Functions
The following sections list the PKCS #11 functions supported by the nShield PKCS #11 library. For a list of supported mechanisms, see Mechanisms.
| Certain functions are included in PKCS #11 version 2.40 for compatibility with earlier versions only. |
Choosing functions
Some PKCS #11 applications enable you to choose which functions you want to perform on the PKCS #11 token and which functions you want to perform in your application.
The following paragraphs in this section describe the functions that an nShield HSM can provide.
Generating random numbers and keys
The nShield HSM includes a hardware random number generator. A hardware random number generator provides greater security than the pseudo-random number generators provided by host computers. Therefore, always use the nShield HSM to generate random numbers and keys.
Digital signatures
The nShield PKCS #11 library can use the nShield HSM to sign and verify messages using the following algorithms:
-
DSA
-
RSA
-
DES3_MAC
-
AES
-
ECDSA (if the appropriate feature is enabled)
An nShield hardware security module is specifically optimized for public key algorithms, and therefore it will provide significant acceleration for DSA, RSA and ECDSA signature generation and verification. You should always choose to perform asymmetric signature generation and verification with an nShield HSM.
Asymmetric encryption
The nShield PKCS #11 library can use an nShield HSM to perform asymmetric encryption and decryption with the RSA algorithm.
The nShield HSM is specifically optimized for asymmetric algorithms, so you should always choose to perform asymmetric operations with the nShield HSM.
Symmetric encryption
The nShield PKCS #11 library can use the nShield HSM to perform symmetric encryption with the following algorithms:
-
DES
-
Triple DES
-
AES
Because of limitations on throughput, these operations can be slower on the nShield HSM than on the host computer. However, although the nShield HSM may be slower than the host under a light load, you may find that under a heavy load the advantage gained from off-loading the symmetric cryptography (which frees the host CPU for other tasks) means that you achieve better overall performance.
Message digest
The nShield PKCS #11 library can perform message digest operations with MD5, SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 algorithms. However, for reasons of throughput, the library performs these operations on the host computer.
Mechanisms
The mechanisms currently supported by the nShield PKCS #11 library, including some vendor-supplied mechanisms, are listed in Mechanisms.