PKCS11

PKCS#11, also known as Cryptographic Token Interface or Cryptoki, is an industry standard that defines a platform- and vendor-neutral API for applications to interact with cryptographic tokens. A token can be a hardware security module (HSM), a smart card, or a software-based token. The API enables software to perform cryptographic operations, manage keys and certificates, and control the token’s security state without needing to know the token’s internal design.

Key concepts in PKCS#11 include slots (the physical or logical readers), tokens (the cryptographic devices), sessions, and objects. A session can be read-only or read-write; user authentication (for example with a PIN) may be required to access private objects. Objects stored on the token include keys and certificates, described by attributes such as class, label, and id. The API provides mechanisms to search for objects, create keys, and perform operations on them.

PKCS#11 defines a large set of functions for initialization, session management, object search, key generation, encryption and decryption, signing and verification, and key management operations such as wrapping and unwrapping. Typical function categories include C_Initialize, C_OpenSession, C_Login, C_FindObjects, C_GenerateKey, C_Sign, and C_Encrypt, among others. The standard itself specifies the interface and semantics, while the token implements the underlying cryptographic algorithms and security policies.

Use and ecosystem: PKCS#11 does not specify algorithms; tokens implement cryptographic routines, commonly including RSA, ECC, and symmetric algorithms like AES. It is widely used to enable secure key storage and cryptographic operations for TLS, code signing, S/MIME, and authentication. Software libraries such as OpenSSL, Mozilla NSS, and Java’s JCA can interface with PKCS#11 tokens, often via providers or engines; p11-kit offers a unifying front end for multiple implementations.