Knowledge check

PKCS#11: the standard behind every HSM and smart card

10 questions testing what you just read — no login, no tracking, just immediate feedback.

Question 1 of 10

What problem was PKCS#11 originally created to solve?

Question 2 of 10

What is Cryptoki?

Question 3 of 10

In Cryptoki's object model, what does an application actually receive when it asks for a private key?

Question 4 of 10

What does a PKCS#11 "session" carry?

Question 5 of 10

What does setting CKA_EXTRACTABLE = false on a private key actually guarantee?

Question 6 of 10

The Web Crypto API's generateKey takes an `extractable` boolean. What does it correspond to in PKCS#11 terms?

Question 7 of 10

Which of these commonly uses PKCS#11 under the hood?

Question 8 of 10

What real-world attribute misconfiguration enables the classic PKCS#11 "wrap-then-decrypt" key extraction attack?

Question 9 of 10

Why does the wrap-then-decrypt attack work even though the target key has CKA_SENSITIVE = true and CKA_EXTRACTABLE = false?

Question 10 of 10

What is the recommended fix for the wrap-then-decrypt attack class?

0 / 10 answered