1# Key Generation Overview and Algorithm Specifications
2
3You can use the HUKS APIs to generate a key randomly and store the key in HUKS.
4> **NOTE**<br>
5> Key aliases must not contain sensitive information, such as personal data.
6
7- Random generation: HUKS uses a cryptographically secure pseudorandom number generator (PRNG) to generate keys. The PRNG helps improve the randomness, unpredictability, and non-reproducibility of the keys, making the generated keys difficult to infer.
8
9- Secure storage: Except the public keys in asymmetric key pairs, the keys generated by HUKS can be used only in the secure storage area throughout their lifecycle (from generation to destruction). In addition, the generated key file cannot be directly accessed by any service except HUKS. Even the services that generate the keys can perform key operations and obtain the operation result only using the HUKS APIs.
10- Key usage: A key can be used for only one purpose. For example, a key cannot be used for encryption/decryption or signing/signature verification, but cannot be used for both. In addition, the usage specified when the key is generated must be the same as that specified when the key is used. Otherwise, an exception may occur.
11
12
13## Supported Algorithms
14
15The following table lists the supported key generation specifications.
16<!--Del-->
17The key management service specifications include mandatory specifications and optional specifications. Mandatory specifications are algorithm specifications that must be supported. Optional specifications can be used based on actual situation. Before using the optional specifications, refer to the documents provided by the vendor to ensure that the specifications are supported.
18
19**You are advised to use mandatory specifications in your development for compatibility purposes.**
20<!--DelEnd-->
21**Specifications for Standard-System Devices**
22| Algorithm| Supported Key Length (Bit)| API Version| <!--DelCol4-->Mandatory|
23| -------- | -------- | -------- | -------- |
24| AES | 128, 192, 256| 8+ | Yes|
25| <!--DelRow-->RSA | 512, 768, 1024| 8+ | No|
26| RSA | 2048, 3072, 4096| 8+ | Yes|
27| HMAC | An integer multiple of 8, ranging from 8 to 1024 (inclusive)| 8+ | Yes|
28| <!--DelRow-->ECC | 224 | 8+ | No|
29| ECC | 256, 384, 521| 8+ | Yes|
30| ED25519 | 256 | 8+ | Yes|
31| X25519 | 256 | 8+ | Yes|
32| <!--DelRow-->DSA | An integer multiple of 8, ranging from 512 to 1024 (inclusive) | 8+ | No|
33| DH | 2048 | 8+ | Yes|
34| <!--DelRow-->DH | 3072, 4096| 8+ | No|
35| SM2 | 256 | 9+ | Yes|
36| SM4 | 128 | 9+ | Yes|
37
38> **NOTE**<br>
39> The DH algorithm uses the FFDHE named safe prime groups.
40
41**Specifications for Mimi-System Devices**
42
43<!--Del-->
44Before implementing the specifications for mini-system devices, determine whether your device supports the related specifications.
45<!--DelEnd-->
46
47| Algorithm| Supported Key Length (Bit)| API Version|
48| -------- | -------- | -------- |
49| AES | 128, 192, 256| 8+ |
50| DES | 64 | 12+ |
51| 3DES | 128, 192| 12+ |
52| RSA | An integer multiple of 8, ranging from 1024 to 2048 (inclusive)| 12+ |
53| HMAC | An integer multiple of 8, ranging from 8 to 1024 (inclusive)| 12+ |
54| CMAC | 128 (supporting only 3DES)| 12+ |
55