Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Solaris there's a function pkcs11_PasswdToKey() which is a wrapper of C_GenerateKey(). I made a simple test and it turned out that pkcs11_PasswdToKey() only supports following CKK_types:


From my understanding, other symmetric ciphers (like CKK_IDEA) should also be supported. Can anyone make some clarification?

share|improve this question
up vote 0 down vote accepted

I am not familiar with that specific Solaris library (is that a software token?).

However, what I can say is that PKCS#11 does not set any minimum requirement for the algorithms that a certain implementation should offer. CKK_IDEA could be supported, but only if the implementer chooses to. For instance, up to a few years ago, IDEA was patented and it was often not included in libraries and devices for legal reasons.

Besides, that is there any good reason not to use CKK_AES? That is the best choice in most cases.

share|improve this answer
Thanks. I believe you're right that it's implementation dependent. – whjm May 15 '13 at 5:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.