OpenSSL Studio / S/MIME & CMS Workshop

What you will do: Sign, verify, encrypt and decrypt CMS messages with real OpenSSL 3.6 running in the browser, using ML-DSA, SLH-DSA and ML-KEM-768.

Worked example: An ML-DSA-65 CMS SignedData signed and verified end to end, then an ML-KEM-768 AuthEnvelopedData encrypted and decrypted; toggle the signing key through the PKCS#11 provider.

Runtime and privacy: The cryptographic exercise runs in this browser. Review the site privacy terms before entering sensitive material; use synthetic inputs for learning and evaluation.

Browse all Crypto Lab tools · Learn with Email & Document Signing

For your role

Developer / Engineer

Run Sign + Verify with ML-DSA-65 on a payload, then Encrypt + Decrypt with ML-KEM-768 and aes-256-gcm: the CMS SignedData and AuthEnvelopedData are produced by OpenSSL 3.6 WASM, and Use HSM key routes the signing key through softhsmv3.

Security Architect

The Dual-sign + Verify step (ML-DSA-65 with EC, marked WIP and not LAMPS composite) shows the migration-period pattern of two SignerInfos; the CMS Encryption step shows KEMRecipientInfo replacing key transport.

Researcher / Academic

Run the ML-DSA and ML-KEM steps and compare the CMS structures with and without the HSM key; the Live HSM Provider smoke test at the top shows whether the PKCS#11 provider initialised.