<?xml version="1.0" encoding="utf-8"?>
<!-- Copyright (c) 2007-2010 Nokia Corporation and/or its subsidiary(-ies) All rights reserved. -->
<!-- This component and the accompanying materials are made available under the terms of the License 
"Eclipse Public License v1.0" which accompanies this distribution, 
and is available at the URL "http://www.eclipse.org/legal/epl-v10.html". -->
<!-- Initial Contributors:
    Nokia Corporation - initial contribution.
Contributors: 
-->
<!DOCTYPE concept
  PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
<concept id="GUID-B8EF4291-18FE-572F-AAA1-CF7C491F4DA1" xml:lang="en"><title>File-Based
Certificate and Key Stores Overview</title><prolog><metadata><keywords/></metadata></prolog><conbody>
<p>The File-Based Certificate and Key Stores manage cryptography certificates,
keys and certificate applications in a device. </p>
<section id="GUID-76219F94-BD45-4C25-9FDE-137662DA06F9"><title>Required background</title> <p>To understand File-Based Certificate
and Key Stores, you need to have a basic understanding of the following: </p> <ul>
<li id="GUID-E2202F0C-F4D1-5DB8-8048-D815F65CC599"><p><xref href="GUID-A6FF1073-AA55-588D-8DC1-0A8C16864891.dita">Crypto-Token
Framework</xref>  </p> </li>
</ul> </section>
<section id="GUID-2C994F1A-F3E2-42F1-813A-A25930A827DC"><title>Key concepts and terms</title> <dl>
<dlentry>
<dt>Token</dt>
<dd><p>A token is a physical instantiation of an object, such as a certificate
or a key, stored in a phone. Each token belongs to a group of tokens called
a token type. For example, an X.509 certificate is a token which belongs to
the X.509 token type. </p> </dd>
</dlentry>
<dlentry>
<dt>Key</dt>
<dd><p>A cryptography key is a constant value applied using a cryptographic
algorithm to encrypt text or to decrypt encrypted text. </p> <p>Keys are classified
as symmetric and asymmetric based on the type of algorithm applied. If the
same key is used for both encryption and decryption, it is symmetric. If different
keys are used for encryption and decryption, they are asymmetric. Asymmetric
keys exist in the form of a public and private key pair, where the public
key is used for encryption and the private key is used for decryption. </p> </dd>
</dlentry>
<dlentry>
<dt>Certificate</dt>
<dd><p>A certificate (or Public Key Infrastructure (PKI) certificate) is an
electronic document that binds an identity to a public key. It is used to
authenticate public keys. </p> <p>Certificates are issued by a certification
authority (CA) and usually include information such as a label, serial number,
validity period, certificate format (for example, X.509) and algorithm type
(for example, RSA). </p> </dd>
</dlentry>
<dlentry>
<dt>Certificate Store</dt>
<dd><p>A certificate store is a database or a file that stores and manipulates
certificates. </p> <p>Certificate stores typically provide the following functionality: </p> <ul>
<li id="GUID-E054023C-F86C-520E-9619-6AE5149CD69E"><p>Generation, storage
and retrieval of certificates </p> </li>
<li id="GUID-18A9F698-4715-58B0-A85D-461796A3708A"><p>Assigning trust status
to certificates </p> </li>
<li id="GUID-1CF81CBF-6B12-5D83-AD33-B3A026B13733"><p>Retrieving list of applications
trusting a certificate </p> </li>
</ul> </dd>
</dlentry>
<dlentry>
<dt>Key Store</dt>
<dd><p>A key store is a repository of keys that can be retrieved and used
to accomplish a variety of tasks. </p> <p>Key stores typically provide the
following functionality: </p> <ul>
<li id="GUID-B45FB71B-1CEA-511A-936E-9386345285B2"><p>Generation, import and
export of RSA, DSA, and DH key pairs </p> </li>
<li id="GUID-51C117AA-37C9-5467-A699-187BE8C580F0"><p>Listing stored keys </p> </li>
