pkcs11 — archive

[Robert Burns]

Title: RE: [pkcs11] CKA_PUBLIC_KEY_INFO Mike, Firstly, the word 'opaque' means that the token has no requirement to decode/dissect/encode/interpret the data stored in that object. Your descriptions require both encoding and decoding of this data -- that is the opposite of 'opaque'. So no, as you've described it, this field is not opaque. Secondly, this attribute is on ALL public and private key objects, not just RSA -- so a use case for RSA rings hollow. Thirdly, if the APPLICATION has the subject public key info data, it can itself decode it and provide the necessary public attributes during C_CreateObject() -- why is this the token's responsibility? This doesn't make sense. Furthermore, if the application does not have the relevant fields, then too bad so sad -- they can't create the object then. Seems like we're hacking P11 to support poorly constructed P11 applications, and that just seems like the wrong approach to me. Bob