This integration guide explains how to use the PKCS#11 cryptography standard with Utimaco Hardware Security Module (HSM) from the PKCS11Interop API .NET.
Motivation
Utimaco IS GmbH provides its clients with a hardware technology concept; however, it is not always clear if a client's specific application would be able to communicate with the Utimaco HSM properly. In this guide we introduce a solution to one instance of this problem, namely how to use the PKCS#11 standard with the HSM from a C# application using an open source PKCS11Interop interface [1].
Concepts
PKCS11Interop is a wrapper library written in C# that allows .NET application developers to use full power of PKCS#11 standard. It is an interface between a .NET application and a PKCS#11 vendor library, where the latter directly communicates to the HSM device. The complete communication pipeline between a .NET application and the Utimaco HSM device is explained below.
PKCS11Interop library consists of two sets of APIs: LowLevelAPI and HighLevelAPI. The former has following characteristics:
-
Provides a developer with a full power of PKCS#11 C API.
-
Requires C style coding.
whereas the latter has these characteristics:
-
Built on top of LowLevelAPI.
-
Provides a developer with a friendly .NET API.
As already mentioned, PKCS11Interop is considered to be a wrapper library, which implements the conventional programming pattern also known as Wrapper or Adapter. Whenever any friendly HighLevelAPI method is invoked from a particular .NET application, the corresponding LowLevelAPI method is implicitly invoked. The latter call is followed by the corresponding PKCS#11 C function call, which is the vendor specific function implementation of the cryptography standard. In such a way end-to-end connection between any .NET application and the Utimaco HSM device is set up.
More information about this library can be found under this link: http://www.pkcs11interop.net/.