Re: [opensc-devel] implementation of the function C_DestroyObject

[Service Développement]

Nils Larsch a écrit : Service Développement wrote: ... Index: E:/Sources/opensc/svn_trunk/src/pkcs15init/pkcs15-init.h =================================================================== --- E:/Sources/opensc/svn_trunk/src/pkcs15init/pkcs15-init.h    (r‚vision 3114) +++ E:/Sources/opensc/svn_trunk/src/pkcs15init/pkcs15-init.h    (copie de travail) @@ -259,6 +259,11 @@      const char *        app_label;      struct sc_object_id    app_oid;   +      /* This flag receives SC_PKCS15_CO_FLAG_PRIVATE (if data object is created with +        * CKA_PRIVATE to TRUE). Because data object can be private or not. +        * This flag is passed then to the object's flags.*/ +      int flags; +      sc_pkcs15_der_t        der_encoded; /* Wrong name: is not DER encoded */  };   why not use the auth_id field (i.e. if it's empty the object is protected by a auth object ... normally a PIN) ? Cheers, Nils _______________________________________________ opensc-devel mailing list opensc-devel@lists.opensc-project.org http://www.opensc-project.org/mailman/listinfo/opensc-devel Hi Nils, I agree with you that objects are created with PIN protection if auth_id is empty. But, it's not the goal of this modification. The pkcs#11 documentation says that "The common Objects attributes CKA_CLASS, CKA_TOKEN, CKA_PRIVATE, CKA_LABEL must be specified when object is created." So, my application have to create some data objects with the attribute CKA_PRIVATE to TRUE, and others with CKA_PRIVATE to FALSE. Without this modification (flag receive SC_PKCS15_CO_FLAG_PRIVATE), when this application list the differents created data objects, all of them  have the CKA_PRIVATE attribute to  FALSE !! Why ? Because, by default, data objects in pkcs#15 are created with DEFAULT_DATA_FLAGS (0x02) in the function sc_pkcs15init_new_object. The CKA_PRIVATE attribute is not managed between the opensc pkcs#11 structure and the differents pkcs#15 structures. there is no parameter to change it. That's why i added this modification. I think that if PKCS#11 allows the management of CKA_PRIVATE attribute, the PKCS#15 have to manage it too. Maybe there is another solution with the existing parameters, but i didn't find how to do it... So, to conclude, this modification is not made for protecting the data objects, but it allows an application to differentiate private data and public data. Cheers, -- Vincent WYON   Dhimyotis 5 allée des écuries 59650 Villeneuve d'ascq tél.   : 03 20 79 24 09 www.dhimyotis.com   ============================================= Ce mail est signé électroniquement grâce au système Certigna. Il a valeur légale. Pour plus d'informations, connectez-vous à : http://www.certigna.com =============================================

smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
opensc-devel mailing list
opensc-devel@lists.opensc-project.org
http://www.opensc-project.org/mailman/listinfo/opensc-devel