feat(hsm): HSM-delegated EC/ECDSA/RSA-PSS/EdDSA key generation and signing

[Manuthor]

Extends HSM delegation beyond the existing RSA path: KMIP key generation and signing operations can now be delegated end-to-end to a PKCS#11 HSM for EC (NIST curves, Ed25519/Ed448, X25519), ECDSA, RSA-PSS, and EdDSA, closing #1154 and most of #1157.

Features

• HSM-delegated RSA-PSS signing — SigningAlgorithm/HsmSigningAlgorithm gain RsaPssSha256/384/512 { salt_length }, resolved from KMIP CryptographicParameters; deterministic (salt_length: 0) and default (digest-length) salt both supported.
• HSM-delegated EC key generation — new HsmKeypairAlgorithm::EC, EcCurve enum (P-224/256/384/521, Ed25519/Ed448, X25519), new KeyMaterial::EcPrivateKey/EcPublicKey; existing ckms ec keys create and server create_key_pair.rs needed no changes (already algorithm-generic).
• HSM-delegated ECDSA signing — SigningAlgorithm::EcdsaSha256/384/512, dispatched to CKM_ECDSA_SHA*; raw PKCS#11 r‖s signatures re-encoded to DER.
• HSM-delegated EdDSA signing — EcCurve::Ed25519/Ed448 (CKM_EC_EDWARDS_KEY_PAIR_GEN), SigningAlgorithm::Ed25519/Ed448 (CKM_EDDSA), gated behind a new non-fips feature on cosmian_kms_interfaces/cosmian_kms_base_hsm/every vendor PKCS#11 loader, mirroring existing software EdDSA gating.
• HSM-delegated X25519 key generation — EcCurve::X25519 (CKM_EC_MONTGOMERY_KEY_PAIR_GEN), requested via CryptographicAlgorithm::ECDH + CURVE25519 RecommendedCurve; generated keys carry CKA_DERIVE only (derive-only). Rejected from the public HSM trait until a matching DeriveKey path exists.
• HsmStore generalized from RSA-only to algorithm-generic (RSA or EC) keypair-creation detection, signing, and attribute reconstruction; get_key_type() validates CKA_EC_PARAMS against the FIPS-approved curve allow-list for any CKK_EC object.

Fixes

• Preserve EC-family HSM metadata when reconstructing KMIP objects (signing algorithm, ECDH/DeriveKey typing for X25519, curve domain parameters in GetAttributes).
• Fixed delegated-signing mechanism selection: pre-digested ECDSA/RSA-PSS now use raw CKM_ECDSA/CKM_RSA_PKCS_PSS, explicit MGF1 hash choices are preserved, and missing parameters fall back to key-aware defaults instead of assuming RSA/SHA-256.
• Hardened edge cases: pre-digested RSA PKCS#1 v1.5 now wraps the digest as DigestInfo (raw CKM_RSA_PKCS) instead of re-hashing; KMIP Sign rejects requests setting both data and digested_data; Ed25519/Ed448 reject unsupported pre-hashed requests.
• ckms ec sign now sends curve-appropriate CryptographicParameters automatically for HSM-delegated ECDSA/EdDSA and rejects --digested for Ed25519/Ed448 and non-signing curves (X25519/X448).

Deferred (tracked as remaining #1157 scope)

• X25519 ECDH key agreement (DeriveKey), HKDF/SP 800-108 KDF, and message-based AEAD delegation — no available PKCS#11 simulator (SoftHSM2, Utimaco CryptoServer simulator) implements the required mechanisms in this environment.

Testing

• Unit tests for the new SigningAlgorithm/HsmSigningAlgorithm PSS/ECDSA/EdDSA variants and mechanism dispatch, curve OID round-trips, and Edwards/Montgomery parameter encoding.
• #[ignore]d SoftHSM2 integration tests, manually validated against live SoftHSM2 tokens: RSA-PSS (all digests/salt modes), EC keypair generation (all 4 curves), ECDSA signing (4 curves × 3 hashes, DER + OpenSSL cross-check), EdDSA sign/verify (Ed25519/Ed448).
• Two ADRs documenting the Track A (RSA-PSS/EC/ECDSA) scope decision and its completion, including the PBKDF2/X25519-derive deferral rationale.

