1OPENCRYPTOKI.CONF(5) openCryptoki OPENCRYPTOKI.CONF(5)
2
6 opencryptoki.conf - Configuration file for pkcsslotd.
7
10 pkcsslotd uses a configuration file at /etc/opencryptoki/opencryp‐
11 toki.conf
12 This is a text file that contains information used to configure pkcs#11
14 slots. At startup, the pkcsslotd daemon parses this file to determine
15 which slots will be made available.
16
19 This file is made up of optional global definitions, and slot descrip‐
20 tions.
21 The following global definitions are valid:
23 disable-event-support
26 If this keyword is specified the openCryptoki event support is
27 disabled.
28 statistics (off|on[,implicit][,internal])
31 Enables or disables collection of statistics of mechanism usage.
32 By default, statistics collection is enabled. A value of (off)
33 disables all statistics collection. A value of (on) enables col‐
34 lection of mechanism usage. The collected statistics can be
35 displayed using the pkcsstats tool.
36 In addition to enabling statistics collection for mechanisms
38 used by PKCS#11 applications, you can specify (on,implicit) to
39 also enable collection of implicit mechanism usage, where addi‐
40 tional mechanisms are specified in mechanism parameters. For ex‐
41 ample, RSA-PSS or RSA-OAEP allow to specify a hash mechanism and
42 a mask generation function (MGF) in the mechanism parameter.
43 ECDH allows to specify a key derivation function (KDF) in the
44 mechanism parameter.
45 You can additionally enable statistics collection of mechanisms
47 internally used by Opencryptoki by specifying (on,internal).
48 This additionally collects usage statistics for crypto opera‐
49 tions used internally for pin handling and encryption of private
50 token objects in the data store.
51 Implicit and internal statistics collection can also be com‐
53 bined: (on,implicit,internal)
54 Each slot description is composed of a slot number, brackets and key-
57 value pairs.
58 slot number
60 {
61 key = value
62 ...
63 }
64 More than one key-value pair may be used within a slot description.
66 A key-value pair is composed of, keyword = value.
68 The following keywords are valid:
70 description
73 A Description of the slot. PKCS#11v2.20 defined this as a
74 64-byte max character-string.
75 stdll This keyword is used to define the name of the stdll or token
77 library that will be used for this slot. The stdll is an avail‐
78 able token library in opencryptoki.
79 manufacturer
81 This keyword is used to name the ID of the slot manufacturer.
82 PKCS#11v2.20 defines this as a 32 byte long string.
83 hwversion
85 Version number of the slot's hardware, if any. The version num‐
86 ber is composed of a major version number (the integer portion
87 of the version) and a minor version number (the hundredths por‐
88 tion of the version). For example, version 1.2, major = 1, mi‐
89 nor = 2
90 firmwareversion
92 Version number of the slot's firmware, if any. The version num‐
93 ber is composed of a major version number (the integer portion
94 of the version) and a minor version number (the hundredths por‐
95 tion of the version).
96 confname
98 If the slot is associated with a token that has its own configu‐
99 ration file, this option identifies the name of that configura‐
100 tion file. For example, confname=ep11tok.conf
101 tokname
103 If a token want to have its own token directory name that is
104 different from the default name, especially if multiple tokens
105 of the same type are configured, this option defines the name of
106 the token individual directory. For example, tokname=ep11tok01
107 Note: This key-value pair is optional: If only one token per to‐
109 ken type is used, you don't need that entry. In that case the
110 default directory name is used.
111 tokversion
113 Version number of the slot's token of the form <major>.<minor>.
114
117 The pound sign ('#') is used to indicate a comment. Both the comment
118 character and any text after it, up to the end of the line, are ig‐
119 nored. The comment character cannot be used inside the brackets of slot
120 descriptions, as this will cause a syntax error.
121
124 opencryptoki(7),
125 pkcsslotd(8),
126 pkcsstats(1),
1273.21.0 September 2012 OPENCRYPTOKI.CONF(5)