pkcs11 — archive

[Robert Burns]

Title: RE: [pkcs11] CKA_PUBLIC_KEY_INFO Peter, So going back to my original thought, perhaps the way forward is to add some sort of opaque attribute to public/private/certificate objects which can be application defined? That way, it could be used to interlink all three (e.g. assigning the hash of the public bits) for easy lookup, or could be used to hold the SPKI info in your cases? Seems like a win-win that keeps it lite on the P11 spec side (e.g. won't need language about how to interpret, parse, etc.) and affords the applications the ability to use this attribute as needed -- furthermore, we could make it required, but default to 'empty' making the implementation less ambiguous. Possibilities attribute names: 1) CKA_KEYPAIR_INDEX, 2) CKA_KEYPAIR_ID, 3) CKA_KEYPAIR_INFO -- other suggestions? What do you think? Bob