File-Based Certificate and Key Stores Overview

Required background

To understand File-Based Certificate and Key Stores, you need to have a basic understanding of the following:

• Crypto-Token Framework

Key concepts and terms

Token

A token is a physical instantiation of an object, such as a certificate or a key, stored in a phone. Each token belongs to a group of tokens called a token type. For example, an X.509 certificate is a token which belongs to the X.509 token type.

Key

A cryptography key is a constant value applied using a cryptographic algorithm to encrypt text or to decrypt encrypted text.

Keys are classified as symmetric and asymmetric based on the type of algorithm applied. If the same key is used for both encryption and decryption, it is symmetric. If different keys are used for encryption and decryption, they are asymmetric. Asymmetric keys exist in the form of a public and private key pair, where the public key is used for encryption and the private key is used for decryption.

Certificate

A certificate (or Public Key Infrastructure (PKI) certificate) is an electronic document that binds an identity to a public key. It is used to authenticate public keys.

Certificates are issued by a certification authority (CA) and usually include information such as a label, serial number, validity period, certificate format (for example, X.509) and algorithm type (for example, RSA).

Certificate Store

A certificate store is a database or a file that stores and manipulates certificates.

Certificate stores typically provide the following functionality:

• Generation, storage and retrieval of certificates

• Assigning trust status to certificates

• Retrieving list of applications trusting a certificate

Key Store

A key store is a repository of keys that can be retrieved and used to accomplish a variety of tasks.

Key stores typically provide the following functionality:

• Generation, import and export of RSA, DSA, and DH key pairs

• Listing stored keys

• Performing private key operations for authenticated users

Certificate Applications Store

The certificate applications store holds a list of the human-readable names and UIDs of applications that make use of (trust) the certificates held in the certificate stores.

Architecture

See the Architecture section of the Crypto-Token Framework Overview for details.

Description

The Symbian platform provides device creators with a file-based software plug-in implementation of key, certificate and certificate application stores in the device such that these can be directly used. These stores are implemented using the Crypto-Token Framework. They are deployed ahead of the device creators' stores at ROM build.

The Unified Store APIs form the single point of access for applications that require access to certificates, keys and certificate applications in the device. While the Unified Certificate Store API provides a unified view of all the certificate stores and the certificate applications stores in the device, the Unified Key Store API provides a similar view of all the key stores in the device. Although applications can bypass the Unified Stores and gain access through additional, configurable plug-in interfaces of the file-based certificate and key stores, this is not recommended.

Device creators can choose to exclude this component at the time of ROM build. However, at least one implementation of the stores (Symbian's or the device creator's implementation) must be available to ensure the normal functioning of the applications that use the certificates, keys and certificate applications in the device.

Note: Device creators, by default, are provided with tools to manipulate certificate and key stores. For details of these tools, see Certtool and Keytool.

APIs

See the Key Classes section of the Crypto-Token Framework Overview for details.

Typical uses

See the following sections for details of the typical uses of the certificate and key stores:

• Unified Certificate Store Tutorial

• Unified Key Store Tutorials