Re: [pkcs11] Sensitivity and extractability of derived keys

Michael, Can you point me to the section of the spec which mentions 3) ?
Also, I believe 3) is an option, an open option.
You do 3) only if you absolutely need it.
Otherwise, by default, one should not do 3).
Thanks!
-Oscar