Patrick wrote: > The NSS documentation reflects that a user application can define a password > callback function using the PK11_SetPasswordFunc function. That's fine, > and I did that. But what exactly happens to the password returned by my > callback function? Does NSS properly deletes it out of memory when no longer > needed? I think the answer is yes, but when exactly does NSS do that? On > NSS_shutdown?
The password is used to log into your token, then it is immediately trashed. NSS no longer keeps the password around. The various tokens, however, may keep the password around in various forms. The softoken (NSS Internal Cert and Private Key store) keeps the PBE generated by the password around once it is logged in. This gets tossed when you log out of the softoken. > *More importantly*, is there a way for me to delete the password out of NSS' > memory, and force NSS to call my callback function each and every time it > needs the password? It depends on what you mean by 'each and every time it needs the password'. If you mean 'whenever the NSS library needs a passord to authenticate to a token', then you have that semantic by default. NSS does not remember passwords. If you pull a token from a slot and re-insert the same token (logging it out), you will get a password prompt again for that same token. If you mean 'whenever the NSS library goes to do a private key operation', then you can control that by setting the appropriate password check option on the desired token. Tokens without any option default to the option set on the internal key database. Those options are: ask once (default), timeout after a specified period of time, and ask every. The last option will give you the semantics described above. If you mean 'whenever the NSS library would normally check for the need to authenticate' there is not easy way to do this. You probably don't want this anyway. In a typical operation, NSS may check this status several times, particularly if we are decrypting an S/MIME message. bob > > -- P > > > >
