System Management Guide: Operating System and Devices

PKCS #11 Overview

Note: The information in this section is specific to the POWER-based platform.

The PKCS #11 subsystem provides applications a method for accessing hardware devices (tokens) in a device neutral manner. The content in this document conforms to Version 2.01 of the PKCS #11 standard.

This subsystem has been implemented using three components:

• A slot manager daemon (pkcsslotd) which provides the subsystem with information regarding the state of available hardware devices. This daemon is started automatically during installation and when the system is rebooted.
• An API shared object (/usr/lib/pkcs11/pkcs11_API.so) is provided as a generic interface to the adapters for which PKCS #11 support has been implemented.
• An adapter specific library which provides the PKCS #11 support for the adapter. This tiered design allows the user to easily use new PKCS #11 devices when they come available with no recompilations of existing applications.

IBM 4758 Model 2 Cryptographic Coprocessor

The IBM 4758 Model 2 Cryptographic Coprocessor provides a secure computing environment. Before attempting to configure the PKCS #11 subsystem, verify that the adapter has been properly configured with a supported microcode.

Verifying the IBM 4758 Model 2 Cryptographic Coprocessor for use with the PKCS #11 subsystem

The PKCS #11 subsystem is designed to automatically detect adapters capable of supporting PKCS #11 calls during installation and at reboot. For this reason, any IBM 4758 Model 2 Cryptographic Coprocessor which is not properly configured will not be accessible from the PKCS #11 interface and calls sent to the adapter will fail. Complete the following to verify that your adapter is set up correctly:

1. Ensure that the software for the adapter is properly installed using the following command:

   lsdev -Cc adapter | grep crypt
   

   If the IBM 4758 Model 2 Cryptographic Coprocessor does not show in the resulting list, check that the card is seated properly and that the supporting software is correctly installed.

2. Determine that the proper firmware has been loaded onto the card using the csufclu utility:

   csufclu /tmp/l ST device_number_minor 
   

   Verify that the Segment 3 Image has the PKCS #11 Application loaded. If it is not loaded refer to the adapter specific documentation to obtain the latest microcode and installation instructions.

   Note: If this utility is not available, then the supporting software has not been installed.