Re: [pkcs11] Groups - Pub from Priv draft 2 uploaded

[Robert Relyea <rrelyea@redhat.com>]

On 2/8/23 3:38 AM, Dieter Bong wrote:

Bob, all,

Â

Here my questions and comments to the Pub-from-Priv proposal:

• Line 204: typo Pubic -> Public

    That's typo we should scan for in our overall document!

• Line 218: Should CKA_DESTROYABLE default to CK_FALSE? Or should it be set to CKA_DESTROYABLE of the private key?

This is one that needs discussion. I figured the public key you generated was going to be a fresh copy and not something burned in a ROM somewhere. I suppose the token could implement it by having a non-destroyable copy in ROM already and just returning that, but in that case the application would have just found it with the CKA_ID (Well NSS would have anyway. It does the search before it calls PubFromPriv). Any that would be a case where the default could be token specific?

bob