pkcs11 — archive

[Darren Moffat]

On 04/03/13 07:32, Cohen, Doron wrote: Thanks Mike for your comments. The proposal I submitted was created under the assumption for minimal changes to the spec, but adding an explicit mechanism per you proposal below makes sense and will probably make it easier to understand and implement. So I like it . As for using CKM_AES_KEY_WRAP_PAD - from a first look it seems to be a valid alternative to GCM and CCM - I will go over that with my cryptograph to make sure I have not missed anything . I would still like to see CKM_AES_CCM and CKM_AES_GCM made available for wrapping as part of the standard. We already use them for key wrapping in ZFS on Solaris (but we do the wrap/unwrap with our in kernel API not PKCS#11). Doron