Cryptographic agility application program interface engine
There is provided a computer-implemented method for remote delegation of cryptographic processing from an application to other entities. The method including: structuring the cryptographic package with an application programming interface (API) as an engine of the cryptographic package and each provider including a dynamic-link library (dll) of an instance of the API; registering the API to a cryptographic library as a new crypto suite through the engine; implementing a control policy at a control entity to provide runtime input to the providers; receiving an API call from the application to implement a cryptographic action via the API, the API selecting the cryptographic scheme to implement the action.
1. A computer-implemented method for remote delegation of cryptographic processing from an application to other entities, the method comprising:
structuring a cryptographic package with an application programming interface (API) as an engine of the cryptographic package, the cryptographic package comprising a plurality of cryptographic providers, each cryptographic provider comprising a dynamic-link library (dll) of an instance of the API;
registering the API to a cryptographic library as a new crypto suite through the engine;
implementing a control policy at a control entity to provide runtime input to the cryptographic providers;
receiving an API call from the application to implement a cryptographic action via the API, the API selecting the cryptographic scheme to implement the action,
wherein the engine replaces a previously used engine to dynamically link the cryptographic library used by the application, allowing runtime selection and usage of different cryptographic libraries from a plurality of cryptographic providers without application recompilation or modification.
2. The method of claim 1 , wherein each node in each cryptographic provider comprises only one cryptographic algorithm.
3. The method of claim 2 , wherein for each of the cryptographic providers, each of the nodes and cryptographic algorithms have fixed generic names respectively assigned.
4. The method of claim 3 , wherein a real name of each of the algorithms is in a description field associated with the respective node.
5. The method of claim 1 , further comprising generating a configuration file listing active cryptographic schemes at runtime, wherein each cryptographic provider determines if its respective cryptographic schemes are present in the configuration file prior to implementation by the application.
6. The method of claim 1 , wherein the cryptographic action is signing with a digital signature.
7. The method of claim 1 , wherein the cryptographic action is authenticating with a digital signature.
8. The method of claim 1 , wherein the cryptographic library comprises OpenSSL.
9. The method of claim 1 , wherein the cryptographic library comprises one of WolfSSL, BouncyCastle, and BoringSSL.