Inquiry About Post-Quantum Algorithm Support in EJBCA 9.0.0 and 9.1.1

[zikoz-g]

How are you,

I’m encountering issues when attempting to use post-quantum algorithms (ML-DSA and Falcon) with EJBCA 9.0.0 and 9.1.1.
ML-DSA Key Generation
In version 9.1.1, when I try to generate a key pair for ML-DSA-65 in a crypto token, I receive the following error:
Error: java.lang.IllegalStateException: Algorithm ML-DSA-65 was not recognized.
However, generating RSA keys works fine.

Falcon 512/1024 Key Generation
In the case of Falcon 512/1024, the key pair generation process completes without the expected key algorithm or specification.
I receive the following error:
Error: Result from signing is null.

Could you please confirm if EJBCA 9.0.0 or 9.1.1 officially supports post-quantum algorithms like Dilithium ML-DSA and Falcon?

Thank you in advance for your help.

[zikoz-g]

new error:
Error: invalid ParameterSpec: org.bouncycastle.jcajce.spec.MLDSAParameterSpec@6bd8ad87
when trying to generate a key pair ML DSA 65

[primetomas]

9.1 supports ML-DSA and Falcon. What deployment form do you use? Easiest to test is with our container. If you use source build, perhaps you have another, older, BC provider installed, that would mess things up.

[primetomas]

https://docs.keyfactor.com/ejbca/latest/wildfly-35#id-(9.2.3)WildFly35-RemoveRESTEasy-Crypto

[zikoz-g]

Thank you again for your guidance earlier regarding the resolution of Bouncy Castle conflicts in WildFly. Your assistance allowed me to successfully enable post-quantum algorithms (ML-DSA, Falcon) in EJBCA Community Edition deployment using software-based crypto tokens.

I would like to confirm one remaining point:

Is it currently possible to use post-quantum algorithms (e.g., ML-DSA, Falcon) in combination with Hardware Security Modules (HSM) within EJBCA Community Edition via PKCS#11?

[primetomas]

No it's not possible. The Sun PKCS#11 provider does not support it (and only a few HSMs support it).

[zikoz-g]

Thank you for the clarification! To confirm, if I have an HSM that supports post-quantum algorithms like ML-DSA and ML-KEM, would it be possible to use EJBCA Community Edition (CE) in combination with this HSM for post-quantum cryptography? Or would I need EJBCA Enterprise to use these post-quantum algorithms effectively?

[primetomas]

You need EJBCA Enterprise. For HSMs this requires HSM specific coding, and that we do in Enterprise. Java PKCS#11 provider will never (haven't done historically at least) do things like vendor defined PKCS#11 mechanisms.