PKCS#11 Support
This chapter describes the PKCS#11 support provided by the Luna SDK. It contains the following topics:
A note about C_FindObjects behavior and application performance
When a partition contains large numbers of keys and objects, it is generally best to employ the C_FindObjects function using limiting parameters like description or other attributes to refine and minimize the scope of the search, for performance reasons. Avoid calling C_FindObjects all repeatedly, because this will degrade performance when large numbers of keys and objects are involved.
A preferred approach is to use C_FindObjects to find all objects when your application first starts a session with an HSM, and thereafter to use that output to identify and call only for specific objects as needed during the ongoing session.
The performance hit from frequent calls to C_FindObjects all is magnified when the client is dealing with an HA group. This is due to the additional time required for synchronization across the members of the virtual partition. The table created by an initial C_FindObjects all at application start should be used to craft refined calls for individual objects, generating much less demand on HSM and client resources. Keep in mind also that handles for the same object differ across HA group members, as those are assigned by each HSM at object creation or cloning-in; instead specify objects by attributes that remain constant when cloned from partition to partition.
