English 
Tiếng ViệtPKCS#11 OBJECT MODEL
Objects, attributes and persistence
Applications receive predictable object visibility and attribute behavior instead of relying on provider-specific guesses.
01
Object profiles
| Object class | Key attributes | Policy |
|---|---|---|
| CKO_PRIVATE_KEY | CKA_ID, CKA_LABEL, CKA_KEY_TYPE, CKA_SIGN/DERIVE | Sensitive; non-extractable unless approved wrapped migration |
| CKO_PUBLIC_KEY | CKA_ID, CKA_LABEL, CKA_VERIFY | Exportable public material under profile |
| CKO_CERTIFICATE | CKA_ID, CKA_LABEL, CKA_SUBJECT, CKA_ISSUER | Associated to key by stable CKA_ID |
| CKO_DATA | Vendor/profile data only | Not used for secret material without explicit profile |
02
Attribute behavior
| Attribute | Behavior |
|---|---|
| CKA_ID | Stable key/certificate association identifier |
| CKA_LABEL | Human-readable, uniqueness rules documented |
| CKA_TOKEN | Persistence choice controlled by template/policy |
| CKA_SENSITIVE | True for private/secret material |
| CKA_EXTRACTABLE | False by default for protected private keys |
| CKA_ALWAYS_AUTHENTICATE | Used only when release profile implements context login |
| Unknown/unsupported attribute | CKR_ATTRIBUTE_TYPE_INVALID or documented behavior |