0
$\begingroup$

On Solaris there's a function pkcs11_PasswdToKey() which is a wrapper of C_GenerateKey(). I made a simple test and it turned out that pkcs11_PasswdToKey() only supports following CKK_types:

CKK_AES
CKK_BLOWFISH
CKK_DES
CKK_DES2
CKK_DES3
CKK_RC4

From my understanding, other symmetric ciphers (like CKK_IDEA) should also be supported. Can anyone make some clarification?

$\endgroup$

1 Answer 1

0
$\begingroup$

I am not familiar with that specific Solaris library (is that a software token?).

However, what I can say is that PKCS#11 does not set any minimum requirement for the algorithms that a certain implementation should offer. CKK_IDEA could be supported, but only if the implementer chooses to. For instance, up to a few years ago, IDEA was patented and it was often not included in libraries and devices for legal reasons.

Besides, that is there any good reason not to use CKK_AES? That is the best choice in most cases.

$\endgroup$
1
  • $\begingroup$ Thanks. I believe you're right that it's implementation dependent. $\endgroup$
    – N142857
    May 15, 2013 at 5:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.