communication between native PKCS11 implementation and Smart card

Question

I am digitally signing a file by using Smart card on java platform. Syntactically, I am getting the flow of code and other things too. But my problem is how native PKCS11 implementation is communicating with smart card or vice versa(That thing I don't know).

I want to know internal flow. I have googled it alot but did not get internal communication flow (I am getting code only). Can anyone give me some link or reference or some class diagram.

Answer 1

I got some brief idea by going through this PDF

ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/v2-30/TUT-M51_Griffin_PKCS11.pdf

But still i did not get the whole flow .For this, I think i need to go deeper and deeper in the sea of PKCS#11 ;)

Answer 2

PKCS#11 is an API definition in C to use cryptographic tokens. It explicitly does not specify any implementation details of these cryptographic tokens. In principle any security and software module may be represented by a PKCS#11 interface. So it depends completely on the PKCS#11 middleware on how the smart card is accessed. The same goes for things as logging by the PKCS#11 module - PKCS#11 does not specify how logging is performed.

Now most smart cards that are used for signature generation are compatible with at least ISO 7816-4 (which defines which APDU's may be used to read/write to the card and how some cryptographic APDU's may be used). Futhermore, they may implement ISO 7816-15 (a slightly different version of PKCS#15), which is a quite complex standard to find files and objects (such as keys) on the card. Normally these cards are accessed through PCSC, so it is best to try and get a log of the PCSC or smart card reader driver API calls.

With Java you can also directly use the card through javax.smartcardio which implements ISO 7816-4 compatible transport over PCSC. In that case you will have to implement the entire application level interface to the smart card though.

This is unfortunately a long text to say that this all depends on the implementation of the PKCS#11 library and the smart card.