DoD CAC Middleware Requirements - IDManagement.gov

Appendix C- PKCS 11 Functions
The P11 module should be compatible with at least Version 2.11 of the cryptoki header files
available at: http://www.rsasecurity.com/rsalabs/pkcs/pkcs-11/index.html.
Note: DoD understands during the development of this document, a newer version was released,
but version 2.11 is still widely used so is a minimum requirement.
The PKCS#11 registry setting shall identify the vendor and the fully qualified path of the DLL
that supports the PKCS#11 interface.
Key
[HKEY_LOCAL_MACHINE\SOFTWARE\GSC\Cryptography\PKCS#11\
Key Values Type Setting Default Setting
“PKCS#11DLL” String N/A
“Vendor” String N/A
Setting Description
Fully qualified path to the PKCS11 DLL
Vendor’s full name.
Example
[HKEY_LOCAL_MACHINE\SOFTWARE\GSC\Cryptography\PKCS#11\Vendor1]
”PKCS#11DLL”=”c:\windows\system32\pkcs11.dll”
“Vendor”=”Middleware Vendor 1”
Figure 9
PKCS#11 Test Inputs
CK_ATTRIBUTE one[7], two[7], three[7]; two[3].type = CKA_MODIFIABLE;
CK_OBJECT_CLASS cko_data =
CKO_DATA;
two[3].pValue = &__true;
CK_BBOOL __false = CK_FALSE, __true = two[3].ulValueLen =
CK_TRUE;
sizeof(CK_BBOOL);
char *key = "TEST PROGRAM"; two[4].type = CKA_LABEL;
CK_ULONG key_len = strlen(key); two[4].pValue = "Test data object two";
one[0].type = CKA_CLASS; two[4].ulValueLen = strlen((const
char*)two[4].pValue);
one[0].pValue = &cko_data; two[5].type = CKA_APPLICATION;
one[0].ulValueLen =
sizeof(CK_OBJECT_CLASS);
two[5].pValue = key;
UNCLASSIFIED 30