AWS cloudhsm documentation change
Summary
Added documentation for ECDH key agreement functions with X9.63 KDF support in Java library
Security assessment
The change adds documentation for cryptographic key agreement mechanisms (ECDH with KDFs), which are security features for secure key exchange. No evidence of addressing a specific vulnerability is present.
Diff
diff --git a/cloudhsm/latest/userguide/java-lib-supported_5.md b/cloudhsm/latest/userguide/java-lib-supported_5.md index 7186657cc..465498a1c 100644 --- a//cloudhsm/latest/userguide/java-lib-supported_5.md +++ b//cloudhsm/latest/userguide/java-lib-supported_5.md @@ -5 +5 @@ -Generate key and key pair functionsCipher functionsSign and verify functionsDigest functionsHash-based message authentication code (HMAC) functionsCipher-based message authentication code (CMAC) functionsConvert keys to key specifications using key factoriesMechanism annotations +Generate key and key pair functionsCipher functionsSign and verify functionsDigest functionsHash-based message authentication code (HMAC) functionsCipher-based message authentication code (CMAC) functionsKey Agreement FunctionsConvert keys to key specifications using key factoriesMechanism annotations @@ -24,0 +25,2 @@ This topic provides information about supported mechanisms for JCE provider with + * Key Agreement Functions + @@ -170,0 +173,17 @@ The AWS CloudHSM software library for Java supports the following CMAC algorithm +## Key Agreement Functions + +The AWS CloudHSM software library for Java supports ECDH with Key Derivation Functions (KDF). The following KDF types are supported: + + * `ECDHwithX963SHA1KDF` Supports X9.63 KDF SHA1 algorithm2 + + * `ECDHwithX963SHA224KDF` Supports X9.63 KDF SHA224 algorithm2 + + * `ECDHwithX963SHA256KDF` Supports X9.63 KDF SHA256 algorithm2 + + * `ECDHwithX963SHA384KDF` Supports X9.63 KDF SHA384 algorithm2 + + * `ECDHwithX963SHA512KDF` Supports X9.63 KDF SHA512 algorithm2 + + + + @@ -226,0 +246,2 @@ For KeyFactory's `translateKey` method, it takes in any Key that implements the +[2] Key derivation functions (KDFs) are specified in [RFC 8418, Section 2.1](https://datatracker.ietf.org/doc/html/rfc8418). +