PKCS #11 mechanisms supported by the ICA token

Edit online

View a list of mechanisms provided by PKCS #11 which you can use to exploit the openCryptoki features for the ICA token from within your application. Use the pkcsconf -m -c <ICA_token_slot> command to list the mechanisms (algorithms), that are supported by the ICA token.

The command output depends on the libica version, whether libica is running in FIPS mode, and on the processor generation. The output of the pkcsconf -m -c <slot> command corresponds to the list shown in Table 1 which presents all mechanisms supported by the ICA token on an IBM z15® machine.

Table 1. Supported mechanism list for the ICA token
Table with 4 columns that contain information about openCryptoki mechanisms supported by the ICA token.
Mechanism	Key sizes in bits or bytes	Properties	Support with OC version
CKM_AES_CBC	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_CBC_PAD	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_CFB64	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_CFB8	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_CFB128	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_CMAC	16-32 bytes	HW, SIGN, VERIFY	before 3.16
CKM_AES_CMAC_GENERAL	16-32 bytes	HW, SIGN, VERIFY	before 3.16
CKM_AES_CTR	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_ECB	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_GCM	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	3.25: WRAP, UNWRAP
CKM_AES_KEY_GEN	16-32 bytes	HW, GENERATE	before 3.16
CKM_AES_KEY_WRAP	32-64 bytes	ENCRYPT, DECRYPT, WRAP, UNWRAP	3.25
CKM_AES_KEY_WRAP_KWP	32-64 bytes	ENCRYPT, DECRYPT, WRAP, UNWRAP	3.25
CKM_AES_KEY_WRAP_PAD	32-64 bytes	ENCRYPT, DECRYPT, WRAP, UNWRAP	3.25
CKM_AES_KEY_WRAP_PKCS7	32-64 bytes	ENCRYPT, DECRYPT, WRAP, UNWRAP	3.25
CKM_AES_MAC	16-32 bytes	HW, SIGN, VERIFY	before 3.16
CKM_AES_MAC_GENERAL	16-32 bytes	HW, SIGN, VERIFY	before 3.16
CKM_AES_OFB	16-32 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_AES_XTS	32 -64 bytes	ENCRYPT, DECRYPT, WRAP, UNWRAP	3.20
CKM_AES_XTS_KEY_GEN	32 -64 bytes	HW, GENERATE	3.20
CKM_DES_CBC	8-8 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_DES_CBC_PAD	8-8 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_DES_CFB8	8-8 bytes	HW, ENCRYPT, DECRYPT	before 3.16
CKM_DES_CFB64	8-8 bytes	HW, ENCRYPT, DECRYPT	before 3.16
CKM_DES_ECB	8-8 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_DES_KEY_GEN	8-8 bytes	HW, GENERATE	before 3.16
CKM_DES_OFB64	8-8 bytes	HW, ENCRYPT, DECRYPT	before 3.16
CKM_DES3_CBC	24-24 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_DES3_CBC_PAD	24-24 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_DES3_CMAC	16-24 bytes	HW, SIGN, VERIFY	before 3.16
CKM_DES3_CMAC_GENERAL	16-24 bytes	HW, SIGN, VERIFY	before 3.16
CKM_DES3_ECB	24-24 bytes	HW, ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_DES3_KEY_GEN	24-24 bytes	HW, GENERATE	before 3.16
CKM_DES3_MAC	24-24 bytes	HW, SIGN, VERIFY	before 3.16
CKM_DES3_MAC_GENERAL	24-24 bytes	HW, SIGN, VERIFY	before 3.16
CKM_EC_KEY_PAIR_GEN	160-521 bits	HW, GENERATE_KEY_PAIR, CKF_EC_F_P, CKF_EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDH_AES_KEY_WRAP	160-521 bits	WRAP, UNWRAP, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	3.25
CKM_ECDH1_DERIVE	160-521 bits	HW, DERIVE, EC_F_P, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDSA	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDSA_SHA1	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDSA_SHA224	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDSA_SHA256	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDSA_SHA3_224	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	3.24
CKM_ECDSA_SHA3_256	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	3.24
CKM_ECDSA_SHA3_384	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	3.24
CKM_ECDSA_SHA3_512	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	3.24
CKM_ECDSA_SHA384	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_ECDSA_SHA512	160-521 bits	HW, SIGN, VERIFY, EC_F_P, EC_OID, EC_UNCOMPRESS, EC_COMPRESS	before 3.16
CKM_GENERIC_SECRET_KEY_GEN	80-2048 bits	HW, GENERATE	before 3.16
CKM_IBM_SHA3_224	n/a	HW, DIGEST	before 3.16
CKM_IBM_SHA3_224_HMAC	112-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_IBM_SHA3_256	n/a	HW, DIGEST	before 3.16
CKM_IBM_SHA3_256_HMAC	128-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_IBM_SHA3_384	n/a	HW, DIGEST	before 3.16
CKM_IBM_SHA3_384_HMAC	192-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_IBM_SHA3_512	n/a	HW, DIGEST	before 3.16
CKM_IBM_SHA3_512_HMAC	256-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_MD5	n/a	DIGEST	before 3.16
CKM_MD5_HMAC	8-2048 bits	SIGN, VERIFY	before 3.16
CKM_MD5_HMAC_GENERAL	8-2048 bits	SIGN, VERIFY	before 3.16
CKM_RSA_AES_KEY_WRAP	512-4096 bits	WRAP, UNWRAP	3.25
CKM_RSA_PKCS	512-4096 bits	HW, ENCRYPT, DECRYPT, SIGN, SIGN_RECOVER, VERIFY, VERIFY_RECOVER, WRAP, UNWRAP	before 3.16
CKM_RSA_PKCS_KEY_PAIR_GEN	512-4096 bits	GENERATE_KEY_PAIR	before 3.16
