Hello I need to develop data format for representation of PKCS#11-information on some smartcard. The obvious choice seems to be PKCS#15. However I have some problems due to the fact that some vendor-specific functionality (which is out of scope of PKCS#11) should be supported. May someone say me whether (and how) the following functionality may be represented via PKCS#15: 1. I want user PIN to be presented to the card via challenge-response mechanism (to prevent eavesdropping and replay attacks). If I use PIN auth. object, I cannot do it. If I use key object, I cannot represent other password's attributes (such as password change date, min/max password length, unblocking issues etc. Is there any way to combine these things? 2. When encoding access conditions of some object (which are in fact references to auth. objects) how can I encode ALWAYS and NEVER? 3. I would like to protect operations with private key with SM. Is there any way to associate SM with particular objects and operations on these objects, not just with authentication? 4. Since it is spoken about PKCS#11-application (not about client-server solution) there is no way to keep secret for SM on the host. I would like to derive SM key from the password. Is there some way to represent such thing via PKCS#15? 5. How can I store vendor-specific attributes of data objects? I don't really care if other applications will just ignore them, as long as they will not fall and will not destruct my data. 6. Is there any way to store vendor-specific attributes for objects other than data (keys, certificates)? 7. Is there any way to store vendor-specific object types? 8. Is there any way to have more vendor-specific information for auth. object (such as password quality rules). Again, I have no problem if other applications will just ignore it. 9. PKCS#15 leaves many implementation options: I may freely make choice between record/binary files, various key identifiers, keeping multiple objects of the same type in the same or different files. Does it REALLY mean that no matter which option I will choose, other applications will understand it? Does it mean that I must support all of these options since other applications may choose any of them when creating objects on the card? 10. I base all my decisions on PKCS#15 v1.1, since it is much richer than 1.0. What are implications in terms of compatibility? I understand it theoretically, but what real applications use today?
Thanks in advance. Vladimir Beker
<<winmail.dat>>
_______________________________________________ Muscle mailing list [email protected] http://lists.drizzle.com/mailman/listinfo/muscle
