Supported algorithms
Roost offers a short list of safe choices. Weak algorithms and modes are not available, so they cannot be chosen by mistake.
| Use | Algorithms |
|---|---|
| Signatures | ECDSA P-256 (SHA-256), ECDSA P-384 (SHA-384), RSA-3072 (PSS, SHA-256), ML-DSA-65 (hybrid with ECDSA) |
| Data encryption | AES-256-GCM, ARIA-256-GCM |
| Key wrapping and transport | AES-256-KWP, ECDH P-384, ML-KEM-768 (hybrid) |
| Message authentication | HMAC-SHA-256, HMAC-SHA-384 |
| Hashing | SHA-256, SHA-384 |
| Random | DRBG seeded from the chip, per voter |
Not available
RSA below 3072, SHA-1, 3DES, ECB, CBC without authentication, and raw export of private or secret keys.
Post-quantum
Signatures and key transport can run in hybrid mode: a classical algorithm and a post-quantum one together, so a connection or a signature stays valid if either is broken. Hybrid is set per key purpose and per partition.
Korean algorithms
ARIA-256-GCM and HMAC-SHA-256 with ECDSA P-256 cover sites that require KCMVP-listed algorithms. The same API serves AES and ARIA; the partition policy chooses.