> ## Documentation Index
> Fetch the complete documentation index at: https://developers.fireblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Link Supported Key Algorithms

> The key algorithms and public key formats that Fireblocks Key Link accepts for validation keys and signing keys, and how the two key types work together.

Fireblocks Key Link uses two types of external keys that you register in your workspace: validation keys and signing keys. Each key type supports a different set of algorithms. Validation keys accept a wider range of algorithms because they only certify signing keys and never sign transactions.

| Key type | Supported algorithms | Purpose |
| - | - | - |
| Validation key | RSA (2048-bit or larger), ECDSA P-256, ECDSA secp256k1, EdDSA Ed25519 | Signs the certificate of each signing key you register, proving that you control it |
| Signing key | ECDSA secp256k1, EdDSA Ed25519 | Signs transactions for the vault account it is assigned to |

## Validation keys

A validation key is a public key that you register with Fireblocks to certify your signing keys. When you add a new signing key, you submit a certificate for it that is signed by one of your validation keys. Fireblocks accepts the signing key only when that certificate validates against a validation key registered in your workspace.

### Supported validation key algorithms

You can register a validation key that uses any of these algorithms:

* RSA, with a key size of 2048 bits or larger
* Elliptic Curve Digital Signature Algorithm (ECDSA) on the P-256 curve
* ECDSA on the secp256k1 curve
* Edwards-curve Digital Signature Algorithm (EdDSA) on the Ed25519 curve

Any supported validation key algorithm can sign a certificate for a signing key of either supported type. For example, an RSA validation key can certify both ECDSA secp256k1 and EdDSA Ed25519 signing keys.

### Public key format

Submit the validation key's public key as a PEM-encoded SubjectPublicKeyInfo structure. This format starts with the following header:

```text theme={"system"}
-----BEGIN PUBLIC KEY-----
```

The Console rejects RSA public keys in the PKCS#1 format, which start with `-----BEGIN RSA PUBLIC KEY-----`. If your HSM exports RSA public keys in PKCS#1 format, convert the key before you register it. For example, with OpenSSL:

```bash theme={"system"}
openssl rsa -RSAPublicKey_in -in validation-key-pkcs1.pem -pubout -out validation-key.pem
```

### Expiration

Each validation key has an expiration period, set with the `daysTillExpired` parameter when you add the key. The minimum value is 1 day. After a validation key expires, you can no longer use it to certify new signing keys. Register a new validation key before the current one expires so you can keep adding signing keys.

New validation keys require approval from your workspace's admin quorum before they become active. For the request and response fields, see [Add a new validation key](/api-reference/key-link-beta/add-a-new-validation-key).

## Signing keys

A signing key is the key in your HSM or key management system that signs transactions for a vault account. Signing keys must use one of these algorithms:

* ECDSA on the secp256k1 curve (`ECDSA_SECP256K1`)
* EdDSA on the Ed25519 curve (`EDDSA_ED25519`)

The algorithm determines which blockchains the key can sign for. For the request fields, including the signed certificate (`signedCertPem`), see [Add a new signing key](/api-reference/key-link-beta/add-a-new-signing-key).

## Related pages

* [Key Link transaction metadata](/reference/keylink-transaction-metadata)
* [Get list of registered validation keys](/api-reference/key-link-beta/get-list-of-registered-validation-keys)
* [Get list of signing keys](/api-reference/key-link-beta/get-list-of-signing-keys)