Appendices

Compatible PKCS #11 Devices

This section has informative character. Knot DNS has been tested with several devices which claim to support PKCS #11 interface. The following table indicates which algorithms and operations have been observed to work. Please notice minimal GnuTLS library version required for particular algorithm support. Factors like firmware and Cryptoki module version might affect the outcome.

	Generate	Import	EDDSA	ECDSA	RSA	Tested
Utimaco SecurityServer (V4) 1	yes	yes	n/a	256 384	1024 2048 4096	2018-09
Trustway Proteccio NetHSM	yes	ECDSA only	n/a	256 384	1024 2048 4096	2019-03
Ultra Electronics CIS Keyper Plus (Model 9860-2)	yes	RSA only	n/a	256 384	1024 2048 4096	2020-01
SoftHSM 2.0 2	yes	yes	ed25519 ed448	256 384	1024 2048 4096	2025-12
Luna Cloud HSM (non-FIPS)	yes	n/a	n/a	256 384	1024 2048 4096	2025-11
Luna Network HSM (non-FIPS)	yes	n/a	ed448	256 384	1024 2048 4096	2025-12
Securosys Primus HSM and CloudHSM (non-FIPS)	yes	yes	ed25519 ed448	256 384	1024 2048 4096	2025-12

1

Requires setting the number of background workers to 1!

2

Algorithms supported depend on support in OpenSSL on which SoftHSM relies. A command similar to the following may be used to verify what algorithms are supported: $ pkcs11-tool --module /usr/lib64/pkcs11/libsofthsm2.so -M.