PKCS#11

What it is

PKCS#11 is a cryptographic token interface standard, which specifies an API, called Cryptoki.
PKCS#11 was developed by the RSA Labs but is now an open standard managed by the OASIS PKCS 11 Technical Committee.
https://www.oasis-open.org/committees/pkcs11/

If you want to have support for multiple platforms, and you know what you do, PKCS#11 can be a good choice for buildning an application using certificates.

Version

The current version of the standard is 2.40, but our implementation will return 2.11 as version information.

The differences between the two versions are:
a) Algorithm extensions not concerning smart cards
b) Changed suggestion for handling multiple PINs. The suggestion regarding multiple PINs is useless and will be removed in future versions of the standard.

The implementation in Net iD Enterprise and Net iD Client is very stable and we seldom need to change anything. The last change was the addition of PKCS#11 key attribute CKA_ALWAYS_AUTHENTICATE in 6.8.4.10.

Applications implementing the standard should only be concerned with the major version (2) and minor versions adding support for specific algorithms which are needed, i.e. in those rare cases where a new specific algorithm is mandatory.

Third-party Package

The PKCS#11 library may be installed in any location; it has no other binary dependencies, and only needs the configuration file for license information.
For library version 5.4 and later the configuration file may be included in the binary, there is no need for a separate file.

Example

The example will test three standard operations with a smart card: create/verify a digital signature, encrypt/decrypt a message and wrap/unwrap a secret key. The example uses Microsoft Developer Studio, but is written in standard C and should be possible to compile using any compiler. Download sample code:

Link your application to Pointsharps PKCS#11 implementation

Net iD Enterprise
Windows => iidp11.dll
Linux => libiidp11.so
macOS => libiidp11.dylib

Net iD Client
Windows => netid.dll
Linux => libnetid.so
macOS => /usr/local/lib/netid/libnetid.dylib

a) You should list all available slots (C_GetSlotList)
b) Then open a session for every found slot and search for all certificates in all slots.
c) When all certificates have been collected check them against the rules set up by your application and the context.
d) If you get more than one hit you should present a decent dialog where the user can select a certificate.
e) Then proceed with the desired operations.
Details can be found here: https://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html

Cryptoki specifications

Prefixes

PKCS#11 Error Codes

Defined mechanism types for Cryptoki

Not yet in place. See the standard itself.

Sample 1 - How PKCS#11 can look like

An application using PKCS#11 to list slots and their eventual content

Sample 2 - An application talks PKCS#11

Another application using PKCS#11 to list slots and their eventual content