Cryptographic Application Programming Interfaces (APIs)

Abstract

Abstract mechanisms and services form a basic part of the security features of computer and data network systems. Application and system/sub-system programs alike require access to these mechanisms, including encryption and key management functions, in a controlled, guaranteed and reliable form. Such cryptographic sub-systems may be components of so-called ‘middle-ware’; basic tools sets needed to create the next generation of distributed application systems whereby applications may be created without detailed knowledge of underlying network topology or services. Already a number of cryptographic Application Programming Interfaces (APIs) exist but these tend to be vendor and/or system or even application industry, such as banking and finance, dependent. This paper examines the problem of defining suitable APIs, their control, management and placement in other operating systems services. It concludes that while standardization may be worthwhile it would appear to be premature at present as further research is needed particularly into the ‘level’ of such services and their positioning in an overall system sense.