[Vladimir Beker] Thanks a lot for your answers. Some of them helped to me.
> > auth. object, I cannot do it. If I use key object, I cannot represent > > other password's attributes (such as password change date, min/max > > password length, unblocking issues etc. Is there any way to combine > > these things? > > of course if you use a challenge and response authentication based > on a symm (or asymm.) cipher key attributes like min/max length are > useless as the key length is determined by the underlying cipher [Vladimir Beker] This is obvious. What I wanted to do is the following: from the viewpoint of the user there is password (since I speak about human client). The password is converted to the encryption key (for instance, according to PKCS#5 - and this key is used for real authentication. This way I prevent eavesdropping and replay attacks by using challenge-response (alternatively I need SM but it supposes that both sides already share some secret). However from the user point of view, it is password, so min/max length and other password attributes still take place. > > > 2. When encoding access conditions of some object (which are in fact > > references to auth. objects) how can I encode ALWAYS and NEVER? > > ALWAYS == no ac == no authId in the CommonObjectAttributes > (NEVER, don't know perhaps an invalid authId, but personally I don't > the necessity for this) [Vladimir Beker] ALWAYS - you seem to be right. NEVER - well, I would like to define access condition for object removal. > > > Does it mean that I must support all of these options > > since other applications may choose any of them when creating objects on > > the card? > > if you want other libraries to write on your card the answer is yes [Vladimir Beker] And if I want to operate with cards prepared by other libraries on the smartcard of the type known to me? The source of these last questions are very simple: if we don't get interoperability what's the reason to follow standard? Thanks Vladimir ************************************************************************************************** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to anyone or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ************************************************************************************************** _______________________________________________ Muscle mailing list [email protected] http://lists.drizzle.com/mailman/listinfo/muscle
