Vladimir Beker wrote: ...
[Vladimir Beker] Regarding to asymm. SM: First, as you say, not all cards support it. Second (more important for me): even if I go to the asymmetric scheme, I need to describe it in the smartcard layout (so that application will know that it should apply SM working with particular key).
I don't think this is possible using pkcs15
Anyway the same applies to EXTERNAL AUTHENTICATE is case a symm. cipher is used.
[Vladimir Beker] Absolutely. That's why I want to derive key from password and use EXTERNAL AUTHENTICATE for user authentication.
so you still need to store a shared secret (the one that the user should derive from the 'pin') on the smartcard (hence you can have more less the same effect using sm).
However from the user point of view, it is password, so min/max length and other password attributes still
take place.
of course you can misuse a pin a object for this, but I don't think there's an elegant solution for this (using pkcs15, not to mention pkcs11 ;-)
[Vladimir Beker] Regarding to PKCS#15 - it is not elegant (it would be better to have missing attributes in auth. key object instead, just to make them OPTIONAL. So, presence of these attributes (such as min. length) would mean that it is actually password derived.
of course you would need to specify the alg and parameters to derive the key as well ...
...
[Vladimir Beker] Well, the proposal may be a bit different. I would
propose to use invalid value here. As minimum, it may be ID that does
not appear in the directory of authentication objects.
that's not allowed. to quote pkcs15:
CommonObjectAttributes ::= SEQUENCE {
...
authId Identifier OPTIONAL, ...,
...
} (CONSTRAINED BY {
-- authId should be present in the IC card case if flags.private is set.
-- It must equal an authID in one AuthRecord in the AODF -- })but I don't that many libraries stumble over this.
Or it may be something that the card will not accept in VERIFY command (such as 0xFF).
id != reference
Nils _______________________________________________ Muscle mailing list [email protected] http://lists.drizzle.com/mailman/listinfo/muscle
