PKCS#11.

A standard C API, also called Cryptoki, that lets applications use cryptographic tokens such as hardware security modules and smart cards without depending on a vendor-specific driver. It belongs to the Cryptography category of cybersecurity.

A standard C API, also called Cryptoki, that lets applications use cryptographic tokens such as hardware security modules and smart cards without depending on a vendor-specific driver.

PKCS#11 (Public-Key Cryptography Standard #11), originally published by RSA Laboratories and now maintained by OASIS, defines a platform-independent C interface, Cryptoki, for accessing cryptographic tokens. The token exposes slots, sessions, and objects (keys, certificates, data), with operations such as C_Sign, C_Encrypt, C_Wrap, and C_DeriveKey performed inside the device so private keys never leave it. PKCS#11 is the de-facto standard for talking to HSMs, smart cards, and TPM-backed stores from TLS servers (OpenSSL via pkcs11-provider), PKI software, code-signing pipelines, and KMIP clients. The current version, PKCS#11 v3.1, adds modern algorithms such as Ed25519, EdDSA, and post-quantum primitives.

Defences for PKCS#11 typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cryptoki, PKCS11.