMAC_SHA3_384.htm">CKM_HMAC_SHA3_384 YesSign | VerifyNone811280409610448SymmetricSHA3_384HMACExtractable
CKM_HMAC_SHA3_512.htm">CKM_HMAC_SHA3_512.htm">CKM_HMAC_SHA3_512 YesSign | VerifyNone81128040967264SymmetricSHA3_512HMACExtractable
CKM_NIST_PRF_KDF.htm">CKM_NIST_PRF_KDF.htm">CKM_NIST_PRF_KDF YesDeriveNone8112N/A409600SymmetricNoneNoneNone
CKM_RSA_FIPS_186_3_AUX_PRIME_KEY_PAIR_GEN.htm">CKM_RSA_FIPS_186_3_AUX_PRIME_KEY_PAIR_GEN.htm">CKM_RSA_FIPS_186_3_AUX_PRIME_KEY_PAIR_GEN YesGenerate Key PairNone102420481024409600RSANoneNoneNone
CKM_RSA_FIPS_186_3_PRIME_KEY_PAIR_GEN.htm">CKM_RSA_FIPS_186_3_PRIME_KEY_PAIR_GEN.htm">CKM_RSA_FIPS_186_3_PRIME_KEY_PAIR_GEN YesGenerate Key PairNone20482048N/A409600RSANoneNoneNone
CKM_RSA_PKCS.htm">CKM_RSA_PKCS.htm">CKM_RSA_PKCS YesSign | Verify | Encrypt | Decrypt | Wrap | UnwrapCannot wrap | Cannot legacy decrypt | Cannot legacy unwrap | Cannot encrypt25620481024819200RSANoneNoneNone
CKM_RSA_PKCS_OAEP.htm">CKM_RSA_PKCS_OAEP.htm">CKM_RSA_PKCS_OAEP YesEncrypt | Decrypt | Wrap | UnwrapNone | Cannot legacy decrypt | Cannot legacy unwrap25620481024819200RSANoneNoneNone
CKM_RSA_PKCS_PSS.htm">CKM_RSA_PKCS_PSS.htm">CKM_RSA_PKCS_PSS YesSign | VerifyNone25620481024819200RSANoneNoneNone | PSS
CKM_RSA_X9_31.htm">CKM_RSA_X9_31.htm">CKM_RSA_X9_31 YesSign | VerifyNone102420481024819200RSANoneNoneExtractable | X9.31
CKM_SHA_1.htm">CKM_SHA_1.htm">CKM_SHA_1 YesDigestCannot sign00N/A06420NoneSHANoneExtractable
CKM_SHA_1_HMAC.htm">CKM_SHA_1_HMAC.htm">CKM_SHA_1_HMAC YesSign | VerifyCannot sign81128040966420SymmetricSHAHMACExtractable
CKM_SHA_1_HMAC_GENERAL.htm">CKM_SHA_1_HMAC_GENERAL.htm">CKM_SHA_1_HMAC_GENERAL YesSign | VerifyCannot sign81128040966420SymmetricSHAHMACExtractable
CKM_SHA1_RSA_PKCS.htm">CKM_SHA1_RSA_PKCS.htm">CKM_SHA1_RSA_PKCS YesSign | VerifyCannot sign2562048102481926420RSASHANoneExtractable
CKM_SHA1_RSA_PKCS_PSS.htm">CKM_SHA1_RSA_PKCS_PSS.htm">CKM_SHA1_RSA_PKCS_PSS YesSign | VerifyCannot sign2562048102481926420RSASHANoneExtractable | PSS
CKM_SHA1_RSA_X9_31.htm">CKM_SHA1_RSA_X9_31.htm">CKM_SHA1_RSA_X9_31 YesSign | VerifyCannot sign10242048102481926420RSASHANoneExtractable | X9.31
CKM_SHA3_224.htm">CKM_SHA3_224.htm">CKM_SHA3_224 YesDigestNone00N/A014428NoneSHA3_224NoneExtractable
CKM_SHA3_224_DSA.htm">CKM_SHA3_224_DSA.htm">CKM_SHA3_224_DSA YesSign | VerifyNone102420481024307214428DSASHA3_224NoneExtractable
CKM_SHA3_224_ECDSA.htm">CKM_SHA3_224_ECDSA.htm">CKM_SHA3_224_ECDSA YesSign | VerifyNone10522416057114428ECDSA | BIP32SHA3_224NoneExtractable
CKM_SHA3_224_RSA_PKCS.htm">CKM_SHA3_224_RSA_PKCS.htm">CKM_SHA3_224_RSA_PKCS YesSign | VerifyNone25620481024819214428RSASHA3_224NoneExtractable
CKM_SHA3_224_RSA_PKCS_PSS.htm">CKM_SHA3_224_RSA_PKCS_PSS.htm">CKM_SHA3_224_RSA_PKCS_PSS YesSign | VerifyNone51220481024819214428RSASHA3_224NoneExtractable | PSS
CKM_SHA3_256.htm">CKM_SHA3_256.htm">CKM_SHA3_256 YesDigestNone00N/A013632NoneSHA3_256NoneExtractable
