A Comparison of CDSA to Cryptoki

The Common Data Security Architecture (CDSA) is a general security service architecture which has been standardized by the Open Group. This paper compares the CDSA CAPI to another well known low-level CAPI, RSA’s PKCS #11 (Cryptoki). Both CDSA and Cryptoki are low-level interfaces which satisfy criteria established by the NSA’s CAPI Team. However, CDSA provides a security services infrastructure to several categories of security services, and therefore provides more auxiliary services to manage this more complex architecture. Additionally, Cryptoki provides a more direct interface to hardware cryptographic tokens. This paper maps calls in the APIs, describes differences between the two and how these may be handled, and considers porting issues.