← Back to the reading view
Slides · 7 slides
PKCS#11: the standard behind every HSM and smart card
The same use case told visually, ready to present. Speaker notes carry the full explanation.
Key Management
PKCS#11
The standard interface behind every HSM, smart card and USB token
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today1 / 7
The family
One numbered standard per job
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today2 / 7
Object model
Slots, tokens, sessions and objects
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today3 / 7
A session
Signing with a token-resident key
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today4 / 7
Attributes
The token enforces what a key may do
Use it to sign forever, export it never: not even an administrator can
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today5 / 7
Everyday
Where you've already used PKCS#11
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today6 / 7
Attack
Wrap, then decrypt: the Clulow attack
Fix: a wrapping key gets CKA_WRAP or CKA_UNWRAP and nothing else
PKCS#11: the standard behind every HSM and smart card · Classical Crypto Today7 / 7
1 / 7
Keys: ← → move, F full screen, G all slides, N notes