PKCS#11 provider differences

Differences in behavior

Dynamic configuration

In version 8 of the SDK, you could create an instance of the IBMPKCS11Impl class and then use that instance to configure the provider dynamically. For example, you could specify a configuration file when you created the instance.

Provider p = new com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl("D:\\pkcs11impl\\luna.cfg");

Or you could create the instance and then specify the configuration file later by using the Init() method.

com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl p = new com.ibm.crypto.pkcs11impl.provider.IBMPKCS11Impl();
p.Init("D:\\pkcs11impl\\luna.cfg ", "password".toCharArray());

The SunPKCS11 provider does not have a SunPKCS11 class or an Init() method. To dynamically configure this provider, you must create an instance of the Provider class and then use its configure() method to specify the PKCS#11 configuration file.

Provider p = java.security.Security.getProvider(“SunPKCS11”);
P = p.configure(“/opt/bar/cfg/pkcs11.cfg”);

For more information, see SunPKCS11 Configuration.

Token objects

The IBMPKCS11Impl provider allowed multiple token objects with the same label whereas the SunPKCS11 provider does not. A load failure can occur if there are multiple token objects with the same label.

Algorithms

Algorithms that are available in the IBMPKCS11Impl provider might not be available, or might have different names, in the SunPKCS11 provider. For a detailed list, see Differences between IBM and Oracle PKCS#11 algorithms.

Equivalent classes