According to PKCS#11 v2.20, "C_GetMechanismInfo obtains information about a particular mechanism possibly supported by a token." Does that mean C_GetMechanismInfo() can return CKR_OK on a temporarily disabled mechanism? For example, if C_GetMechanismList() does not return CKM_MD5 in the result then is it OK for C_GetMechanismInfo(CKM_MD5) to return CKR_OK?


The caller may invoke C_GetMechanismInfo for a mechanism that does not appear in the list returned by C_GetMechanisList, where the latter "... is used to obtain a list of mechanism types supported by a token".

I believe that's the reason they added the adverb possibly.

I am not sure what you refer to as "temporary disabled". To me, if the token is not in a state that allows a certain mechanism (temporarilly or permanently), C_GetMechanismInfo should return CKR_MECHANISM_INVALID or at the very least not CKR_OK.

| improve this answer | |
  • $\begingroup$ Thanks. On Solaris, one mechanism can be disabled by the cryptoadm command. $\endgroup$ – pynexj Sep 2 '13 at 2:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.