Cryptographic Token Interface Standard

PKCS#11


Case 1: Generation of OTP values

figure_1.gif
Figure 1: Retrieving OTP values through C_Sign

Figure 1 shows an integration of PKCS #11 into an application that needs to authenticate users holding OTP tokens. In this particular example, a connected hardware token is used, but a software token is equally possible. The application invokes C_Sign to retrieve the OTP value from the token. In the example, the application then passes the retrieved OTP value to a client API that sends it via the network to an authentication server. The client API may implement a standard authentication protocol such as RADIUS [RFC 2865] or EAP [RFC 3748], or a proprietary protocol such as that used by RSA Security's ACE/AgentTM software.


RSA Security Inc. Public-Key Cryptography Standards - PKCS#11 - v230mechanism1