Closes #1154, partially addresses #1157
Closes #1182
Closes #1158

[Copilot]

🟡 Changes recommended

There are correctness gaps between the new EC/Ed signing support and actual request/filter behavior (notably default signing parameters and EC object discovery), plus documentation/ADR inconsistencies that would mislead users.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR expands KMS HSM delegation beyond RSA by adding EC keypair creation and additional signing mechanisms (RSA-PSS, ECDSA, and non-FIPS EdDSA), plus related HSM object export/metadata handling and documentation/ADRs.

Changes:

• Add EC keypair generation and EC key export/metadata plumbing in the HSM base layer.
• Extend signing algorithm resolution and PKCS#11 dispatch for RSA-PSS, ECDSA, and (non-FIPS) EdDSA.
• Document the new HSM-delegated capabilities and add Track A ADRs; propagate a new non-fips feature through HSM crates.

File summaries

File	Description
documentation/docs/hsm_support/hsm_operations.md	Documents HSM-delegated EC keygen and signing behavior, plus PKCS#11 v3 capability notes
documentation/docs/adr/2026-09-06-hsm-track-a-ec-ecdsa-completion-pbkdf2-deferral.md	Adds ADR claiming Track A EC/ECDSA completion and PBKDF2 deferral
documentation/docs/adr/2026-09-05-hsm-track-a-rsa-pss-scope-decision.md	Adds initial scope decision ADR for Track A (RSA-PSS first)
crate/server/src/core/operations/destroy.rs	Allows HSM guard to accept EC key types in destroy flow
crate/interfaces/src/lib.rs	Exposes new EC key types/materials in interfaces crate exports
crate/interfaces/src/hsm/mod.rs	Re-exports new EC HSM interface types
crate/interfaces/src/hsm/interface.rs	Adds EC keypair algorithm + filters + EC key material types
crate/interfaces/src/hsm/hsm_store.rs	Extends HsmStore to create/sign/export EC keys and map curves to KMIP
crate/interfaces/src/crypto_oracle.rs	Adds RSA-PSS/ECDSA/EdDSA signing variants and KMIP parameter resolution tests
crate/interfaces/Cargo.toml	Adds non-fips feature flag for HSM-related non-FIPS algorithms
crate/hsm/utimaco/Cargo.toml	Propagates non-fips feature to vendor loader crate
crate/hsm/softhsm2/src/tests.rs	Extends SoftHSM2 test suite to cover EC keygen, RSA-PSS, ECDSA, and EdDSA (non-fips)
crate/hsm/softhsm2/Cargo.toml	Propagates non-fips feature to vendor loader crate
crate/hsm/smartcardhsm/Cargo.toml	Propagates non-fips feature to vendor loader crate
crate/hsm/proteccio/Cargo.toml	Propagates non-fips feature to vendor loader crate
crate/hsm/crypt2pay/Cargo.toml	Propagates non-fips feature to vendor loader crate
crate/hsm/base_hsm/src/tests_shared.rs	Adds shared EC/RSA-PSS/ECDSA/(EdDSA) test helpers and OpenSSL verification helpers
crate/hsm/base_hsm/src/session/session_impl.rs	Adds signing dispatch (RSA-PSS/ECDSA/EdDSA), EC key export/metadata handling, and EC filters
crate/hsm/base_hsm/src/session/mod.rs	Registers new EC session module and exposes curve helpers internally
crate/hsm/base_hsm/src/session/ec.rs	Implements EC keypair generation, curve OID/name encoding, and curve helpers
crate/hsm/base_hsm/src/kms_hsm.rs	Extends BaseHsm create_keypair to support EC and non-fips curves
crate/hsm/base_hsm/Cargo.toml	Adds OpenSSL dependency (used by shared HSM test helpers) and non-fips feature
CHANGELOG/hsm_delegation.md	Adds branch changelog entry for Track A/Track B delegation work
Cargo.lock	Records added dependency (OpenSSL) in lockfile

Review details

Suppressed comments (1)

crate/interfaces/src/hsm/hsm_store.rs:1506

• The EC Attributes created here omit key_format_type. Setting it to TransparentECPublicKey helps ensure GetAttributes and attribute-based queries report the correct key format for EC public keys.

            let mut attributes = Attributes {
                cryptographic_algorithm: Some(CryptographicAlgorithm::EC),
                cryptographic_length: Some(i32::try_from(km.curve.key_length_in_bits()).map_err(
                    |e| InterfaceError::InvalidRequest(format!("Invalid key length: {e}")),
                )?),

• Files reviewed: 23/24 changed files
• Comments generated: 8
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.