KRYOPTIC(7)

✨ KRYOPTIC ✨ (section 7, Miscellaneous Information Manual, bestie)

okay so listen. this is the kryoptic page from the Miscellaneous Information Manual, section 7, and it's literally about a PKCS#11 soft token written in Rust. yes we're doing crypto library lore today. grab a boba. 🧋💖

---

🌸 NAME 🌸

kryoptic — a PKCS#11 soft token written in Rust 🦀

---

🎀 SYNOPSIS 🎀

libkryoptic_pkcs11.so

that's it. that's the whole synopsis. she's a shared object and she's thriving. 💅

---

🦋 DESCRIPTION 🦋

Kryoptic is a PKCS#11 software token implemented in Rust. bestie it is so Rust. 🦀

It utilizes OpenSSL for cryptographic operations, and it provides support for multiple storage backends, including SQLite and NSS DB. periodt.

It's distributed as a dynamic library — libkryoptic_pkcs11.so — which can be loaded by applications that are out here expecting a standard PKCS#11 module. so like, if your app speaks PKCS#11, kryoptic is ready to be its main character. ✨

Kryoptic aims to provide a modern, secure, and flexible software token. no cap. It can be built to use the system OpenSSL dynamically, or it can be statically linked. your choice, your vibe. 🫶

It also includes support for FIPS 140-3 builds (when linked against OpenSSL's libfips.a), which restricts algorithms and enforces FIPS approved behaviors. so if you're in a FIPS situation, she knows. 👑

---

💖 INITIALIZATION 💖

Applications initialize the Kryoptic token via the standard PKCS#11 C_Initialize() function. iconic. standard. we love a spec-compliant entrance. 💅

Kryoptic can process custom configurations passed through the reserved argument in C_Initialize(), which allows for flexible initialization methods:

• Config file path: e.g., kryoptic_conf=/path/to/config.toml
• Legacy SQLite path: e.g., /path/to/database.sql
• NSS config directory: e.g., configDir=/etc/pki/nssdb

If no explicit arguments are provided, Kryoptic falls back to searching for its TOML configuration file in predefined system and user locations. she'll go looking for her own little config. independent queen. 🧚

---

🌈 ENVIRONMENT VARIABLES 🌈

Several environment variables affect the runtime behavior of Kryoptic. here's the roster, bestie, they all matter:

• KRYOPTIC_CONF — The path to the Kryoptic configuration file. This one has the highest precedence, so she speaks first, always. 👑
• XDG_CONFIG_HOME — Used as a fallback if KRYOPTIC_CONF is not set. Kryoptic will look for ${XDG_CONFIG_HOME}/kryoptic/token.conf. 🦋
• HOME — Used as a fallback if XDG_CONFIG_HOME is not set. Kryoptic will look for ${HOME}/.config/kryoptic/token.conf. 🏠💜
• KRYOPTIC_EC_POINT_ENCODING — Can be used to override the default ec_point_encoding specified in the configuration file. Valid values are BYTES or DER. pick one, bestie, those are the options fr fr.

---

⭐ SEE ALSO ⭐

• kryoptic.conf(5)
• softhsm_migrate(1)

---

and that's the whole page, bestie!! 🎀 you made it to the end, which means you now know more about a Rust PKCS#11 soft token than 99% of the group chat. go off. 🌸

signing off from the Miscellaneous Information Manual, section 7 — this was KRYOPTIC(7), footer and all, mwah 💅💖