PKCS#11
also: Cryptoki, PKCS11
PKCS#11 is a cryptographic standard that defines how applications interact with hardware security modules and smart cards to perform cryptographic operations and manage digital certificates.
PKCS#11 (Public Key Cryptography Standards #11) is a standardized API (application programming interface) that allows software to communicate with cryptographic hardware devices. It acts as a bridge between applications and physical security devices like smart cards, hardware security modules (HSMs), and USB tokens.
Instead of storing private keys in files on disk, PKCS#11 enables applications to request that a hardware device perform cryptographic operations. For example, when you need to sign a document, the application sends the data to the hardware token, which performs the signing internally and returns only the signature—the private key never leaves the device.
In Linux, PKCS#11 support is commonly used for secure authentication, digital signatures, and certificate management. Tools like openssl, gpg, and SSH can be configured to use PKCS#11 drivers to access smartcards and hardware tokens.