Re: [External] : [pkcs11] FIPS indicators

[Darren J Moffat <Darren.Moffat@Oracle.com>]

Why would we need a new function for an FIPS indicator ?

For a session could we use a flag that can be reported via the CK_SESSION_INFO ?

Similarly a flag for CK_MECHANISM_INFO to indicate if the slot/token combination allows it to provide services in a FIPS 140 compatible way.

Then for keys an attribute CKA_FIPS140_3 that takes an appropriate value, maybe similar to how CKA_ALWAYS_SENSITIVE works.

What am I missing with the above that a new C_GetFIPSStatus() provides that the above doesn't ?

Darren