pkcs11 — archive

[pkcs11] Proposal: CKM_RSA_PKCS_FIPS_186_4

From: Wan-Teh Chang <[email protected]>
To: [email protected]
Date: Mon, 05 Aug 2013 17:43:00 -0000

On Mon, Aug 5, 2013 at 10:29 AM, Michael StJohns <[email protected]> wrote: > > A better way to deal with this is to set the ulMinKeySize parameter of the > CK_MECHANISM_INFO for CKM_RSA_PKCS to 1024 and to note - in the product > guidance - that 1024, 2048 and 3072 are the only valid lengths when you're > in FIPS mode. I agree that a FIPS mode for the product would be a better way to deal with the additional restrictions imposed by FIPS. It is also problematic to encode the exact FIPS 186 revision (_4) in the mechanism name because as others pointed out, FIPS 186 could be updated again in a few years. Wan-Teh Chang