Re: PKCS#11 platform integration

2015-05-11 Thread David Woodhouse
On Sun, 2015-05-10 at 12:47 -0700, Ryan Sleevi wrote: - Don't load a module unless the user has explicitly asked or configured that module to be loaded. - Do not patch NSS to load modules outside of the explicitly requested modules. Quite right; that's absolutely how we should behave. As

Re: PKCS#11 platform integration

2015-05-11 Thread Brian Smith
David Woodhouse dw...@infradead.org wrote: The sysadmin should be able to configure things for *all* users according to the desired policy, rather than forcing each user to set things up for themselves. And in turn the *developers* of the operating system distribution should be able to set

Re: PKCS#11 platform integration

2015-05-11 Thread Ryan Sleevi
On Mon, May 11, 2015 4:09 am, David Woodhouse wrote: I completely agree that Chrome should only ever load the modules which are configured to be loaded into Chrome. I'm surprised you feel the need to mention that. Because you still don't understand, despite how many ways I'm trying to say

Re: target parameter to PK11_Derive

2015-05-11 Thread Robert Relyea
On 05/07/2015 11:49 AM, Andrew Cagney wrote: [inline] On 5 May 2015 at 13:18, Robert Relyea rrel...@redhat.com wrote: The target Mechanism is the operation you are going to use the target key for, It shouldn't match the mechanism used to derive the key. It is basically used to set the