security - PKCS11 中的 "mechanism"是什么？

Question

机制在PKCS11中是什么意思？例如:CKM_RSA_PKCS。

机制(CKM_RSA_PKCS)和签名算法(NoneWithRSA)有什么区别？

Answer 1

机制是描述加密操作的常量值。例如，CKM_RSA_PKCS 在 PKCS #11 手册中定义为:

The PKCS #1 v1.5 RSA mechanism, denoted CKM_RSA_PKCS, is a multi-purpose mechanism based on the RSA public-key cryptosystem and the block formats initially defined in PKCS #1 v1.5. It supports single-part encryption and decryption; single-part signatures and verification with and without message recovery; key wrapping; and key unwrapping. This mechanism corresponds only to the part of PKCS #1 v1.5 that involves RSA; it does not compute a message digest or a DigestInfo encoding as specified for the md2withRSAEncryption and md5withRSAEncryption algorithms in PKCS #1 v1.5.

注意“多用途”子句 - 这种单一机制可用于加密/解密以及签名/验证。

Java 机制NoneWithRSA 是defined as :

The RSA signature algorithm which does not use a digesting algorithm (e.g. MD5/SHA1) before performing the RSA operation. For more information about the RSA Signature algorithms, please see PKCS1.

Java 机制仅适用于签名。

根据描述，Java 中使用 NoneWithRSA 计算的签名似乎等同于使用 CKM_RSA_PKCS 在 PKCS #11 中计算的签名。