Page 24

HSM_for_Dummies

3 The Interface: The Key to the Application PKCS#11 Cryptographic Token Interface Standard This standard (also called Cryptoki) is an API for HSMs (in a broad sense) that store cryptographic information and run cryptographic operations. PKCS are essentially Public Key Cryptography Standards developed from 1991 onwards by the RSA Laboratories. PKCS#11 was developed up to Version 2.30 by RSA Labs. The Organization for Advancement of Structured Information Standards (OASIS) took over the development in 2013. This interface is currently the most widely used generic interface for accessing security modules. Benefits One of the key benefits of the PKCS#11 interface is interoperability between application and security module. PKCS#11 also offers a universal approach for symmetric as well as asymmetric cryptographic methods. Downsides However great the aforementioned interoperability may be, many manufacturers have installed enhancements, or vendor defined mechanisms, in their PKCS#11 implementation, and so have reduced the benefit of manufacturer neutrality to absurdity. The standard has also developed such a high level of complexity that attacks on the interface in particular have very high success rates with sequences of commands. Take a look at this article, http://www.dsi.unive.it/ ~focardi/Articoli/bmfs-ASA09.pdf, which describes the problem very well. JCE: Java Cryptography Extension The Java Cryptography Extension (JCE) is an interface of the Java programming language, and at the same time a framework for cryptographic tasks such as encryption, signature generation and key management. It’s been part of the Java platform since JDK 1.4. The JCE is part of the Java Cryptography Architecture (JCA). The split into JCE and JCA meant that in the past the API could comply with US restrictions for cryptography. Because the JCA contains only hash functions, key generators and so on, they could be freely exported. The JCE is based on a provider model that enables programmers to link in different cryptographic models. The JCE is independent of the implementation of the 23


HSM_for_Dummies
To see the actual publication please follow the link above