pkcs11 — archive

[Robert Burns]

Title: RE: [pkcs11] CKA_PUBLIC_KEY_INFO Mike, Thanks again -- I do appreciate the time you're taking on this dialog. So we're in violent agreement that the proposal for SPKI requires formatted marshaled data that the token has to deal with (e.g. definitely not opaque). We're also in agreement that there is nothing in P11 which requires that public keys and private keys be inextricably tied together (which is a good thing and a desirable trait as there are real use cases for having access to only one or the other). Therefore, my opinion is that the CKA_PUBLIC_KEY_INFO proposal does not add anything that is already there today and only increases the implementation requirements on tokens. For every use case where the calling API can provide the SPKI info, the application can decode it itself and create a separate public key object. For those cases where the token generates a key pair, the public key is (by definition) available at that instant and can be extracted by the application, and bundled into an SPKI blob, and then assigned to the CKA_ID field of a private key object as required. This is an application use case issue, not a token issue (or a problem with the P11 model). This is a corner case that can be easily solved by any application, if implemented correctly. Thanks, Bob