pkcs11 — archive

[Gil Abel]

> Anyone else have insight as the reasoning here why CKU_SO + read-only sessions were originally disallowed? Yes, the reason is that if 'RO SO Functions' sessions would be allowed, they would have been identical in behavior to 'RO Public Session' sessions. Here is way. Let's assume we define those 2 types of sessions, the behavior would have been as follows: - Session objects: RW access to session objects is always granted, regardless if the session is RO or RW (so we can forget about them for this discussions). - Public Objects: both session types (assuming defined), would have allowed RO access to public objects. - Private Objects: both session would NOT have allowed any type of access to private objects (which require the User's PIN). So having a RO public session, and then logging on as SO to that session would have changed nothing, the same access would have remain, which makes this type of session meaningless.... Gil.