OPENCRYPTOKI.CONF(5)

💖 opencryptoki.conf — the config file for pkcsslotd 💖

okay bestie, so this is a section 5 manpage from the openCryptoki manual set, and it's literally just the glow-up guide for one config file. it's giving "small file, big power". let's get into it 🎀

---

✨ NAME ✨

opencryptoki.conf — the configuration file for pkcsslotd. that's it, that's the name, no notes 💅

---

🌸 DESCRIPTION 🌸

so pkcsslotd reads its config from exactly one place, and that place is:

/etc/opencryptoki/opencryptoki.conf

it's a plain text file, bestie. nothing fancy, no weird binary nonsense, just vibes. and what it holds is all the info used to configure pkcs#11 slots. when the pkcsslotd daemon starts up, it parses this file to figure out which slots are gonna be made available. periodt.

---

🦋 SYNTAX 🦋

the file is made up of optional global definitions and then slot descriptions. two flavors, one file, we love a multitasker 💅

🌟 global definitions 🌟

here are the global definitions that are valid, queen:

• disable-event-support — if you drop this keyword in, openCryptoki's event support gets disabled. just like that. poof. 🙈
• statistics (off|on[,implicit][,internal]) — turns collection of statistics of mechanism usage on or off. by default, statistics collection is enabled (iconic of it). a value of (off) disables all statistics collection. a value of (on) enables collection of mechanism usage. and once you've collected all those gorgeous stats, you can view them with the pkcsstats tool ✨

so on top of enabling stats collection for mechanisms used by PKCS#11 applications, you can also specify (on,implicit) to additionally enable collection of implicit mechanism usage — that's where extra mechanisms get specified in the mechanism parameters. for example, RSA-PSS or RSA-OAEP let you specify a hash mechanism and a mask generation function (MGF) in the mechanism parameter. and ECDH lets you specify a key derivation function (KDF) in the mechanism parameter. sneaky but slay.

you can also additionally enable stats collection for mechanisms used internally by Opencryptoki by specifying (on,internal). this one additionally collects usage statistics for crypto operations used internally for pin handling and encryption of private token objects in the data store. lowkey important.

and yes bestie, implicit and internal collection can be combined: (on,implicit,internal) — have it all, you deserve it 👑

🎀 slot descriptions 🎀

each slot description is composed of a slot number, brackets, and key-value pairs. the shape is:

 slot number
 {
     key = value
     ...
 }

more than one key-value pair may be used inside a slot description. stack 'em, it's fine.

and a key-value pair is composed of keyword = value. that's the whole recipe 🍓

the valid keywords (all of them, no skips)

• description — a description of the slot. PKCS#11v2.20 defined this as a 64-byte max character-string. keep it cute and keep it short.
• stdll — this keyword defines the name of the stdll or token library that's gonna be used for this slot. the stdll is an available token library in opencryptoki.
• manufacturer — names the ID of the slot manufacturer. PKCS#11v2.20 defines this as a 32 byte long string.
• hwversion — the version number of the slot's hardware, if any. it's composed of a major version number (the integer portion of the version) and a minor version number (the hundredths portion of the version). for example, version 1.2 → major = 1, minor = 2. math but make it fashion 💅
• firmwareversion — the version number of the slot's firmware, if any. same deal: a major version number (the integer portion) and a minor version number (the hundredths portion).
• confname — if the slot is associated with a token that has its own configuration file, this option identifies the name of that configuration file. for example, confname=ep11tok.conf ✨
• tokname — if a token wants to have its own token directory name that's different from the default name — especially if multiple tokens of the same type are configured — this option defines the name of the token individual directory. for example, tokname=ep11tok01

Note: this key-value pair is optional! if only one token per token type is used, you don't need that entry. in that case, the default directory name is used. no stress 🫶

• tokversion — the version number of the slot's token, of the form <major>.<minor>.
• usergroup — specifies the name of a user group that's set as the owner of the token directory. only users that are members of this group have access to the token and its objects. users who aren't members of this group will not see the token as being available (e.g. via pkcsconf -t or via C_GetTokenInfo). and heads up: all users that are members of this group must also be members of the pkcs11 group to be able to use Opencryptoki. double membership, double the vibes.

Note: this key-value pair is optional! if it's not specified, the token belongs to the pkcs11 group. 💜

---

🧚 Notes 🧚

the pound sign ('#') is used to indicate a comment. both the comment character and any text after it, up to the end of the line, are ignored. cute, clean, gone. ✨

⚠️ but bestie, listen: the comment character cannot be used inside the brackets of slot descriptions, because that will cause a syntax error. do not do it. i'm begging. 😭

---

👀 SEE ALSO 👀

go read these too, they're all in the family:

• opencryptoki(7)
• pkcsslotd(8)
• pkcsstats(1)

---

and that's the whole page, no cap 💖 this was the openCryptoki manual, version 3.27.0, dated September 2012 — yeah she's vintage but she still ate, fr fr. go configure those slots, main character 🎀✨🦋