PKCS #11 v2.20：加密令牌接口标准草案

pkcs结构

需积分: 6 199 浏览量更新于2024-07-19 收藏 2.65MB DOC 举报

身份认证购VIP最低享 7 折!

30元优惠券

"PKCS #11 v2.20是RSA实验室发布的Cryptographic Token Interface Standard的草案5版，用于定义加密令牌接口标准。这个标准详细规定了如何与硬件安全模块（如智能卡、HSMs）进行交互，以便在各种操作系统和应用程序之间提供统一的加密服务。" 本文档的核心内容包括以下部分： 1. **介绍**: 部分可能对标准的目的、重要性和背景进行了简要说明，介绍了PKCS #11的作用，即提供一个通用的API，使得不同的加密硬件可以被不同的应用程序所使用。 2. **范围**: 定义了标准的应用领域，可能涵盖了各种类型的加密令牌，以及与这些设备相关的操作和功能。 3. **参考**: 列出了相关标准、文献和其他技术资源，以便读者更深入地理解PKCS #11。 4. **定义**: 提供了标准中使用的术语和概念的明确解释，有助于理解和使用标准。 5. **符号和缩写**: 列出所有关键的符号和缩写，方便查阅。 6. **一般概述**: 这部分详细描述了设计目标、模型、逻辑令牌视图、用户、应用及其对Cryptoki的使用方式。其中， - **设计目标**可能包括互操作性、安全性和效率等。 - **一般模型**可能涉及系统架构和组件之间的关系。 - **逻辑令牌视图**描绘了硬件安全模块的抽象表示。 - **用户**可能包括个人用户和系统级实体。 - **应用和Cryptoki的使用**解释了如何在不同环境和上下文中使用Cryptoki API。 - **会话**部分详细说明了会话的概念，包括只读和读写状态、对象访问权限、会话事件、会话句柄和对象句柄以及会话的能力。 - **次要认证**（已废弃）可能是指早期版本中的一种辅助验证机制，但在当前版本中不再推荐。 7. **函数概览**: 提供了标准中包含的主要函数的功能概述，帮助开发者了解如何调用和使用这些函数。 8. **安全考虑**: 强调了在实现和使用PKCS #11时必须注意的安全问题和风险。 9. **平台和编译器依赖性指令**: 这部分可能包含针对C或C++编程的特定指导，如结构对齐和指针相关宏，以确保跨平台兼容性。此标准对于理解并实现与硬件安全模块的通信至关重要，对于开发需要加密和签名功能的应用程序的开发者尤其有用。通过遵循PKCS #11，开发者可以创建能够无缝集成各种加密硬件的软件。

资源详情

资源推荐

INTRODUCTION XI

L.39.2 CMS Signature Mechanism Objects......................................................................................390

L.39.3 CMS mechanism parameters..................................................................................................391

CK_CMS_SIG_PARAMS, CK_CMS_SIG_PARAMS_PTR..............................................................391

L.39.4 CMS signatures......................................................................................................................392

L.40 BLOWFISH............................................................................................................................... 394

L.40.1 Definitions..............................................................................................................................394

L.40.2 BLOWFISH secret key objects...............................................................................................394

L.40.3 Blowfish key generation.........................................................................................................395

L.40.4 Blowfish -CBC........................................................................................................................395

L.41 TWOFISH................................................................................................................................. 396

L.41.1 Definitions..............................................................................................................................396

L.41.2 Twofish secret key objects......................................................................................................396

L.41.3 Twofish key generation..........................................................................................................397

L.41.4 Twofish -CBC.........................................................................................................................397

APPENDIX M: TOKEN MANAGEMENT OBJECTS........................................................................398

M.1 HARDWARE FEATURE OBJECTS.................................................................................................398

M.1.1 Clock........................................................................................................................................398

M.1.1.1 Definition.............................................................................................................................398

M.1.1.2 Description...........................................................................................................................398

M.1.2 Monotonic Counter Objects....................................................................................................398

M.1.2.1 Definition.............................................................................................................................398

M.1.2.2 Description...........................................................................................................................399

M.1.3 User Interface Objects............................................................................................................399

M.1.3.1 Definition.............................................................................................................................399

M.1.3.2 Description...........................................................................................................................399

APPENDIX N: CRYPTOKI TIPS AND REMINDERS.......................................................................402

N.1 OPERATIONS, SESSIONS, AND THREADS....................................................................................... 402

N.2 MULTIPLE APPLICATION ACCESS BEHAVIOR..............................................................................402

N.3 OBJECTS, ATTRIBUTES, AND TEMPLATES.....................................................................................403

N.4 SIGNING WITH RECOVERY..........................................................................................................403

APPENDIX O: MANIFEST CONSTANTS...........................................................................................405

APPENDIX P: TOKEN PROFILES.......................................................................................................415

APPENDIX Q: COMPARISON OF CRYPTOKI AND OTHER APIS.............................................417

APPENDIX R: INTELLECTUAL PROPERTY CONSIDERATIONS..............................................421

APPENDIX S: METHOD FOR EXPOSING MULTIPLE-PINS ON A TOKEN THROUGH

CRYPTOKI (DEPRECATED).................................................................................................................422

APPENDIX T: REVISION HISTORY...................................................................................................423

List of Figures

Figure 1, General Cryptoki Model.....................................................................................14

Figure 2, Object Hierarchy................................................................................................15

Figure 3, Read-Only Session States...................................................................................20

Figure 4, Read/Write Session States..................................................................................21

