Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

According to PKCS#11 v2.20, "C_GetMechanismInfo obtains information about a particular mechanism possibly supported by a token." Does that mean C_GetMechanismInfo() can return CKR_OK on a temporarily disabled mechanism? For example, if C_GetMechanismList() does not return CKM_MD5 in the result then is it OK for C_GetMechanismInfo(CKM_MD5) to return CKR_OK?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The caller may invoke C_GetMechanismInfo for a mechanism that does not appear in the list returned by C_GetMechanisList, where the latter "... is used to obtain a list of mechanism types supported by a token".

I believe that's the reason they added the adverb possibly.

I am not sure what you refer to as "temporary disabled". To me, if the token is not in a state that allows a certain mechanism (temporarilly or permanently), C_GetMechanismInfo should return CKR_MECHANISM_INVALID or at the very least not CKR_OK.

share|improve this answer
    
Thanks. On Solaris, one mechanism can be disabled by the cryptoadm command. –  bzjywhjm Sep 2 '13 at 2:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.