Appendix A: Supported mechanisms - Futurex Documentation

This appendix lists the PKCS#11 mechanisms advertised by the CryptoHub-backed module (libcryptohub-pkcs11.*). The tables were captured directly from the module at runtime by enumerating mechanisms with C_GetMechanismList and inspecting each mechanism’s flags and key-size limits with C_GetMechanismInfo.

These tables were captured from a live module and are a snapshot. The authoritative mechanism list for your deployment is always the list returned by the installed library for the selected slot. CryptoHub policy, key metadata, module version, and backend capability can all affect which operations succeed even when a mechanism is advertised. Verify against your own environment with C_GetMechanismList before relying on any entry below.

Tested configuration

Property	Value
Provider	CryptoHub-backed PKCS#11 (`libcryptohub-pkcs11.*`)
Cryptoki version	`3.2`
Mechanisms advertised	138
Slot tested	`0`
Backend	CryptoHub 7.3

About key sizes and units

The module reports mechanism key limits as MinBits/MaxBits. The tables below give those limits in bits. Note the following:

Symmetric key sizes are effective bits (for example, DES reports 56, not the 8-byte stored length).
Post-quantum mechanisms are selected by parameter set, not by a key length in bits. ML-DSA and ML-KEM rows therefore list parameter sets rather than a Min/Max bit range.
Edwards and Montgomery key-pair generation are selected by named curve. The module reports a generic elliptic-curve bit range for these, which is misleading, so the tables list the supported named curves instead.
HMAC and generic-secret MAC mechanisms accept variable-length keys. The module reports generic-secret key sizes of 80–512 bits; individual HMAC rows show — because the accepted length follows the key object rather than the mechanism.

Key generation

The following table shows advertised key generation mechanisms (CKF_GENERATE, CKF_GENERATE_KEY_PAIR).

Mechanism	Min (bits)	Max (bits) / Parameter sets	Operations
`CKM_DES_KEY_GEN`	56	56	`CKF_GENERATE`
`CKM_DES2_KEY_GEN`	112	112	`CKF_GENERATE`
`CKM_DES3_KEY_GEN`	168	168	`CKF_GENERATE`
`CKM_AES_KEY_GEN`	128	256	`CKF_GENERATE`
`CKM_GENERIC_SECRET_KEY_GEN`	80	512	`CKF_GENERATE`
`CKM_SHA3_224_KEY_GEN`	80	512	`CKF_GENERATE`
`CKM_SHA3_256_KEY_GEN`	80	512	`CKF_GENERATE`
`CKM_SHA3_384_KEY_GEN`	80	512	`CKF_GENERATE`
`CKM_SHA3_512_KEY_GEN`	80	512	`CKF_GENERATE`
`CKM_RSA_PKCS_KEY_PAIR_GEN`	1408	8192	`CKF_GENERATE_KEY_PAIR`
`CKM_RSA_X9_31_KEY_PAIR_GEN`	1408	8192	`CKF_GENERATE_KEY_PAIR`
`CKM_EC_KEY_PAIR_GEN`	160	521	`CKF_GENERATE_KEY_PAIR`
`CKM_EC_EDWARDS_KEY_PAIR_GEN`	—	Ed25519	`CKF_GENERATE_KEY_PAIR`
`CKM_EC_MONTGOMERY_KEY_PAIR_GEN`	—	Curve25519 (X25519)	`CKF_GENERATE_KEY_PAIR`
`CKM_ML_DSA_KEY_PAIR_GEN`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`CKF_GENERATE_KEY_PAIR`
`CKM_ML_KEM_KEY_PAIR_GEN`	—	ML-KEM-512, ML-KEM-768, ML-KEM-1024	`CKF_GENERATE_KEY_PAIR`

Encryption and decryption

The following table shows advertised encryption and decryption mechanisms (CKF_ENCRYPT, CKF_DECRYPT).