<li id="GUID-B18A26D3-6B19-524D-B70A-05FC07E8E513"><p>Performing private key
operations for authenticated users </p> </li>
</ul> </dd>
</dlentry>
<dlentry>
<dt>Certificate Applications Store</dt>
<dd><p>The certificate applications store holds a list of the human-readable
names and UIDs of applications that make use of (trust) the certificates held
in the certificate stores. </p> </dd>
</dlentry>
</dl> </section>
<section id="GUID-359392CB-4DD8-4494-86B0-4E9DCDB359E6"><title>Architecture</title> <p>See the <b>Architecture</b> section
of the <xref href="GUID-C7150120-74C2-5FF1-99F0-0A267393E342.dita">Crypto-Token
Framework Overview</xref> for details. </p> </section>
<section id="GUID-BCA11717-7A0F-4506-8E89-BD68008C1DA2"><title>Description</title> <p>The Symbian platform provides
device creators with a file-based software plug-in implementation of key,
certificate and certificate application stores in the device such that these
can be directly used. These stores are implemented using the <xref href="GUID-A6FF1073-AA55-588D-8DC1-0A8C16864891.dita">Crypto-Token
Framework</xref>. They are deployed ahead of the device creators' stores at
ROM build. </p> <p>The <xref href="GUID-39B459CD-8210-59B5-95F4-85CE36676735.dita">Unified
Store</xref> APIs form the single point of access for applications that require
access to certificates, keys and certificate applications in the device. While
the <xref href="GUID-0010EB39-8C23-5453-BE96-4EFC520B6F81.dita">Unified Certificate
Store</xref> API provides a unified view of all the certificate stores and
the certificate applications stores in the device, the <xref href="GUID-695FCEB8-EA04-5C1C-A197-648275BA0281.dita">Unified
Key Store</xref> API provides a similar view of all the key stores in the
device. Although applications can bypass the Unified Stores and gain access
through additional, configurable plug-in interfaces of the file-based certificate
and key stores, this is not recommended. </p> <p>Device creators can choose
to exclude this component at the time of ROM build. However, at least one
implementation of the stores (Symbian's or the device creator's implementation)
must be available to ensure the normal functioning of the applications that
use the certificates, keys and certificate applications in the device. </p> <p> <b>Note:</b> Device
creators, by default, are provided with tools to manipulate certificate and
key stores. For details of these tools, see <xref href="GUID-93C32496-036F-5000-B6FD-CAECAD21DEB8.dita">Certtool</xref> and <xref href="GUID-BD7B20B9-0C04-5F71-8562-246BB60AE769.dita">Keytool</xref>. </p> </section>
<section id="GUID-1109D836-EF43-47AC-B9B5-CD103CE3760F"><title>APIs</title> <p>See the <b>Key Classes</b> section of the <xref href="GUID-C7150120-74C2-5FF1-99F0-0A267393E342.dita">Crypto-Token Framework Overview</xref> for
details. </p> </section>
<section id="GUID-16209BE8-5A3D-4AEB-8F39-C0E4A8708E75"><title>Typical uses</title> <p>See the following sections for details
of the typical uses of the certificate and key stores: </p> <ul>
<li id="GUID-8B1C7AEA-C67A-5D7F-A1EF-1459C72849A6"><p><xref href="GUID-B946BDF0-C5D8-57E2-9D05-7BE134AD032E.dita">Unified
Certificate Store Tutorial</xref>  </p> </li>
<li id="GUID-8BACA3C0-B1F7-5B62-AE59-5CC06CA33EA1"><p><xref href="GUID-6C6AED40-D5B3-5613-8F92-FD2CB711AE54.dita">Unified
Key Store Tutorials</xref>  </p> </li>
</ul> </section>
</conbody><related-links>
<link href="GUID-A6FF1073-AA55-588D-8DC1-0A8C16864891.dita"><linktext>Crypto-Token
Framework</linktext></link>
<link href="GUID-39B459CD-8210-59B5-95F4-85CE36676735.dita"><linktext>Unified Store</linktext>
</link>
</related-links></concept>