> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:muscle- > [EMAIL PROTECTED] On Behalf Of David Corcoran > Sent: Tuesday, April 26, 2005 9:27 AM > To: MUSCLE > Subject: [Muscle] PKCS#11 2.20 / Multiple User PINs > > Hi, > > Curious if anyone has run into this before. There is a notion of > having multiple user pins on some national id programs so that the user > can be guaranteed that they are signing a document with the correct key > and that key is tied to a pin which is only associated to that signing > key. > In the 12 year old Fortezza program, a card is a container for multiple personalities, each bearing key sets. One must login as a particular personality.
Unlike CAC cards, the Fortezza card was designed for secure messaging, rather than being a generic cryptomodule, where card issuer and key management authority are essentially the same. In Fortezza, there was a registration process - to safeguard the distribution of the general purpose tokens - but then the secure messaging context controlled which PKI(s) one might enroll in. If a US military person was issued a card, for use in DMS while on base in the CONUS, for example, and then wandered into a NATO joint mission for example, where his cert was listed in a non DMS portion of the directory, the card had to be able to support this new personality with custom key gen authorities defined by the (joint) mission. You didn't get a second card! You get a second personality, mission specific. Fortezza got a lot of things right for open systems work, that CAC got wrong. But then, years, years and yet more years of design effort went into the Fortezza planning. > Earlier versions of PKCS#11 had a notion of virtual slots which would > allow you to use these other user pins. In the 2.20 version of > PKCS#11, the notion of virtual slots has been thrown out (from what I > can see). Does anyone know how you are supposed to support multiple > user pins in 2.20 ? > > Thanks, > Dave > > ------------------------------------------------------------------------ > ------------ > David Corcoran [EMAIL PROTECTED] > Identity Alliance http://www.identityalliance.com > phone: 260-488-3099 fax: 260-488-2455 > > Smart Cards, Biometrics, Training, Identity Management > ------------------------------------------------------------------------ > ------------- > > _______________________________________________ > Muscle mailing list > [email protected] > http://lists.drizzle.com/mailman/listinfo/muscle _______________________________________________ Muscle mailing list [email protected] http://lists.drizzle.com/mailman/listinfo/muscle
