DMCA
On the Security of PKCS #11 (2003)
| Venue: | IN PROCEEDINGS OF THE 5TH INTERNATIONAL WORSHOP ON CRYPTOGRAPHIC HARDWARE AND EMBEDDED SYSTEMS (CHES’03), VOLUME 2779 OF LNCS |
| Citations: | 37 - 1 self |
BibTeX
@INPROCEEDINGS{Clulow03onthe,
author = {Jolyon Clulow},
title = {On the Security of PKCS #11},
booktitle = {IN PROCEEDINGS OF THE 5TH INTERNATIONAL WORSHOP ON CRYPTOGRAPHIC HARDWARE AND EMBEDDED SYSTEMS (CHES’03), VOLUME 2779 OF LNCS},
year = {2003},
pages = {411--425},
publisher = {Springer-Verlag}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Public Key Cryptography Standards (PKCS) #11 has gained wide acceptance within the cryptographic security device community and has become the interface of choice for many applications. The high esteem in which PKCS #11 is held is evidenced by the fact that it has been selected by a large number of companies as the API for their own devices. In this paper we analyse the security of the PKCS #11 standard as an interface (e.g. an application-programming interface (API)) for a security device. We show that PKCS #11 is vulnerable to a number of known and new API attacks and exhibits a number of design weaknesses that raise questions as to its suitability for this role. Finally we present some design solutions.
