在 CAPI/CNG 中替换 PKCS #11 智能卡数据 Object

Question

There are 3 main PKCS #11 objects (Key, Certificate, Data), I found replacement for key and certificate objects in CAPI/CNG, but I didn't found replacement for creating data object on smart card using CAPI/CNG

PKCS #11 Data Object documentation here https://www.cryptsoft.com/pkcs11doc/v220/group__SEC__10__5__DATA__OBJECTS.html

Answer 1

PKCS#11 or rather Cryptoki is a specification to control a secure token. Sometimes it can make sense to store other sensitive data such as password in a token. Furthermore, sometimes data is used to interact with schemes themselves, such as the "Info" parameter for key derivation functions, although commonly such data is provided as parameter to the PKCS#11 method invocation.

CAPI/CNG is much more oriented towards providing cryptographic operations for applications. It makes kind of sense that generic data objects are not supported; such objects can already be present in the software itself after all. As such, it is less need to store it on a secure device. If there is a method to retrieve such data from a secure token then I haven't seen it.