PKCS11

From Wikipedia, the free encyclopedia

Jump to: ,

The correct title of this article is PKCS#11. The substitution or omission of a sign is because of .

In , PKCS#11 is one of the family of standards called , published by . It defines a platform-independent to cryptographic tokens, such as Hardware Security Modules and . (The PKCS#11 standard names the API "Cryptoki", but "PKCS#11" is often used to refer to the API as well as the standard that defines it.)

Since there isn't a real standard for cryptographic tokens, this API has been developed to be an abstraction layer for the generic cryptographic token. The PKCS#11 API defines most commonly used cryptographic object types ( keys, Certificates, / keys, etc.) and all the functions needed to use, create/generate, modify and delete those objects.

PKCS#11 is largely adopted to access smart cards and HSMs. Most commercial software uses PKCS#11 to access the CA signing key or to enroll user certificates. Cross-platform software that needs to use smart cards uses PKCS#11, such as and (using an extension). Software written for may use the platform specific API instead.

[] Applications using PKCS#11

• - Disk encryption system
• , a web browser
• , a email client
• - SSL library
• - VPN system
• - VPN system
• - Disk encryption system

[] PKCS#11 wrappers

Since PKCS#11 is a complex API many wrappers exist that let the developer use the API from various languages.

• - A wrapper for
• for Python
• 5.0 includes a wrapper for PKCS#11 API
• - A simple C interface to handle PKCS#11 tokens.
• for C by Alon Bar-Lev

[] References