Mechanism	Min (bits)	Max (bits)	Operations
`CKM_DES_ECB`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES_CBC`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES_CBC_PAD`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES_OFB8`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES_OFB64`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES_CFB8`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES_CFB64`	56	56	`ENCRYPT`, `DECRYPT`
`CKM_DES3_ECB`	112	168	`ENCRYPT`, `DECRYPT`
`CKM_DES3_CBC`	112	168	`ENCRYPT`, `DECRYPT`
`CKM_DES3_CBC_PAD`	112	168	`ENCRYPT`, `DECRYPT`
`CKM_AES_ECB`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CBC`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CBC_PAD`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CFB1`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CFB8`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CFB64`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CFB128`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_CTR`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_OFB`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_AES_GCM`	128	256	`ENCRYPT`, `DECRYPT`
`CKM_RSA_PKCS`	1408	8192	`ENCRYPT`, `DECRYPT`
`CKM_RSA_PKCS_OAEP`	1408	8192	`ENCRYPT`, `DECRYPT`
`CKM_RSA_X_509`	1408	8192	`ENCRYPT`, `DECRYPT`

CKM_RSA_PKCS advertises encrypt, decrypt, sign, and verify on this module. It does not advertise wrap or unwrap. The DES OFB/CFB streaming modes advertise encrypt and decrypt only.

Signature and verification

The following table shows advertised signature and verification mechanisms (CKF_SIGN, CKF_VERIFY), including RSA PSS, CMAC, MAC, HMAC, ECDSA, EdDSA, and ML-DSA.

Mechanism	Min (bits)	Max (bits) / Parameter sets	Operations
`CKM_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_RSA_X_509`	1408	8192	`SIGN`, `VERIFY`
`CKM_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_MD5_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA1_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA224_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA256_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA384_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA512_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA224_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA256_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA384_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA512_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_224_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_256_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_384_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_512_RSA_PKCS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_224_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_256_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_384_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_SHA3_512_RSA_PKCS_PSS`	1408	8192	`SIGN`, `VERIFY`
`CKM_ECDSA`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA1`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA224`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA256`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA384`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA512`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA3_224`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA3_256`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA3_384`	160	521	`SIGN`, `VERIFY`
`CKM_ECDSA_SHA3_512`	160	521	`SIGN`, `VERIFY`
`CKM_EDDSA`	—	Ed25519	`SIGN`, `VERIFY`
`CKM_ML_DSA`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA224`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA256`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA384`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA512`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA3_224`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA3_256`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA3_384`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHA3_512`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHAKE128`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_HASH_ML_DSA_SHAKE256`	—	ML-DSA-44, ML-DSA-65, ML-DSA-87	`SIGN`, `VERIFY`
`CKM_AES_MAC`	128	256	`SIGN`, `VERIFY`
`CKM_AES_MAC_GENERAL`	128	256	`SIGN`, `VERIFY`
`CKM_AES_CMAC`	128	256	`SIGN`, `VERIFY`
`CKM_AES_CMAC_GENERAL`	128	256	`SIGN`, `VERIFY`
`CKM_DES_MAC`	56	56	`SIGN`, `VERIFY`
`CKM_DES_MAC_GENERAL`	56	56	`SIGN`, `VERIFY`
`CKM_DES3_MAC`	112	168	`SIGN`, `VERIFY`
`CKM_DES3_MAC_GENERAL`	112	168	`SIGN`, `VERIFY`
`CKM_DES3_CMAC`	112	168	`SIGN`, `VERIFY`
`CKM_DES3_CMAC_GENERAL`	112	168	`SIGN`, `VERIFY`
`CKM_MD5_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_MD5_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_RIPEMD128_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_RIPEMD128_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_RIPEMD160_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_RIPEMD160_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA_1_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA_1_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA224_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA224_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA256_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA256_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA384_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA384_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_224_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_224_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_256_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_256_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_T_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA512_T_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_224_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_224_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_256_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_256_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_384_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_384_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_512_HMAC`	—	—	`SIGN`, `VERIFY`
`CKM_SHA3_512_HMAC_GENERAL`	—	—	`SIGN`, `VERIFY`

Key encapsulation (KEM)

The following table shows the advertised PKCS#11 v3.2 key encapsulation mechanism. Encapsulation and decapsulation use the C_EncapsulateKey and C_DecapsulateKey functions introduced in PKCS#11 v3.2.