XII PKCS #11 V2.20 (DRAFT): CRYPTOGRAPHIC TOKEN INTERFACE STANDARD
Figure 5, Object Attribute Hierarchy.................................................................................64
List of Tables
Table 1, Symbols...............................................................................................................10
Table 2, Prefixes................................................................................................................10
Table 3, Character Set........................................................................................................12
Table 4, Read-Only Session States....................................................................................20
Table 5, Read/Write Session States...................................................................................21
Table 6, Access to Different Types Objects by Different Types of Sessions...................22
Table 7, Session Events.....................................................................................................22
Table 8, Summary of Cryptoki Functions.........................................................................27
Table 9, Major and minor version values for published Cryptoki specifications..............38
Table 10, Slot Information Flags.......................................................................................40
Table 11, Token Information Flags...................................................................................43
Table 12, Session Information Flags.................................................................................50
Table 13, Mechanism Information Flags...........................................................................56
Table 14, C_Initialize Parameter Flags.............................................................................63
Table 15, Common footnotes for object attribute tables...................................................68
Table 16, Common Object Attributes................................................................................69
Table 17, Hardware Feature Common Attributes..............................................................70
Table 18, Common Storage Object Attributes..................................................................71
Table 19, Data Object Attributes.......................................................................................72
Table 20, Common Certificate Object Attributes..............................................................74
Table 21, Common Key Attributes....................................................................................76
Table 22, Common Public Key Attributes........................................................................78
Table 23, Common Private Key Attributes.......................................................................79
Copyright © 2004 RSA Security Inc. Draft 5, February 2004

INTRODUCTION XIII

Table 24, Common Secret Key Attributes.........................................................................82

Table 25, Common Domain Parameter Attributes............................................................85

Table 26, Common Mechanism Attributes........................................................................86

Table 27, Mechanisms vs. Functions...............................................................................195

Table 28, Mapping of X.509 key usage flags to cryptoki attributes for public keys......201

Table 29, Mapping of X.509 key usage flags to cryptoki attributes for private keys.....201

Table 30, X.509 Certificate Object Attributes.................................................................202

Table 31: WTLS Certificate Object Attributes................................................................204

Table 32, X.509 Attribute Certificate Object Attributes.................................................205

Table 33, RSA Public Key Object Attributes..................................................................207

Table 34, RSA Private Key Object Attributes.................................................................208

Table 35, PKCS #1 v1.5 RSA: Key And Data Length....................................................212

Table 36, PKCS #1 Mask Generation Functions.............................................................213

Table 37, PKCS #1 RSA OAEP: Encoding parameter sources......................................213

Table 38, PKCS #1 RSA OAEP: Key And Data Length................................................215

Table 39, PKCS #1 RSA PSS: Key And Data Length....................................................216

Table 40, ISO/IEC 9796 RSA: Key And Data Length....................................................217

Table 41, X.509 (Raw) RSA: Key And Data Length......................................................219

Table 42, ANSI X9.31 RSA: Key And Data Length......................................................220

Table 43, PKCS #1 v1.5 RSA Signatures with Various Hash Functions: Key And Data

Length..............................................................................................................................221

Table 44, PKCS #1 RSA PSS Signatures with Various Hash Functions: Key And Data

Length..............................................................................................................................222

Table 45, ANSI X9.31 RSA Signatures with SHA-1: Key And Data Length................222

Table 46, DSA Public Key Object Attributes..................................................................223

Table 47, DSA Private Key Object Attributes................................................................224

剩余63页未读，继续阅读

zero_kkk

粉丝: 0
资源: 5

PKCS #11 v2.20：加密令牌接口标准草案

pkcs_11v2.11-CH.pdf.zip_PKCS11 PDF_pkcs-11v2-20.pdf_pkcs11_pkcs_

pkcs11-tool 命令大全

pkcs11-helper-1.11-3.el7.x86_64.rpm

openssl-pkcs11

pkcs11-tool 查看连接状态

指定pkcs-9-at-randomNonce的OID为1.2.840.113549.1.9.25.3， 数据为167EB0E72781E4940112233445566778。请使用linux c语言，调用openssl接口对该数据进行asn1编码后进行base4编码输出结果，并将结果数据解码出原始数据。请给出详细源码

PKCS#11/SunPKCS11/IBMEnterpPKCS11

$>openssl pkcs12 -export -clcerts -in xxx/xxx-cert.pem -inkey xxx/xxx-key.pem -out xxx/xxx.pfx

利用openssl 的pkcs11 engine和softHSM， 实现将证书/home/ts/cert.pem 加载到pkcs11中。C代码实现

分组密码为了避免Padding Oracle attack，可以采用PKCS7-Padding

pkcs11测试工具

PKCS#11和PKCS#5的区别

PKCS1-v1_5填充算法不安全是因为会受到哪种攻击

C:\Users\thgy\go\pkg\mod\chainmaker.org\chainmaker\common\v2@v2.3.2\crypto\pkcs11\pkcs11.go:27:27: undefined: pkcs11.Ctx

openssl pkcs12 -in viptls2.p12 -nokeys -cacerts

openssl pkcs12 -export -out /etc/ssl/skills.pfx -inkey /etc/ssl/skills.key -in /etc/ssl/skills.crt

PKCS1-v1_5填充算法不安全是因为会受Coppersmith攻击

openssl转换pkcs

openssl pkcs11

最新资源

指定pkcs-9-at-randomNonce的OID为1.2.840.113549.1.9.25.3，数据为167EB0E72781E4940112233445566778。请使用linux c语言，调用openssl接口对该数据进行asn1编码后进行base4编码输出结果，并将结果数据解码出原始数据。请给出详细源码

利用openssl 的pkcs11 engine和softHSM，实现将证书/home/ts/cert.pem 加载到pkcs11中。C代码实现