ZetaCA uses the following key objects on the Utimaco HSM:
-
CA Root Key (RSA-4096 or ECDSA P-384): CKA_TOKEN=TRUE, CKA_PRIVATE=TRUE, CKA_SENSITIVE=TRUE, CKA_SIGN=TRUE. Label set by admin (e.g., "root-ca-rsa4096"). Private key never leaves HSM.
-
PQC Key (ML-DSA): Generated via VDM mechanism CKM_MECH_MLDSA_GENKEY. Key type: CKK_VENDOR_UTI_MLDSA_KT.
-
KEK (optional): Envelope encryption key for protecting software-stored keys. Label: "zetaca-kek".
-
Token Layout: Slot 0 — SO_0000 (lifecycle management), PKCS11_0000 (crypto operations), CA private keys (non-extractable), public keys (exportable as PEM).