Mechanism	Parameter sets	Operations
`CKM_ML_KEM_KEY_PAIR_GEN`	ML-KEM-512, ML-KEM-768, ML-KEM-1024	`CKF_GENERATE_KEY_PAIR`
`CKM_ML_KEM`	ML-KEM-512, ML-KEM-768, ML-KEM-1024	`CKF_ENCAPSULATE`, `CKF_DECAPSULATE`

Digests

The following table shows advertised digest mechanisms (CKF_DIGEST). Digest mechanisms do not use a key.

Mechanism	Operations
`CKM_MD5`	`DIGEST`
`CKM_RIPEMD128`	`DIGEST`
`CKM_RIPEMD160`	`DIGEST`
`CKM_SHA_1`	`DIGEST`
`CKM_SHA224`	`DIGEST`
`CKM_SHA256`	`DIGEST`
`CKM_SHA384`	`DIGEST`
`CKM_SHA512`	`DIGEST`
`CKM_SHA3_224`	`DIGEST`
`CKM_SHA3_256`	`DIGEST`
`CKM_SHA3_384`	`DIGEST`
`CKM_SHA3_512`	`DIGEST`

Wrapping and unwrapping

The following table shows advertised wrapping and unwrapping mechanisms (CKF_WRAP, CKF_UNWRAP). The AES and DES block-cipher mechanisms below advertise wrap and unwrap in addition to encrypt and decrypt.

Mechanism	Min (bits)	Max (bits)	Operations
`CKM_DES_ECB`	56	56	`WRAP`, `UNWRAP`
`CKM_DES_CBC`	56	56	`WRAP`, `UNWRAP`
`CKM_DES_CBC_PAD`	56	56	`WRAP`, `UNWRAP`
`CKM_DES3_ECB`	112	168	`WRAP`, `UNWRAP`
`CKM_DES3_CBC`	112	168	`WRAP`, `UNWRAP`
`CKM_DES3_CBC_PAD`	112	168	`WRAP`, `UNWRAP`
`CKM_AES_ECB`	128	256	`WRAP`, `UNWRAP`
`CKM_AES_CBC`	128	256	`WRAP`, `UNWRAP`
`CKM_AES_CBC_PAD`	128	256	`WRAP`, `UNWRAP`
`CKM_AES_KEY_WRAP_KWP`	128	8192	`WRAP`, `UNWRAP`
`CKM_AES_KEY_WRAP_PAD`	128	8192	`WRAP`, `UNWRAP`
`CKM_RSA_PKCS_OAEP`	1408	8192	`WRAP`, `UNWRAP`

The module advertises both CKM_AES_KEY_WRAP_KWP and CKM_AES_KEY_WRAP_PAD. These are distinct AES key-wrap schemes: KWP is the NIST SP 800-38F key-wrap-with-padding scheme, while PAD applies PKCS#7-style padding before a CBC-based wrap. Select the scheme your unwrapping peer expects.

Key derivation

The following table shows advertised key derivation mechanisms (CKF_DERIVE).

Mechanism	Operations
`CKM_ECDH1_DERIVE`	`CKF_DERIVE`
`CKM_ECDH1_COFACTOR_DERIVE`	`CKF_DERIVE`

Earlier documentation for the legacy fxpkcs11 provider listed several *_ENCRYPT_DATA derivation mechanisms (for example, CKM_DES_ECB_ENCRYPT_DATA and CKM_AES_CBC_ENCRYPT_DATA). Those mechanisms did not appear in this module’s advertised list and are intentionally omitted here.

​Tested configuration

​About key sizes and units

​Key generation

​Encryption and decryption

​Signature and verification

​Key encapsulation (KEM)

​Digests

​Wrapping and unwrapping

​Key derivation

Tested configuration

About key sizes and units

Key generation

Encryption and decryption

Signature and verification

Key encapsulation (KEM)

Digests

Wrapping and unwrapping

Key derivation