Supported key types for OpenSSL Provider for AWS CloudHSM Client SDK 5
The AWS CloudHSM OpenSSL Provider supports the following key types with Client SDK 5.
| Key Type | Description |
|---|---|
| RSA | RSA sign/verify and asymmetric encryption operations. Verification is offloaded to OpenSSL software. To generate RSA keys that are interoperable with the OpenSSL Provider, see Export an asymmetric key with CloudHSM CLI. |
| EC | ECDSA sign/verify for P-256, P-384, and P-521 curves. Verification is offloaded to OpenSSL software. To generate EC keys that are interoperable with the OpenSSL Provider, see Export an asymmetric key with CloudHSM CLI. |
| Ed25519 | EdDSA sign/verify operations using Curve25519 (RFC 8032). Verification is offloaded to OpenSSL software. Ed25519 is only available on non-FIPS clusters. To generate Ed25519 keys that are interoperable with the OpenSSL Provider, see Export an asymmetric key with CloudHSM CLI. |
| ML-DSA-44, ML-DSA-65, ML-DSA-87 | Post-quantum digital signature sign/verify operations as defined in FIPS 204. Verification is offloaded to OpenSSL software. ML-DSA1 requires OpenSSL 3.5 or later. To generate ML-DSA keys that are interoperable with the OpenSSL Provider, see Export an asymmetric key with CloudHSM CLI. |
[1] Starting September 1, 2026, ML-DSA is available in FIPS mode for hsm2m.medium clusters.
