In
cryptography
Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adver ...
, PKCS #11 is one of the
Public-Key Cryptography Standards,
and also refers to the programming interface to create and manipulate
cryptographic tokens (a token where the secret is a
cryptographic key
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key c ...
).
Detail
The PKCS #11 standard defines a platform-independent
API
An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software Interface (computing), interface, offering a service to other pieces of software. A document or standa ...
to
cryptographic tokens, such as
hardware security module
A hardware security module (HSM) is a physical computing device that safeguards and manages secrets (most importantly digital keys), performs encryption and decryption functions for digital signatures, strong authentication and other cryptograp ...
s (HSM) and
smart cards
A smart card, chip card, or integrated circuit card (ICC or IC card) is a physical electronic authentication device, used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit (IC) c ...
, and names the API itself "Cryptoki" (from "cryptographic token interface" and pronounced as "crypto-key", although "PKCS #11" is often used to refer to the API as well as the standard that defines it).
The API defines most commonly used cryptographic object types (
RSA keys,
X.509
In cryptography, X.509 is an International Telecommunication Union (ITU) standard defining the format of public key certificates. X.509 certificates are used in many Internet protocols, including TLS/SSL, which is the basis for HTTPS, the secu ...
certificates,
DES
Des is a masculine given name, mostly a short form (hypocorism) of Desmond. People named Des include:
People
* Des Buckingham, English football manager
* Des Corcoran, (1928–2004), Australian politician
* Des Dillon (disambiguation), sever ...
/
Triple DES
In cryptography, Triple DES (3DES or TDES), officially the Triple Data Encryption Algorithm (TDEA or Triple DEA), is a symmetric-key block cipher, which applies the DES cipher algorithm three times to each data block. The Data Encryption Standa ...
keys, etc.) and all the functions needed to use, create/generate, modify and delete those objects.
Usage
Most commercial
certificate authority
In cryptography, a certificate authority or certification authority (CA) is an entity that stores, signs, and issues digital certificates. A digital certificate certifies the ownership of a public key by the named subject of the certificate. This ...
(CA) software uses PKCS #11 to access the CA signing key or to enroll user certificates. Cross-platform software that needs to use
smart cards
A smart card, chip card, or integrated circuit card (ICC or IC card) is a physical electronic authentication device, used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit (IC) c ...
uses PKCS #11, such as
Mozilla Firefox
Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. It uses the Gecko rendering engine to display web pages, which implements current and a ...
and
OpenSSL
OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping or need to identify the party at the other end. It is widely used by Internet servers, including the majority of HTT ...
(using an extension). It is also used to access
smart cards
A smart card, chip card, or integrated circuit card (ICC or IC card) is a physical electronic authentication device, used to control access to a resource. It is typically a plastic credit card-sized card with an embedded integrated circuit (IC) c ...
and
HSMs. Software written for
Microsoft Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
may use the platform specific
MS-CAPI API instead. Both
Oracle Solaris
Solaris is a proprietary Unix operating system originally developed by Sun Microsystems. After the Sun acquisition by Oracle in 2010, it was renamed Oracle Solaris.
Solaris superseded the company's earlier SunOS in 1993, and became known for it ...
and
Red Hat Enterprise Linux
Red Hat Enterprise Linux (RHEL) is a commercial open-source Linux distribution developed by Red Hat for the commercial market. Red Hat Enterprise Linux is released in server versions for x86-64, Power ISA, ARM64, and IBM Z and a desktop version ...
contain implementations for use by applications, as well.
Relationship to KMIP
The
Key Management Interoperability Protocol
The Key Management Interoperability Protocol (KMIP) is an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server. This facilitates data encryption by simplifying encrypti ...
(KMIP) defines a wire protocol that has similar functionality to the PKCS#11 API.
The two standards were originally developed independently but are now both governed by an
OASIS
In ecology, an oasis (; ) is a fertile area of a desert or semi-desert environment'ksar''with its surrounding feeding source, the palm grove, within a relational and circulatory nomadic system.”
The location of oases has been of critical imp ...
technical committee. It is the stated objective of both the PKCS#11 and KMIP committees to align the standards where practicable. For example, the PKCS#11 Sensitive and Extractable attributes are being added to KMIP version 1.4. There is considerable overlap between members of the two technical committees.
History
The PKCS#11 standard originated from
RSA Security
RSA Security LLC, formerly RSA Security, Inc. and doing business as RSA, is an American computer and network security company with a focus on encryption and encryption standards. RSA was named after the initials of its co-founders, Ron Rivest, ...
along with its other
PKCS standards in 1994. In 2013, RSA contributed the latest draft revision of the standard (PKCS#11 2.30) to
OASIS
In ecology, an oasis (; ) is a fertile area of a desert or semi-desert environment'ksar''with its surrounding feeding source, the palm grove, within a relational and circulatory nomadic system.”
The location of oases has been of critical imp ...
to continue the work on the standard within the newly created OASIS PKCS11 Technical Committee. The following list contains significant revision information:
* 01/1994: project launched
* 04/1995: v1.0 published
* 12/1997: v2.01 published
* 12/1999: v2.10 published
* 01/2001: v2.11 published
* 06/2004: v2.20 published
* 12/2005: amendments 1 & 2 (
one-time password
A one-time password (OTP), also known as a one-time PIN, one-time authorization code (OTAC) or dynamic password, is a password that is valid for only one login session or transaction, on a computer system or other digital device. OTPs avoid seve ...
tokens, CT-KIP )
* 01/2007: amendment 3 (additional mechanisms)
* 09/2009: v2.30 draft published for review, but final version never published
* 12/2012: RSA announce that PKCS #11 management is being transitioned to
OASIS
In ecology, an oasis (; ) is a fertile area of a desert or semi-desert environment'ksar''with its surrounding feeding source, the palm grove, within a relational and circulatory nomadic system.”
The location of oases has been of critical imp ...
* 03/2013: OASIS PKCS #11 Technical Committee Inaugural meetings, works starts on v2.40
* 04/2015: OASIS PKCS #11 v2.40 specifications become approved OASIS standards
* 05/2016: OASIS PKCS #11 v2.40 Errata 01 specifications become approved OASIS errata
* 07/2020: OASIS PKCS #11 v3.0 specifications become approved OASIS standards
See also
*
List of applications using PKCS #11
*
Microsoft CryptoAPI
The Microsoft Windows platform specific Cryptographic Application Programming Interface (also known variously as CryptoAPI, Microsoft Cryptography API, MS-CAPI or simply CAPI) is an application programming interface included with Microsoft Windows ...
References
External links
* - The PKCS #11 URI Scheme
PKCS#11: Cryptographic Token Interface StandardOASIS PKCS #11 Technical Committee home page
{{Cryptography navbox
Cryptography standards
Smart cards