Re: [pkcs11] fwd: CKM_PKCS5_PBKD2_PARAMS struct: password length

[Tim Hudson <tjh@cryptsoft.com>]

On 13/04/2013 11:20 AM, Michael StJohns wrote:
> Fix attached.

That isn't a "fix" - that's a way to keep the problem repeating itself
again and again.

The existing structure should be renamed and the mechanism value changed
so that new users of the 2.40 header files get the right usage.
To use a deprecated mechanism should require code changes in the
consumers of the interface.

We do not want any usage of the broken (non-interoperable) interface to
occur for users who recompile existing consumers of the API against the
v2.40 header file.

This isn't a gentle deprecation content - anyone using the interface
that isn't completely sure that both the producer and consumer of the
interface have exactly the same interpretation is non-interoperable -
this interface is simply broken.

Changing the mechanism value to a new one so that previous binary users
of the interface can continue to hope that it works with the same level
of non-guarantee as currently will be supported. So a producer of the
API can support both old and new interfaces (accepting
non-interoperability) but v2.40 and beyond get sorted out.

Tim.