AWS cloudhsm documentation change

Service: cloudhsm · 2025-05-03 · Documentation low

File: cloudhsm/latest/userguide/pkcs11-mechanisms.md

Summary

Added documentation for SP800-108 Counter KDF and ECDH with KDF mechanisms, including vendor-defined KDF types and header requirements

Security assessment

The changes document cryptographic key derivation functions which are security-related features, but there's no evidence of addressing a specific vulnerability. The additions clarify implementation details for secure key derivation mechanisms.

Diff

diff --git a/cloudhsm/latest/userguide/pkcs11-mechanisms.md b/cloudhsm/latest/userguide/pkcs11-mechanisms.md
index 15ec1045f..b8eb135cd 100644
--- a//cloudhsm/latest/userguide/pkcs11-mechanisms.md
+++ b//cloudhsm/latest/userguide/pkcs11-mechanisms.md
@@ -20,0 +21,2 @@ The PKCS #11 library supports the following algorithms:
+  * **Key derivation** – SP800-108 Counter KDF and ECDH with KDF (Supported KDF algorithms are X9.63 with SHA1, SHA224, SHA256, SHA384, SHA512)
+
@@ -198 +200 @@ The AWS CloudHSM software library for PKCS #11 library allows you to use the fol
-The AWS CloudHSM software library for PKCS #11 library allows you to use the following mechanisms for Derive functions.
+The AWS CloudHSM software library for PKCS #11 library supports the following key derivation mechanisms:
@@ -201,0 +204,12 @@ The AWS CloudHSM software library for PKCS #11 library allows you to use the fol
+  * `CKM_ECDH1_DERIVE` \- Supports ECDH key derivation with the following vendor-defined KDF types6:
+
+    * `CKD_CLOUDHSM_X963_SHA1_KDF` \- X9.63 KDF with SHA17
+
+    * `CKD_CLOUDHSM_X963_SHA224_KDF` \- X9.63 KDF with SHA2247
+
+    * `CKD_CLOUDHSM_X963_SHA256_KDF` \- X9.63 KDF with SHA2567
+
+    * `CKD_CLOUDHSM_X963_SHA384_KDF` \- X9.63 KDF with SHA3847
+
+    * `CKD_CLOUDHSM_X963_SHA512_KDF` \- X9.63 KDF with SHA5127
+
@@ -281,0 +296,8 @@ Show moreShow less
+  * [6] Vendor defined types. In order to use CloudHSM vendor defined types, PKCS#11 applications must include `cloudhsm_pkcs11_vendor_defs.h` during compilation. This is found in `/opt/cloudhsm/include/pkcs11/cloudhsm_pkcs11_vendor_defs.h` for Linux based platforms and `C:\Program Files\Amazon\CloudHSM\include\pkcs11\cloudhsm_pkcs11_vendor_defs.h` for Windows based platforms
+
+Show moreShow less
+
+  * [7] Key derivation functions (KDFs) are specified in [RFC 8418, Section 2.1](https://datatracker.ietf.org/doc/html/rfc8418).
+
+Show moreShow less
+