Re: [pkcs11] Groups - Slides: PKCS #11 AEAD Functions at 2014-02-28 F2F uploaded

On 2/28/2014 12:52 PM, Wan-Teh Chang
      wrote:

    

     Submitter's message

      I will be using these slides for my talk on PKCS #11 AEAD
      functions at the F2F meeting today. 

      -- Wan-Teh Chang
      
        
          

             Document Name:
              Slides:
                PKCS #11 AEAD Functions at 2014-02-28 F2F

               Description

              Wan-Teh Chang's presentation slides on PKCS #11 AEAD
              functions at the F2F

              meeting on 2014-02-28 

              Download
                Latest Revision

              Public
                Download Link

               Submitter:
              Wan-Teh Chang

              Group: OASIS PKCS 11 TC

              Folder: Documents

              Date submitted: 2014-02-28 09:52:38

              

            
          

        
      
    
    

    I did a review pass on the spec document for this proposal, not the
    slides (couldn't find the email announcing the upload so I could
    reply to it) and the annotated version is attached.   It's getting
    closer to my proposal and I noted some areas where it still needs
    improvement.  I wouldn't go forward with this without adding the
    message based calls for Sign and Verify for example.

    

    With respect to the API, I wouldn't attempt to reuse any current API
    calls to implement either AEAD or message based stuff.  The hard
    decision is to open up the API to change - once you do that its
    simply a matter of crafting the set of calls that you need rather
    than trying to impedence match the new functions to the old API.

    

    With respect to the proposal, I think a single pair of
    C_NewAssociation and C_CloseAssociation API calls will work to cover
    all of encrypt, decrypt, sign and verify rather than
    C_NewEncryptAssociation, C_NewSignAssociation etc....  If you think
    of the C_EncryptMessage and C_SignMessage as macros for a
    C_EncryptInit/C_Encrypt which use data from the association, I can't
    see any reason why you need a new association function per message
    type.

    

    Mike

    

  

Attachment:
PKCS11MessageBasedEncryption20140311-msj.pdf

Description: Adobe PDF document