Supported Cryptographic Schemes

Within Canton, we use the cryptographic primitives of signing, symmetric encryption, and asymmetric encryption, with the following supported cryptographic schemes. For asymmetric signing and encryption, each scheme is divided into a key and an algorithm specification.

Note

Legend for the following tables:

• S = Supported

• P¹ = Partially supported — only supports signature verification, not signing with a private key

• P² = Partially supported — only supports encryption, not decryption with a private key

• Values in brackets ([<scheme>]) indicate the configuration strings to use in Canton

Supported Asymmetric Encryption and Signing Key Specifications

Key Spec	JCE	KMS	Purpose
EC-Curve25519 [ec-curve-25519]	S	P¹	Signing
EC-P256 [ec-p-256]	S	S	Signing, Encryption
EC-P384 [ec-p-384]	S	S	Signing
EC-Secp256k1 [ec-secp-256k-1]	S	S	Signing
RSA-2048 [rsa-2048]	S	S	Encryption

Supported Signing Algorithm Specifications

Algorithm	JCE	KMS	Supported Key Specs
Ed25519 [ed-25519]	S	P¹	EC-Curve25519
EC-DSA-SHA256 [ec-dsa-sha-256]	S	S	EC-P256, EC-Secp256k1
EC-DSA-SHA384 [ec-dsa-sha-384]	S	S	EC-P384

Supported Asymmetric Encryption Algorithm Specifications

Algorithm	JCE	KMS	Supported Key Specs
ECIES-HMAC-SHA256-AES128-GCM [ecies-hkdf-hmac-sha-256-aes-128-gcm]	S	P²	EC-P256
ECIES-HMAC-SHA256-AES128-CBC [ecies-hkdf-hmac-sha-256-aes-128-cbc]	S	P²	EC-P256
RSA-OAEP-SHA256 [rsa-oaep-sha-256]	S	S	RSA-2048

Default Cryptographic Schemes

Crypto provider	JCE Default Scheme	KMS Default Scheme
Signing key specification	EC-Curve25519	EC-P256
Signing algorithm specification	Ed25519	EC-DSA-SHA256
Asymmetric encryption key specification	EC-P256	RSA-2048
Asymmetric encryption algorithm	ECIES with HMAC-SHA256 and AES128-GCM	RSA with OAEP and SHA-256
Symmetric encryption scheme [1]	AES128-GCM	Same as JCE
Hash Algorithm [2]	SHA-256	Same as JCE
PBKDF [3]	Argon2id	Same as JCE

[1]

Default and only supported scheme; not configurable.

[2]

Default and only supported hash algorithm; not configurable.

[3]

Default and only supported PBKDF; not configurable.

Key configuration for external keys with a Key Management Service (KMS)

Provider	SIGNING	ENCRYPTION
AWS	Key Purpose: SIGN_VERIFY Key Algorithms: ECC_NIST_P256 or ECC_NIST_P384	Key Purpose: ENCRYPT_DECRYPT Key Algorithm: RSA_2048
GCP	Key Purpose: ASYMMETRIC_SIGN Key Algorithms: EC_SIGN_P256_SHA256 or EC_SIGN_P384_SHA384	Key Purpose: ASYMMETRIC_DECRYPT Key Algorithm: RSA_DECRYPT_OAEP_2048_SHA256
Driver	Must be compatible with EC_P256_SHA256 or EC_P384_SHA384	Must be compatible with RSA_OAEP_2048_SHA256