Components of the Cryptographic Framework

The components of the cryptographic framework are described as follows.

• libpkcs11.so – The framework provides access through the RSA Security Inc. PKCS#11 Cryptographic Token Interface (Cryptoki). Applications need to link to the libpkcs11.so library, which implements the RSA PKCS#11 v2.11 of the standard.

• Pluggable interface – The pluggable interface is the service provider interface (SPI) for PKCS #11 cryptographic services that are provided by Sun Microsystems, Inc. and third-party developers. Providers are user-level libraries. Providers are implemented through encryption services that are available from either hardware or software.

• pkcs11_softtoken.so – A private shared object that contains user-level cryptographic mechanisms that are provided by Sun Microsystems, Inc. The pkcs11_softtoken(5) library implements the RSA PKCS#11 v2.11 of the standard.

• pkcs11_kernel.so – The private shared object used to access kernel-level cryptographic mechanisms. pkcs11_kernel(5) implements the RSA PKCS#11 v2.11 specification. pkcs11_kernel.so offers a PKCS#11 user interface for cryptographic services that are plugged into the kernel's service provider interface.

• /dev/crypto pseudo device driver – The private pseudo device driver for using kernel-level cryptographic mechanisms. This information is provided to avoid inadvertent deletion of the pseudo device driver.

• Scheduler / load balancer – The kernel software that is responsible for coordinating use, load balancing, and dispatching of the cryptographic service requests.

• Kernel programmer interface – The interface for kernel-level consumers of cryptographic services. The IPSec protocol and the kerberos GSS mechanism are typical cryptographic consumers.

  ---

  Note –

  This interface is only available through a special contract with Sun Microsystems, Inc. Send email to solaris-crypto-api@sun.com for more information.

  ---

• Service provider interface – The SPI for providers of kernel-level cryptographic services. These services can be implemented on either hardware or software. To use the SPI, a provider must import special routines from the Solaris kernel. These routines enable modules and device drivers to register and remove services. The routines also notify the framework about changes in state. The framework also requires that providers export certain routines. The exported routines enable consumers and other components of the cryptographic framework to send requests to the provider.

• Sun HW and SW cryptographic providers – Kernel-level cryptographic services that are provided by Sun Microsystems, Inc. HW refers to hardware cryptographic services such as accelerator boards. SW refers to kernel modules that provide cryptographic services, such as an implementation of a cryptographic algorithm.

• Kernel cryptographic framework daemon – The private daemon that is responsible for managing system resources for cryptographic operations. The daemon is also responsible for verifying cryptographic providers.

• Module verification library – A private library used to verify the integrity and authenticity of all binaries that the Solaris cryptographic framework is importing.

• elfsign – A utility offered to third-party providers of cryptographic services. elfsign is used to request certificates from Sun. elfsign also enables providers to actually sign the binaries, that is, elf objects that plug into the Solaris cryptographic framework.

• /dev/cryptoadm pseudo device driver – The private pseudo device driver used by cryptoadm(1M) for administering kernel-level cryptographic mechanisms. This information is provided to avoid inadvertent deletion of the pseudo device driver.

• cryptoadm – A user-level command for administrators to manage cryptographic services. A typical cryptoadm task is listing cryptographic providers and their capabilities. Disabling and enabling cryptographic mechanisms according to security policy is also performed with cryptoadm.