Nss; Pkcs #11 - Netscape MANAGEMENT SYSTEM 6.1 - ADMINISTRATOR Administrator's Manual

System Architecture
http://www.mozilla.org/projects/security/pki/jss/index.html

NSS

Network Security Services (NSS) is a set of libraries designed to support
cross-platform development of security-enabled communications applications.
Applications built with the NSS libraries support the SSL protocol for
authentication, tamper detection, and encryption as well as the PKCS #11 interface
for cryptographic token interfaces. Netscape uses NSS to support these features in
a wide range of products, including CMS. NSS documentation can be found
on-line at:
http://www.mozilla.org/projects/security/pki/nss/overview.html

PKCS #11

Public-Key Cryptography Standard (PKCS) #11 specifies an API used to
communicate with devices that hold cryptographic information and perform
cryptographic operations. Because it supports PKCS #11, CMS works with a wide
range of hardware and software devices intended for such purposes.
One or more PKCS #11 modules must be available to any CMS subsystem instance.
As shown in the figure, a PKCS #11 module (also called a cryptographic module or
cryptographic service provider) manages cryptographic services such as
encryption and decryption via the PKCS #11 interface. PKCS #11 modules can be
thought of as drivers for cryptographic devices that can be implemented in either
hardware or software. Netscape provides a built-in PKCS #11 module with CMS.
A PKCS #11 module always has one or more slots, which can be implemented as
physical hardware slots in some form of physical reader (for example, for smart
cards) or as conceptual slots in software. Each slot for a PKCS #11 module can in
turn contain a token, which is the hardware or software device that actually
provides cryptographic services and optionally stores certificates and keys.
Netscape provides two built-in modules with CMS:
• Default Netscape Internal PKCS #11 Module. This comes with two built-in
tokens:
62 Netscape Certificate Management System Administrator's Guide • February 2003
The Internal Crypto Services token performs all cryptographic operations,
such as encryption, decryption, and hashing.