ECC curves supported by the ICA token

View a list of curves supported by the ICA token for elliptic curve cryptography (ECC).

Table 1 shows the maximum number of curves that the ICA token can support if all prerequisites are fulfilled at their best conditions. The following dependencies exist:

Which openCryptoki version (and thus which libica version) is used? Refer to the applicable libica documentation for information about supported curves.
Which cryptographic coprocessors are available?
Is the MSA9 component of IBM z15® or later available?
Is libica or OpenSSL running in FIPS mode? When FIPS mode is active for libica, OpenSSL is also set into FIPS mode. However, note that the case where libica does not run in FIPS mode, but OpenSSL does, may cause errors when software fallbacks are used. If, for example, an elliptic curve is supported by hardware in libica, but not by OpenSSL, because OpenSSL runs in FIPS mode, this software fallback fails.

Table 1. Curves supported by the ICA token for elliptic curve cryptography (ECC)
Table with three columns that contain information about supported curves by the ICA token.
Curve	Purpose
brainpoolP160r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
brainpoolP192r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
brainpoolP224r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
brainpoolP256r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
brainpoolP320r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
brainpoolP384r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
brainpoolP512r1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
prime192v1 (1), (3)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
prime256v1 (1), (2)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
secp224r1 (1)	for Sign/Verify operations with `CKM_ECDSA` and CKM_ECDSA_SHAnnn for ECDH with CKM_ECDH1_DERIVE
secp384r1 (1), (2)	for Sign/Verify operations with `CKM_ECDSA` and `CKM_ECDSA_SHAnnn` for ECDH with CKM_ECDH1_DERIVE
secp521r1 (1), (2)	for Sign/Verify operations with `CKM_ECDSA` and `CKM_ECDSA_SHAnnn` for ECDH with CKM_ECDH1_DERIVE
Notes: (1) supported via Crypto Express CCA coprocessor (2) supported via CPACF on processors with MSA9 component of IBM z15 or later (3) not available if libica runs in FIPS mode