openCryptoki configuration

Edit online

openCryptoki is an implementation of the PKCS #11 API that allows interfacing to devices that hold cryptographic information. openCryptoki was configured for the JSSE study using these instructions.

openCryptoki is a slot manager and an API for slot token dynamic link libraries (STDLLs). The slot manager runs as a daemon that controls the number of token slots provided to applications. The slot manager interacts with applications using a shared memory region. Each device that has a token associated with it places that token into a slot in the slot manager database. The shared memory region allows for proper sharing of state information between applications.

With Linux® versions SLES 9, SLES 10, RHEL 4, and RHEL 5, openCryptoki must first be configured using the pkcs11_startup script.

When the pkcs11_startup script runs, it performs these tasks:
  1. Creates a Linux group named pkcs11.
  2. Scans for an installed device (/dev/z90crypt).
  3. Creates the slot configuration file (/etc/pkcs11/pk_config_data).

    The slot manager daemon can then be started using the pkcsslotd command or the openCryptoki service control script. Any application that accesses the PKCS subsystem must run as root or under a Linux user that is a member of the pkcs11 group.