Cryptoki到CryptoAPI安全生产协议与标准管理.pptx

安全协议与标准mailto:linfb@linfb@2009, 10PKCS#11 and moreOverview ↓API Usage: Session↓Functions Summary↓Functions Detail/Example↓Mechanisms: Algorithm, Protocol ↓Comparison ↓Implementation↓GSS-API↓GCS-API↓CDSA↓MS-CAPI↓DEPOverviewIn cryptography, PKCS#11 is one of the family of standards called Public-Key Cryptography Standards (PKCS), published by RSA Laboratories. It defines a platform-independent API to cryptographic tokens, such as Hardware Security Modules and smart cards. (The PKCS#11 standard names the API Cryptoki, but is often used to refer to the API as well as the standard that defines it.)Since there isnt a real standard for cryptographic tokens, this API has been developed to be an abstraction layer for the generic cryptographic token. The PKCS#11 API defines most commonly used cryptographic object types (RSA keys, X.509 Certificates, DES/Triple DES keys, etc.) and all the functions needed to use, create/generate, modify and delete those objects.-PKCS#11 is largely adopted to access smart cards and HSMs. Most commercial Certification Authority software uses PKCS#11 to access the CA signing key or to enroll user certificates. Cross-platform software that needs to use smart cards uses PKCS#11, such as Mozilla Firefox and OpenSSL (using an extension). NSS(in Firefox)“pkcs-11v2-20.doc”BackgroundPortable computing devices such as smart cards, PCMCIA cards, and smart diskettes are ideal tools for implementing public-key cryptography, as they provide a way to store the private-key component of a public-key/private-key pair securely, under the control of a single user. With such a device, a cryptographic application, rather than performing cryptographic operations itself, utilizes the device to perform the operations, with sensitive information such as private keys never being revealed. As more applications are developed for public-key cryptography, a standard programming interface for these devices becomes increasingly valuable. This standard addresses this