PKCS#11
O padrão/protocolo PKCS#11 é amplamente utilizado por aplicações que utilizam operações criptográficas com chaves não exportáveis, o protocolo define uma especificação padronizada para interação com hardwares criptográficos (Smartcards, Tokens e HSMs) o driver é oferecido pela maioria dos fabricantes de hardware no segmento, no cenário do uso de certificado em nuvem é utilizado principalmente para autenticação, listagem de objetos e assinatura.
O driver oferece compatibilidade com as melhores bibliotecas de criptografia e pode ser utilizado com os principais sistemas operacionais do mercado, possibilitando uma integração rápida e garantindo uma interoperabilidade na solução que está sendo integrada.
Também já funciona para uso final em aplicações que já utilizam certificados do tipo A3. Como o protocolo também faz parte dos requisitos técnicos no processo de homologação de hardwares (tokens/smartcards) no âmbito da ICP Brasil (DOC-ICP-10.05 2.1-b) muitas aplicações já suportam a configuração da biblioteca/driver em sua versão nativa, não demandando nenhuma integração adicional para a utilização do certificado em nuvem.
A referência completa sobre o padrão PKCS#11 pode ser consultada no site oficial da OASIS (Advancing open standards for the information society). As informações deste manual tratam das especificidades do driver PKCS#11 BirdID.
Instalação
Windows:
Linux:
Mac OSx:
Binários
Windows:
Linux:
Mac OSx:
Funções disponíveis
Status classification
Type
Description
OK
Feature implemented
QUEUE
Implementation queue
x
Will not be implemented
General purpose functions
Status
Category
Description
OK
C_Initialize
initializes Cryptoki
OK
C_Finalize
clean up miscellaneous Cryptoki-associated resources
OK
C_GetInfo
obtains general information about Cryptoki
OK
C_GetFunctionList
obtains entry points of Cryptoki library functions
Slot and token management functions
Status
Category
Description
OK
C_GetSlotList
obtains a list of slots in the system
OK
C_GetSlotInfo
obtains information about a particular slot
OK
C_GetTokenInfo
obtains information about a particular token
x
C_WaitForSlotEvent
waits for a slot event (token insertion, removal, etc.) to occur
OK
C_GetMechanismList
obtains a list of mechanisms supported by a token
OK
C_GetMechanismInfo
obtains information about a particular mechanism
x
C_InitToken
initializes a token (Use User's Portal to manage your account)
x
C_InitPIN
initializes the normal user’s PIN (Use User's Portal to manage your account)
x
C_SetPIN
modifies the PIN of the current user (Use User's Portal to manage your account)
Session management functions
Status
Category
Description
OK
C_OpenSession
opens a connection between an application and a particular token or sets up an application callback for token insertion
OK
C_CloseSession
closes a session
OK
C_CloseAllSessions
closes all sessions with a token
OK
C_GetSessionInfo
obtains information about the session
OK
C_GetOperationState
obtains the cryptographic operations state of a session
OK
C_SetOperationState
sets the cryptographic operations state of a session
OK
C_Login
logs into a token
OK
C_Logout
logs out from a token
Object management functions
Status
Category
Description
x
C_CreateObject
creates an object (Use User's Portal to manage your account)
x
C_CopyObject
creates a copy of an object (Use User's Portal to manage your account)
x
C_DestroyObject
destroys an object (Use User's Portal to manage your account)
OK
C_GetObjectSize
obtains the size of an object in bytes
OK
C_GetAttributeValue
obtains an attribute value of an object
x
C_SetAttributeValue
modifies an attribute value of an object (Use User's Portal to manage your account)
OK
C_FindObjectsInit
initializes an object search operation
OK
C_FindObjects
continues an object search operation
OK
C_FindObjectsFinal
finishes an object search operation
Encryption functions
Status
Category
Description
x
C_EncryptInit
initializes an encryption operation (NOT IMPLEMENTED)
x
C_Encrypt
encrypts single-part data (NOT IMPLEMENTED)
x
C_EncryptUpdate
continues a multiple-part encryption operation (NOT IMPLEMENTED)
x
C_EncryptFinal
finishes a multiple-part encryption operation (NOT IMPLEMENTED)
Decryption functions
Status
Category
Description
x
C_DecryptInit
initializes a decryption operation (NOT IMPLEMENTED)
x
C_Decrypt
decrypts single-part encrypted data (NOT IMPLEMENTED)
x
C_DecryptUpdate
continues a multiple-part decryption operation (NOT IMPLEMENTED)
x
C_DecryptFinal
finishes a multiple-part decryption operation (NOT IMPLEMENTED)
Message digesting functions
Status
Category
Description
x
C_DigestInit
initializes a message-digesting operation (NOT IMPLEMENTED)
x
C_Digest
digests single-part data (NOT IMPLEMENTED)
x
C_DigestUpdate
continues a multiple-part digesting operation (NOT IMPLEMENTED)
x
C_DigestKey
digests a key (NOT IMPLEMENTED)
x
C_DigestFinal
finishes a multiple-part digesting operation (NOT IMPLEMENTED)
Signing and MACing functions
Status
Category
Description
OK
C_SignInit
initializes a signature operation
OK
C_Sign
signs single-part data
OK
C_SignUpdate
continues a multiple-part signature operation
OK
C_SignFinal
finishes a multiple-part signature operation
OK
C_SignRecoverInit
initializes a signature operation, where the data can be recovered from the signature
OK
C_SignRecover
signs single-part data, where the data can be recovered from the signature
Functions for verifying signatures and MACs
Status
Category
Description
x
C_VerifyInit
initializes a verification operation
x
C_Verify
verifies a signature on single-part data
x
C_VerifyUpdate
continues a multiple-part verification operation
x
C_VerifyFinal
finishes a multiple-part verification operation
x
C_VerifyRecoverInit
initializes a verification operation where the data is recovered from the signature
x
C_VerifyRecover
verifies a signature on single-part data, where the data is recovered from the signature
Dual-purpose cryptographic functions
Status
Category
Description
x
C_DigestEncryptUpdate
continues simultaneous multiple-part digesting and encryption operations
x
C_DecryptDigestUpdate
continues simultaneous multiple-part decryption and digesting operations
x
C_SignEncryptUpdate
continues simultaneous multiple-part signature and encryption operations
x
C_DecryptVerifyUpdate
continues simultaneous multiple-part decryption and verification operations
Key management functions
Status
Category
Description
x
C_GenerateKey
generates a secret key
x
C_GenerateKeyPair
generates a public-key/private-key pair
x
C_WrapKey
wraps (encrypts) a key
x
C_UnwrapKey
unwraps (decrypts) a key
x
C_DeriveKey
derives a key from a base key
Random number generation functions
Status
Category
Description
x
C_SeedRandom
mixes in additional seed material to the random number generator
x
C_GenerateRandom
generates random data
Parallel function management functions
Status
Category
Description
x
C_GetFunctionStatus
legacy function which always returns CKR_FUNCTION_NOT_PARALLEL
x
C_CancelFunction
legacy function which always returns CKR_FUNCTION_NOT_PARALLEL
Last updated
Was this helpful?