In Focus

// Research series

PKCS #11 Key Policy

How handles, attributes and mechanisms determine what a token-held key can actually do.

2-part series · Read in order

// Reading path

From first question to final consequence.

All series →
  1. Part 1The handle is not the key.PKCS #11 gives applications a common view of cryptographic devices. The key's policy, lifecycle and operational meaning still depend on what lies behind the handle.
  2. Part 2Audit the attributes, not the datasheet.PKCS #11 key policy is expressed through attributes and mechanisms inside the token. An inventory can reveal permissions that a product datasheet cannot.
The handle is not the key.

The handle is not the key.

by | Jun 10, 2026 | Research

CRYPTOGRAPHIC TOKENS What PKCS #11 abstracts, and what it leaves to the token. An application asks a PKCS #11 module to sign with a key handle. The call succeeds. No private value crosses the interface. That compact description is one of the standard’s...
Audit the attributes, not the datasheet.

Audit the attributes, not the datasheet.

by | Jun 15, 2026 | Research

PKCS #11 POLICY The policy behind the handle is readable, and almost nobody reads it. The earlier article argued that a PKCS #11 handle tells an application nothing about what the key behind it is permitted to do. That is a design observation. This one is about the...