This section provides an overview of the TIMA CCM keystore support for the PKCS #11 API.

About support for PKCS 11 APIs

This topic describes how the TIMA CCM Keystore works with the Public Key Cryptography Standard (PKCS) 11 APIs.

The TIMA CCM Keystore supports proprietary interfaces to perform the following:

• Install encrypted PKCS 8 private key/certificate files
• Request for TrustZone key pair generation followed by certificate signing request issuance
• Access default, pre-installed, client certificates which are signed by the device root key

Once the Keystore creates the keys, the keys are never seen in the normal world. One can only exercise these keys using the standard PKCS 11 cryptographic token standard, which mandates password-based logins for sensitive cryptographic operations.

About PKCS 11 API standard

There are many portable devices out there like Smartcards, CAC cards, PCMCIA cards and so on. which have the ability to store keys securely, under the control of a single user. With such devices, sensitive private keys never leave the device and cryptographic operations are performed on the card itself. PKCS 11 standard is a standard programming interface to talk to such cards.

At the native layer, the PKCS 11 interfaces are exposed and implemented by the shared library libtlc_tz_ccm.so. Any PKCS 11 crypto-key library has a static CK_FUNCTION_LIST structure and a pointer to it can be obtained by the C_GetFunctionList function. This function is in the TZ CCM PKCS 11 library is named TZ_CCM_C_GetFunctionList.

The table below summarizes the list of supported PKCS 11 interfaces. The return values and API behaviors are compliant with the PKCS 11 standard and the library expects the caller to use them in a standard way.

The following PKCS 11 interfaces are not supported:

• C_InitToken
• C_InitPIN, C_SetPIN
• C_UnwrapKey, C_WrapKey
• C_SeedRandom, C_GenerateRandom
• C_DeriveKey, C_GenerateKey, C_GenerateKeyPair
• C_SetAttributeValue, C_SetOperationState
• C_WaitForSlotEvent
• C_CancelFunction
• C_CloseAllSessions
• C_GetMechanismList, C_GetMechanismInfo
• C_GetOperationState
• C_GetInfo, C_GetSessionInfo, C_GetSlotInfo, C_GetTokenInfo
• C_CreateObject, C_CopyObject, C_DestroyObject, C_GetObjectSize

Also, none of the crypto UPDATE/FINAL operations, such as C_DigestUpdate or C_DigestFinal, are supported.

Supported cryptographic formats in the TIMA Keystores

The following encryption formats are supported by the TIMA Keystore.