pkcs11 — archive

[Robert Burns]

Mike, Quite true and I think offering advice on proper nonce selection is important and valuable. From a specification standpoint though, I think we shouldn't necessarily keep a primitive out just because it might be 'hard' to get right -- we should do our best to help the user and provide them with the maximum information -- as you stated, perhaps we could hide this from them by generating the IV as part of the wrap and return as an output? Besides, if we were truly concerned with protecting the users from themselves we shouldn't let them use 'C'! ;-> Bob >