CKM_SHA3_256_DSA.htm">CKM_SHA3_256_DSA.htm">CKM_SHA3_256_DSA YesSign | VerifyNone102420481024307213632DSASHA3_256NoneExtractable
CKM_SHA3_256_ECDSA.htm">CKM_SHA3_256_ECDSA.htm">CKM_SHA3_256_ECDSA YesSign | VerifyNone10522416057113632ECDSA | BIP32SHA3_256NoneExtractable
CKM_SHA3_256_RSA_PKCS.htm">CKM_SHA3_256_RSA_PKCS.htm">CKM_SHA3_256_RSA_PKCS YesSign | VerifyNone25620481024819213632RSASHA3_256NoneExtractable
CKM_SHA3_256_RSA_PKCS_PSS.htm">CKM_SHA3_256_RSA_PKCS_PSS.htm">CKM_SHA3_256_RSA_PKCS_PSS YesSign | VerifyNone51220481024819213632RSASHA3_256NoneExtractable | PSS
CKM_SHA3_384.htm">CKM_SHA3_384.htm">CKM_SHA3_384 YesDigestNone00N/A010448NoneSHA3_384NoneExtractable
CKM_SHA3_384_DSA.htm">CKM_SHA3_384_DSA.htm">CKM_SHA3_384_DSA YesSign | VerifyNone102420481024307210448DSASHA3_384NoneExtractable
CKM_SHA3_384_ECDSA.htm">CKM_SHA3_384_ECDSA.htm">CKM_SHA3_384_ECDSA YesSign | VerifyNone10522416057110448ECDSA | BIP32SHA3_384NoneExtractable
CKM_SHA3_384_RSA_PKCS.htm">CKM_SHA3_384_RSA_PKCS.htm">CKM_SHA3_384_RSA_PKCS YesSign | VerifyNone25620481024819210448RSASHA3_384NoneExtractable
CKM_SHA3_384_RSA_PKCS_PSS.htm">CKM_SHA3_384_RSA_PKCS_PSS.htm">CKM_SHA3_384_RSA_PKCS_PSS YesSign | VerifyNone51220481024819210448RSASHA3_384NoneExtractable | PSS
CKM_SHA3_512.htm">CKM_SHA3_512.htm">CKM_SHA3_512 YesDigestNone00N/A07264NoneSHA3_512NoneExtractable
CKM_SHA3_512_DSA.htm">CKM_SHA3_512_DSA.htm">CKM_SHA3_512_DSA YesSign | VerifyNone10242048102430727264DSASHA3_512NoneExtractable
CKM_SHA3_512_ECDSA.htm">CKM_SHA3_512_ECDSA.htm">CKM_SHA3_512_ECDSA YesSign | VerifyNone1052241605717264ECDSA | BIP32SHA3_512NoneExtractable
CKM_SHA3_512_RSA_PKCS.htm">CKM_SHA3_512_RSA_PKCS.htm">CKM_SHA3_512_RSA_PKCS YesSign | VerifyNone2562048102481927264RSASHA3_512NoneExtractable
CKM_SHA3_512_RSA_PKCS_PSS.htm">CKM_SHA3_512_RSA_PKCS_PSS.htm">CKM_SHA3_512_RSA_PKCS_PSS YesSign | VerifyNone10242048102481927264RSASHA3_512NoneExtractable | PSS
CKM_SHA224.htm">CKM_SHA224.htm">CKM_SHA224 YesDigestNone00N/A06428NoneSHA224NoneExtractable
CKM_SHA224_HMAC.htm">CKM_SHA224_HMAC.htm">CKM_SHA224_HMAC YesSign | VerifyNone81128040966428SymmetricSHA224HMACExtractable
CKM_SHA224_HMAC_GENERAL.htm">CKM_SHA224_HMAC_GENERAL.htm">CKM_SHA224_HMAC_GENERAL YesSign | VerifyNone81128040966428SymmetricSHA224HMACExtractable
CKM_SHA224_RSA_PKCS.htm">CKM_SHA224_RSA_PKCS.htm">CKM_SHA224_RSA_PKCS YesSign | VerifyNone2562048102481926428RSASHA224NoneExtractable
CKM_SHA224_RSA_PKCS_PSS.htm">CKM_SHA224_RSA_PKCS_PSS.htm">CKM_SHA224_RSA_PKCS_PSS YesSign | VerifyNone5122048102481926428RSASHA224NoneExtractable | PSS
CKM_SHA224_RSA_X9_31.htm">CKM_SHA224_RSA_X9_31.htm">CKM_SHA224_RSA_X9_31 YesSign | VerifyNone10242048102481926428RSASHA224NoneExtractable | X9.31
CKM_SHA256.htm">CKM_SHA256.htm">CKM_SHA256 YesDigestNone00N/A06432NoneSHA256NoneExtractable
