diff --git a/docs/stack/evaluate/security.mdx b/docs/stack/evaluate/security.mdx
index 432dc59643..447c9f0191 100644
--- a/docs/stack/evaluate/security.mdx
+++ b/docs/stack/evaluate/security.mdx
@@ -70,6 +70,18 @@ response, or control upgrade authority depending on the deployment. For upgrade
 mechanics, see the
 [OpenZeppelin Transparent Upgradeable Proxy pattern](../../protocol/architecture/smart-contracts.mdx#contract-versioning).
 
+## Cryptographic primitives
+
+The following table outlines the cryptographic primitives Lineth relies on, where they are used in the stack, and what standards they correspond to.
+
+| Primitive | Where the stack uses it | Standard |
+| --- | --- | --- |
+| ECDSA over secp256k1 | Transaction signing and validator signing | Ethereum-standard curve. |
+| ECDSA over secp256r1 (P-256) | Available to smart contracts through the `P256VERIFY` precompile ([RIP-7212](https://github.com/ethereum/RIPs/blob/master/RIPS/rip-7212.md)) | Curve approved under [FIPS 186-5](https://csrc.nist.gov/pubs/fips/186-5/final) |
+| Keccak-256 | EVM hashing, state commitments, and role identifiers | Based on the Keccak permutation standardized in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final) (SHA-3 family). Ethereum uses the pre-standardization Keccak-256 padding, not the FIPS 202 SHA3-256 output. |
+| TLS | Service-to-service and RPC endpoints | Standard TLS. Configuration is per deployment. |
+| Key custody | Remote signing through [Web3Signer](../../protocol/architecture/index.mdx#web3signer), with optional AWS KMS-backed secp256k1 signing | AWS KMS uses FIPS 140-2 and FIPS 140-3 validated HSMs (validations held by AWS). Key custody is a deployment choice. |
+
 ## Available evidence
 
 The following public materials are the available assurance evidence for the Lineth stack: