# Supported key types for OpenSSL Provider for AWS CloudHSM Client SDK 5
<a name="openssl-provider-key-types"></a>

The AWS CloudHSM OpenSSL Provider supports the following key types with Client SDK 5.



| Key Type | Description | 
| --- | --- | 
| RSA | RSA sign/verify and asymmetric encryption operations. Verification is offloaded to OpenSSL software. To generate RSA keys that are interoperable with the OpenSSL Provider, see [Export an asymmetric key with CloudHSM CLI](cloudhsm_cli-key-generate-file.md). | 
| EC | ECDSA sign/verify for P-256, P-384, and P-521 curves. Verification is offloaded to OpenSSL software. To generate EC keys that are interoperable with the OpenSSL Provider, see [Export an asymmetric key with CloudHSM CLI](cloudhsm_cli-key-generate-file.md). | 
| Ed25519 | EdDSA sign/verify operations using Curve25519 (RFC 8032). Verification is offloaded to OpenSSL software. Ed25519 is only available on non-FIPS clusters. To generate Ed25519 keys that are interoperable with the OpenSSL Provider, see [Export an asymmetric key with CloudHSM CLI](cloudhsm_cli-key-generate-file.md). | 
| ML-DSA-44, ML-DSA-65, ML-DSA-87 | Post-quantum digital signature sign/verify operations as defined in FIPS 204. Verification is offloaded to OpenSSL software. ML-DSA[1](#openssl-provider-key-types-note-1) requires OpenSSL 3.5 or later. To generate ML-DSA keys that are interoperable with the OpenSSL Provider, see [Export an asymmetric key with CloudHSM CLI](cloudhsm_cli-key-generate-file.md). | 

[1] Starting September 1, 2026, ML-DSA is available in FIPS mode for hsm2m.medium clusters.