Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to PKCS#11 v2.20, "C_GetMechanismInfo obtains information about a particular mechanism possibly supported by a token." Does that mean C_GetMechanismInfo() can return CKR_OK on a temporarily disabled mechanism? For example, if C_GetMechanismList() does not return CKM_MD5 in the result then is it OK for C_GetMechanismInfo(CKM_MD5) to return CKR_OK?

share|improve this question
up vote 1 down vote accepted

The caller may invoke C_GetMechanismInfo for a mechanism that does not appear in the list returned by C_GetMechanisList, where the latter "... is used to obtain a list of mechanism types supported by a token".

I believe that's the reason they added the adverb possibly.

I am not sure what you refer to as "temporary disabled". To me, if the token is not in a state that allows a certain mechanism (temporarilly or permanently), C_GetMechanismInfo should return CKR_MECHANISM_INVALID or at the very least not CKR_OK.

share|improve this answer
Thanks. On Solaris, one mechanism can be disabled by the cryptoadm command. – whjm Sep 2 '13 at 2:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.