← Back to branch summary

~mrooney/ecryptfs/nautilus-integration

« back to all changes in this revision

Viewing changes to doc/ecryptfs-pkcs11-helper-doc.txt

  • Committer: mhalcrow@us.ibm.com
  • Date: 2007-11-06 22:56:01 UTC
  • Revision ID: git-v1:f8357de9d554b274497b5cce9db4347254b7e7eb
Initial import of eCryptfs filesystem userspace utilities (mount helper, daemon component,
etc.)

Show diffs side-by-side

added added

removed removed

Lines of Context:
doc/ecryptfs-pkcs11-helper-doc.txt
 
1
eCryptfs PKCS#11 Key Module
 
2
 
 
3
ABOUT
 
4
 
 
5
        eCryptfs PKCS#11 key module enables use of PKCS#11 token private key
 
6
        with eCryptfs.
 
7
 
 
8
        ecryptfsd must be running in order to use the key module.
 
9
 
 
10
        The key module expects a private key and certificate on token, both
 
11
        should have the same value in CKA_ID attribute.
 
12
 
 
13
CONFIGURATION
 
14
 
 
15
        Configuration is stored at ~/.ecryptfsrc.pkcs11.
 
16
 
 
17
        Attributes:
 
18
                pkcs11-log-level (Integer, decimal)
 
19
                        Log level of pkcs11-helper, can be from 0-5.
 
20
 
 
21
                pkcs11-pin-cache-timeout (Integer, decimal)
 
22
                        Maximum PIN/session cache period in seconds.
 
23
                        -1 is infinite, until provider invalidates session.
 
24
 
 
25
                pkcs11-provider
 
26
                        name (String)
 
27
                                Provider unique friendly name.
 
28
 
 
29
                        library (String)
 
30
                                Provider library to load.
 
31
 
 
32
                        allow-protected-auth (Boolean)
 
33
                                Enable protected authentication if provider supports the feature.
 
34
 
 
35
                        cert-private (Boolean)
 
36
                                Provider stores the certificates as private objects.
 
37
 
 
38
                        private-mask (Integer, hex)
 
39
                                Provider private key mask:
 
40
                                0       Determine automatically.
 
41
                                1       Use sign.
 
42
                                2       Use sign recover.
 
43
                                4       Use decrypt.
 
44
                                8       Use unwrap.
 
45
        
 
46
        Example:
 
47
                pkcs11-log-level=5
 
48
                pkcs11-provider1,name=myprovider1,library=/usr/lib/pkcs11/myprovider1.so
 
49
                pkcs11-provider2,name=myprovider2,library=/usr/lib/pkcs11/myprovider2.so
 
50
 
 
51
MOUNT OPTIONS
 
52
 
 
53
        key Attributes:
 
54
                id (String)
 
55
                        PKCS#11 serialized object id, this object id can be
 
56
                        aquired using ecryptfs-manager, the default value of
 
57
                        this field is a list of "DN (serial) [serialized id]".
 
58
 
 
59
                x509file (String)
 
60
                        Optional (may be empty) reference to a X.509 PEM file
 
61
                        holding id certificate. It is required if the key is
 
62
                        added when the token is not available.
 
63
 
 
64
        Example:
 
65
                key=pkcs11:id=<serialized-id>
 
66
 
 
67
AUTHORS
 
68
        Alon Bar-Lev <alon.barlev@gmail.com>
 
69