pkcs11 — archive

[Michael StJohns]

On 7/3/2013 6:06 PM, Oscar K So Jr. wrote: Thanks Michael. I see. The CKA_GLOBAL has a larger scope than CKA_TOKEN. CKA_TOKEN persist through session close. CKA_GLOBAL persist through token re-InitToken. And, one side comment here for C_InitToken that you mention, if user wish to rename a token label, going through CKM_SEAL_KEY...and etc, and then C_InitToken with a new token label, and restore (UnwrapKey..) whatever back into the token is also, consider another way of rename token. Just a longer way, but, it will work. :-) Best, Oscar No. It won't. When you initialize zeroize a token, the previous seal keys are thrown away and any key material sealed by that seal key is no better than random bits. When you re-initialize the token, you generate a new seal key - which basically CAN'T unwrap the previously sealed keys. That explanation is with the description of what seal keys are - pkcs11-global-objects.docx - on the pkcs11 doc store. Mike