CKM_SHA256_HMAC.htm">CKM_SHA256_HMAC.htm">CKM_SHA256_HMAC YesSign | VerifyNone81128040966432SymmetricSHA256HMACExtractable
CKM_SHA256_HMAC_GENERAL.htm">CKM_SHA256_HMAC_GENERAL.htm">CKM_SHA256_HMAC_GENERAL YesSign | VerifyNone81128040966432SymmetricSHA256HMACExtractable
CKM_SHA256_RSA_PKCS.htm">CKM_SHA256_RSA_PKCS.htm">CKM_SHA256_RSA_PKCS YesSign | VerifyNone2562048102481926432RSASHA256NoneExtractable
CKM_SHA256_RSA_PKCS_PSS.htm">CKM_SHA256_RSA_PKCS_PSS.htm">CKM_SHA256_RSA_PKCS_PSS YesSign | VerifyNone5122048102481926432RSASHA256NoneExtractable | PSS
CKM_SHA256_RSA_X9_31.htm">CKM_SHA256_RSA_X9_31.htm">CKM_SHA256_RSA_X9_31 YesSign | VerifyNone10242048102481926432RSASHA256NoneExtractable | X9.31
CKM_SHA384.htm">CKM_SHA384.htm">CKM_SHA384 YesDigestNone00N/A012848NoneSHA384NoneExtractable
CKM_SHA384_HMAC.htm">CKM_SHA384_HMAC.htm">CKM_SHA384_HMAC YesSign | VerifyNone811280409612848SymmetricSHA384HMACExtractable
CKM_SHA384_HMAC_GENERAL.htm">CKM_SHA384_HMAC_GENERAL.htm">CKM_SHA384_HMAC_GENERAL YesSign | VerifyNone811280409612848SymmetricSHA384HMACExtractable
CKM_SHA384_RSA_PKCS.htm">CKM_SHA384_RSA_PKCS.htm">CKM_SHA384_RSA_PKCS YesSign | VerifyNone25620481024819212848RSASHA384NoneExtractable
CKM_SHA384_RSA_PKCS_PSS.htm">CKM_SHA384_RSA_PKCS_PSS.htm">CKM_SHA384_RSA_PKCS_PSS YesSign | VerifyNone51220481024819212848RSASHA384NoneExtractable | PSS
CKM_SHA384_RSA_X9_31.htm">CKM_SHA384_RSA_X9_31.htm">CKM_SHA384_RSA_X9_31 YesSign | VerifyNone102420481024819212848RSASHA384NoneExtractable | X9.31
CKM_SHA512.htm">CKM_SHA512.htm">CKM_SHA512 YesDigestNone00N/A0128(NoneSHA512NoneExtractable
CKM_SHA512_HMAC.htm">CKM_SHA512_HMAC.htm">CKM_SHA512_HMAC YesSign | VerifyNone8112804096128(SymmetricSHA512HMACExtractable
CKM_SHA512_HMAC_GENERAL.htm">CKM_SHA512_HMAC_GENERAL.htm">CKM_SHA512_HMAC_GENERAL YesSign | VerifyNone8112804096128(SymmetricSHA512HMACExtractable
CKM_SHA512_RSA_PKCS.htm">CKM_SHA512_RSA_PKCS.htm">CKM_SHA512_RSA_PKCS YesSign | VerifyNone256204810248192128(RSASHA512NoneExtractable
CKM_SHA512_RSA_PKCS_PSS.htm">CKM_SHA512_RSA_PKCS_PSS.htm">CKM_SHA512_RSA_PKCS_PSS YesSign | VerifyNone1024204810248192128(RSASHA512NoneExtractable | PSS
CKM_SHA512_RSA_X9_31.htm">CKM_SHA512_RSA_X9_31.htm">CKM_SHA512_RSA_X9_31 YesSign | VerifyNone1024204810248192128(RSASHA512NoneExtractable | X9.31
CKM_SHAKE_128.htm">CKM_SHAKE_128.htm">CKM_SHAKE_128 YesDigestNone00N/A01680NoneSHAKE_128NoneExtractable
CKM_SHAKE_256.htm">CKM_SHAKE_256.htm">CKM_SHAKE_256 YesDigestNone00N/A01360NoneSHAKE_256NoneExtractable
CKM_X9_42_DH_DERIVE.htm">CKM_X9_42_DH_DERIVE.htm">CKM_X9_42_DH_DERIVE YesDeriveNone10242048N/A409600X9_42_DHNoneNoneNone
CKM_X9_42_DH_HYBRID_DERIVE.htm">CKM_X9_42_DH_HYBRID_DERIVE.htm">CKM_X9_42_DH_HYBRID_DERIVE YesDeriveNone10242048N/A409600X9_42_DHNoneNoneNone
CKM_X9_42_DH_KEY_PAIR_GEN.htm">CKM_X9_42_DH_KEY_PAIR_GEN.htm">CKM_X9_42_DH_KEY_PAIR_GEN YesGenerate Key PairNone10242048N/A409600X9_42_DHNoneNoneNone