Vladimir Beker wrote:
Hello
I need to develop data format for representation of PKCS#11-information
on some smartcard. The obvious choice seems to be PKCS#15. However I
don't agree that pkcs15 is the obvious choice, it's depends on the
intended usage of the card/token
have some problems due to the fact that some vendor-specific
functionality (which is out of scope of PKCS#11) should be supported.
May someone say me whether (and how) the following functionality may be
represented via PKCS#15:
1. I want user PIN to be presented to the card via challenge-response
mechanism (to prevent eavesdropping and replay attacks). If I use PIN
pin authentication (presenting some secret to the card) is different
from a challenge and response authentication (normally via 'external
authenticate'). note: if you enforce sm for the verify command
eavesdropping is not trivial ...
auth. object, I cannot do it. If I use key object, I cannot represent
other password's attributes (such as password change date, min/max
password length, unblocking issues etc. Is there any way to combine
these things?
of course if you use a challenge and response authentication based
on a symm (or asymm.) cipher key attributes like min/max length are
useless as the key length is determined by the underlying cipher
2. When encoding access conditions of some object (which are in fact
references to auth. objects) how can I encode ALWAYS and NEVER?
ALWAYS == no ac == no authId in the CommonObjectAttributes
(NEVER, don't know perhaps an invalid authId, but personally I don't
the necessity for this)
3. I would like to protect operations with private key with SM. Is there
any way to associate SM with particular objects and operations on these
objects, not just with authentication?
in pkcs15 afaik no
4. Since it is spoken about PKCS#11-application (not about client-server
solution) there is no way to keep secret for SM on the host. I would
like to derive SM key from the password. Is there some way to represent
such thing via PKCS#15?
afaik no
5. How can I store vendor-specific attributes of data objects? I don't
really care if other applications will just ignore them, as long as they
will not fall and will not destruct my data.
6. Is there any way to store vendor-specific attributes for objects
other than data (keys, certificates)?
7. Is there any way to store vendor-specific object types?
8. Is there any way to have more vendor-specific information for auth.
object (such as password quality rules). Again, I have no problem if
other applications will just ignore it.
9. PKCS#15 leaves many implementation options: I may freely make choice
between record/binary files, various key identifiers, keeping multiple
objects of the same type in the same or different files. Does it REALLY
mean that no matter which option I will choose, other applications will
understand it?
theoretically yes, practically no
Does it mean that I must support all of these options
since other applications may choose any of them when creating objects on
the card?
if you want other libraries to write on your card the answer is yes
Cheers,
Nils
_______________________________________________
Muscle mailing list
[email protected]
http://lists.drizzle.com/mailman/listinfo/muscle
