1. Security Services (Overview)
Part II System, File, and Device Security
2. Managing Machine Security (Overview)
3. Controlling Access to Systems (Tasks)
4. Controlling Access to Devices (Tasks)
5. Using the Basic Audit Reporting Tool (Tasks)
6. Controlling Access to Files (Tasks)
7. Using the Automated Security Enhancement Tool (Tasks)
Part III Roles, Rights Profiles, and Privileges
8. Using Roles and Privileges (Overview)
9. Using Role-Based Access Control (Tasks)
10. Role-Based Access Control (Reference)
Part IV Oracle Solaris Cryptographic Services
13. Oracle Solaris Cryptographic Framework (Overview)
What's New in the Oracle Solaris Cryptographic Framework?
Oracle Solaris Cryptographic Framework
Scope of the Oracle Solaris Cryptographic Framework
Administrative Commands in the Oracle Solaris Cryptographic Framework
User-Level Commands in the Oracle Solaris Cryptographic Framework
Binary Signatures for Third-Party Software
Plugins to the Oracle Solaris Cryptographic Framework
Cryptographic Services and Zones
14. Oracle Solaris Cryptographic Framework (Tasks)
15. Oracle Solaris Key Management Framework
Part V Authentication Services and Secure Communication
16. Using Authentication Services (Tasks)
19. Using Solaris Secure Shell (Tasks)
20. Solaris Secure Shell (Reference)
21. Introduction to the Kerberos Service
22. Planning for the Kerberos Service
23. Configuring the Kerberos Service (Tasks)
24. Kerberos Error Messages and Troubleshooting
25. Administering Kerberos Principals and Policies (Tasks)
26. Using Kerberos Applications (Tasks)
27. The Kerberos Service (Reference)
Part VII Oracle Solaris Auditing
28. Oracle Solaris Auditing (Overview)
29. Planning for Oracle Solaris Auditing
30. Managing Solaris Auditing (Tasks)
The following list of definitions and examples is useful when working with the cryptographic framework.
Algorithms – Cryptographic algorithms. These are established, recursive computational procedures that encrypt or hash input. Encryption algorithms can be symmetric or asymmetric. Symmetric algorithms use the same key for encryption and decryption. Asymmetric algorithms, which are used in public-key cryptography, require two keys. Hashing functions are also algorithms.
Examples of algorithms include:
Symmetric algorithms, such as AES and ARCFOUR
Asymmetric algorithms, such as Diffie-Hellman and RSA
Hashing functions, such as MD5
Consumers – Are users of the cryptographic services that come from providers. Consumers can be applications, end users, or kernel operations.
Examples of consumers include:
Applications, such as IKE
End users, such as an ordinary user who runs the encrypt command
Kernel operations, such as IPsec
Mechanism – Is the application of a mode of an algorithm for a particular purpose.
For example, a DES mechanism that is applied to authentication, such as CKM_DES_MAC, is a separate mechanism from a DES mechanism that is applied to encryption, CKM_DES_CBC_PAD.
Metaslot – Is a single slot that presents a union of the capabilities of other slots which are loaded in the framework. The metaslot eases the work of dealing with all of the capabilities of the providers that are available through the framework. When an application that uses the metaslot requests an operation, the metaslot figures out which actual slot should perform the operation. Metaslot capabilities are configurable, but configuration is not required. The metaslot is on by default. To configure the metaslot, see the cryptoadm(1M) man page.
Mode – Is a version of a cryptographic algorithm. For example, CBC (Cipher Block Chaining) is a different mode from ECB (Electronic Code Book). The AES algorithm has two modes, CKM_AES_ECB and CKM_AES_CBC.
Policy – Is the choice, by an administrator, of which mechanisms to make available for use. By default, all providers and all mechanisms are available for use. The disabling of any mechanism would be an application of policy. The enabling of a disabled mechanism would also be an application of policy.
Providers – Are cryptographic services that consumers use. Providers plug in to the framework, so are also called plugins.
Examples of providers include:
PKCS #11 libraries, such as pkcs11_softtoken.so
Modules of cryptographic algorithms, such as aes and arcfour
Device drivers and their associated hardware accelerators, such as the mca driver for the Sun Crypto 6000 accelerator
Slot – Is an interface to one or more cryptographic devices. Each slot, which corresponds to a physical reader or other device interface, might contain a token. A token provides a logical view of a cryptographic device in the framework.
Token – In a slot, a token provides a logical view of a cryptographic device in the framework.