Note the following descriptions of concepts and corresponding examples that are useful when working with the Cryptographic Framework.
Algorithms – Cryptographic algorithms are established, recursive computational procedures that encrypt or hash input. Encryption algorithms can be symmetric or asymmetric. Symmetric algorithms use the same key for encryption and decryption. Asymmetric algorithms, which are used in public-key cryptography, require two keys. Hashing functions are also algorithms.
Examples of algorithms include:
Symmetric algorithms, such as AES and ECC
Asymmetric algorithms, such as Diffie-Hellman and RSA
Hashing functions, such as SHA256
Consumers – Users of the cryptographic services that come from providers. Consumers can be applications, end users, or kernel operations.
Examples of consumers include:
Applications, such as IKE
End users, such as a regular user who runs the encrypt command
Kernel operations, such as IPsec
Keystore – In the Cryptographic Framework, persistent storage for token objects, often used interchangeably with token. For information about a reserved keystore, see Metaslot in this list of definitions.
Mechanism – The Application of a mode of an algorithm for a particular purpose.
For example, a DES mechanism that is applied to authentication, such as CKM_DES_MAC, is a separate mechanism from a DES mechanism that is applied to encryption, CKM_DES_CBC_PAD.
Metaslot – A single slot that presents a union of the capabilities of other slots which are loaded in the framework. The metaslot eases the work of dealing with all of the capabilities of the providers that are available through the framework. When an application that uses the metaslot requests an operation, the metaslot determines which actual slot will perform the operation. Metaslot capabilities are configurable, but configuration is not required. The metaslot is on by default. For more information, see the cryptoadm (1M) man page.
The metaslot does not have its own keystore. Rather, the metaslot reserves the use of a keystore from one of the actual slots in the Cryptographic Framework. By default, the metaslot reserves the Sun Crypto Softtoken keystore. The keystore that is used by the metaslot is not shown as one of the available slots.
Users can specify an alternate keystore for metaslot by setting the environment variables ${METASLOT_OBJECTSTORE_SLOT} and ${METASLOT_OBJECTSTORE_TOKEN}, or by running the cryptoadm command. For more information, see the libpkcs11 (3LIB) , pkcs11_softtoken (5) , and cryptoadm (1M) man pages.
Mode – A version of a cryptographic algorithm. For example, CBC (Cipher Block Chaining) is a different mode from ECB (Electronic Code Book). The AES algorithm has two modes: CKM_AES_ECB and CKM_AES_CBC.
Policy – The choice, by an administrator, of which mechanisms to make available for use. By default, all providers and all mechanisms are available for use. The enabling or disabling of any mechanism would be an application of policy. For examples of setting and applying policy, see Administering the Cryptographic Framework.
Providers – Cryptographic services that consumers use. Providers plug in to the framework, so are also called plugins.
Examples of providers include:
PKCS #11 libraries, such as /var/user/$USER/pkcs11_softtoken.so
Modules of cryptographic algorithms, such as aes and arcfour
Device drivers and their associated hardware accelerators, such as the mca driver for the Sun Crypto Accelerator 6000
Slot – An interface to one or more cryptographic devices. Each slot, which corresponds to a physical reader or other device interface, might contain a token. A token provides a logical view of a cryptographic device in the framework.
Token – In a slot, a token provides a logical view of a cryptographic device in the framework.