Algorithms – Cryptographic algorithms. These are established, recursive computational procedures that encrypt or hash input. Encryption algorithms can be symmetric or asymmetric. Symmetric algorithms use the same key for encryption and decryption. Asymmetric algorithms, which are used in public-key cryptography, require two keys. Hashing functions are also algorithms.
Examples of algorithms include:
Symmetric algorithms, such as AES and ARCFOUR
Asymmetric algorithms, such as Diffie-Hellman and RSA
Hashing functions, such as MD5
Examples of consumers include:
Applications, such as IKE
End users, such as an ordinary user who runs the encrypt command
Kernel operations, such as IPsec
For example, a DES mechanism that is applied to authentication, such as CKM_DES_MAC, is a separate mechanism from a DES mechanism that is applied to encryption, CKM_DES_CBC_PAD.
Metaslot – Is a single slot that presents a union of the capabilities of other slots which are loaded in the framework. The metaslot eases the work of dealing with all of the capabilities of the providers that are available through the framework. When an application that uses the metaslot requests an operation, the metaslot figures out which actual slot should perform the operation. Metaslot capabilities are configurable, but configuration is not required. The metaslot is on by default. To configure the metaslot, see the cryptoadm(1M) man page.
Mode – Is a version of a cryptographic algorithm. For example, CBC (Cipher Block Chaining) is a different mode from ECB (Electronic Code Book). The AES algorithm has two modes, CKM_AES_ECB and CKM_AES_CBC.
Policy – Is the choice, by an administrator, of which mechanisms to make available for use. By default, all providers and all mechanisms are available for use. The disabling of any mechanism would be an application of policy. The enabling of a disabled mechanism would also be an application of policy.
Examples of providers include:
PKCS #11 libraries, such as pkcs11_softtoken.so
Modules of cryptographic algorithms, such as aes and arcfour
Device drivers and their associated hardware accelerators, such as the mca driver for the Sun Crypto 6000 accelerator
Slot – Is an interface to one or more cryptographic devices. Each slot, which corresponds to a physical reader or other device interface, might contain a token. A token provides a logical view of a cryptographic device in the framework.