CKM_RSA_PKCS_OAEP	512-4096 bits	ENCRYPT, DECRYPT, WRAP, UNWRAP	before 3.16
CKM_RSA_PKCS_PSS	512-4096 bits	SIGN, VERIFY	before 3.16
CKM_RSA_X_509	512-4096 bits	HW, ENCRYPT, DECRYPT, SIGN, SIGN_RECOVER, VERIFY, VERIFY_RECOVER, WRAP, UNWRAP	before 3.16
CKM_SHA_1	n/a	HW, DIGEST	before 3.16
CKM_SHA_1_HMAC	80-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA_1_HMAC_GENERAL	80-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA_1_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA1_KEY_DERIVATION	8-160 bits	HW, DERIVE	3.24
CKM_SHA1_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA1_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA224	n/a	HW, DIGEST	before 3.16
CKM_SHA224_HMAC	112-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA224_HMAC_GENERAL	112-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA224_KEY_DERIVATION	8-224 bits	HW, DERIVE	3.24
CKM_SHA224_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA224_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA224_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA256	n/a	HW, DIGEST	before 3.16
CKM_SHA256_HMAC	128-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA256_HMAC_GENERAL	128-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA256_KEY_DERIVATION	8-256 bits	HW, DERIVE	3.24
CKM_SHA256_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA256_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA256_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA3_224	n/a	DIGEST	3.24
CKM_SHA3_224_HMAC	112-2048 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_224_HMAC_GENERAL	112-2048 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_224_KEY_DERIVATION	8-224 bits	HW, DERIVE	3.24
CKM_SHA3_224_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA3_224_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_224_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_256	n/a	HW, DIGEST	3.24
CKM_SHA3_256_HMAC	128-2048 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_256_HMAC_GENERAL	128-2048 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_256_KEY_DERIVATION	8-256 bits	HW, DERIVE	3.24
CKM_SHA3_256_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA3_256_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_256_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_384	n/a	HW, DIGEST	3.24
CKM_SHA3_384_HMAC	192-2048 bits	SIGN, VERIFY	3.24
CKM_SHA3_384_HMAC_GENERAL	192-2048 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_384_KEY_DERIVATION	8-384 bits	HW, DERIVE	3.24
CKM_SHA3_384_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA3_384_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_384_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_512	n/a	HW, DIGEST	3.24
CKM_SHA3_512_HMAC	256-2048	HW, SIGN, VERIFY	3.24
CKM_SHA3_512_HMAC_GENERAL	256-2048	HW, SIGN, VERIFY	3.24
CKM_SHA3_512_KEY_DERIVATION	8-512 bits	HW, DERIVE	3.24
CKM_SHA3_512_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA3_512_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA3_512_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	3.24
CKM_SHA384	n/a	HW, DIGEST	before 3.16
CKM_SHA384_HMAC	192-2048	HW, SIGN, VERIFY	before 3.16
CKM_SHA384_HMAC_GENERAL	192-2048	HW, SIGN, VERIFY	before 3.16
CKM_SHA384_KEY_DERIVATION	8-384 bits	HW, DERIVE	3.24
CKM_SHA384_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA384_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA384_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512	n/a	HW, DIGEST	before 3.16
CKM_SHA512_HMAC	256-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_HMAC_GENERAL	256-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_KEY_DERIVATION	8-512 bits	HW, DERIVE	3.24
CKM_SHA512_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA512_RSA_PKCS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_RSA_PKCS_PSS	512-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_224	n/a	HW, DIGEST	before 3.16
CKM_SHA512_224_HMAC	112-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_224_HMAC_GENERAL	112-4096 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_224_KEY_DERIVATION	8-224 bits	HW, DERIVE	3.26
CKM_SHA512_224_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHA512_256	n/a	HW, DIGEST	before 3.16
CKM_SHA512_256_HMAC	128-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_256_HMAC_GENERAL	128-2048 bits	HW, SIGN, VERIFY	before 3.16
CKM_SHA512_256_KEY_DERIVATION	8-256 bits	HW, DERIVE	3.26
CKM_SHA512_256_KEY_GEN	80-2048 bits	HW, GENERATE	3.26
CKM_SHAKE_128_KEY_DERIVATION	8-2048 bits	HW, DERIVE	3.24
CKM_SHAKE_256_KEY_DERIVATION	8-2048 bits	HW, DERIVE	3.24

Certain mechanisms indicate the HW flag in the Properties column (short form for the CKF_HW). If for theses mechanisms, the CKF_HW flag is set to TRUE, the pertaining cryptographic operations are performed by the cryptographic hardware. If the flag is not set for these mechanisms, the operations are performed in software.

For a description of mechanisms with a name pattern of CKM_IBM_... refer to IBM-specific mechanisms.