<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=GB2312" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
BODY {
LINE-HEIGHT: 1.5; FONT-FAMILY: ËÎÌå; COLOR: #000080; FONT-SIZE: 10.5pt
}
</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18702"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>>Generating keys is defined in pkcs#11, not doing it would mean you are not</DIV>
<DIV>>supporting pkcs#11.</DIV>
<DIV> </DIV>
<DIV>They said they supported pkcs#11, but they do some extra things to avoid
creating</DIV>
<DIV>keys using the API directly, it's for security purpose they said.</DIV>
<DIV> </DIV>
<DIV>>"your APIs" = pkcs#11 and HSM vendors should support that.</DIV>
<DIV> </DIV>
<DIV>So the vendor does some tricks to the using of pkcs#11? For security
purpose,Do the</DIV>
<DIV>vendors's HSMs you have tested had some special limitations for key
generation?</DIV>
<DIV> </DIV>
<DIV>
<DIV>>OpenDNSSEC lists a bunch a HSMs that work with it and AFAICT they all</DIV>
<DIV>>do pkcs#11.</DIV>
<DIV> </DIV>
<DIV>I think the vendor we have been talking to in our country abides the rules
of some</DIV>
<DIV>authorities, and we are afraid that foreign products may not pass the
authentication</DIV>
<DIV>of the security authority here.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>Best regards,</DIV>
<DIV>Stuart</DIV></DIV>
<DIV> </DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0cm; PADDING-LEFT: 0cm; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<DIV
style="PADDING-BOTTOM: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px; BACKGROUND: #efefef; COLOR: #000000; FONT-SIZE: 12px; PADDING-TOP: 8px">
<DIV><B>From:</B> <A href="mailto:miek@miek.nl">Miek Gieben</A></DIV>
<DIV><B>Date:</B> 2012-10-08 14:40</DIV>
<DIV><B>To:</B> <A href="mailto:shuoleo@126.com">Áõ˶</A></DIV>
<DIV><B>CC:</B> <A
href="mailto:opendnssec-user@lists.opendnssec.org">opendnssec-user</A></DIV>
<DIV><B>Subject:</B> Re: [Opendnssec-user]</DIV></DIV></DIV>
<DIV>
<DIV>[ Quoting <shuoleo@126.com> in "[Opendnssec-user]..." ]</DIV>
<DIV>> Hi all,</DIV>
<DIV>> </DIV>
<DIV>> Take key generation for example, the vendors' HSM devices allow create keys</DIV>
<DIV>> with</DIV>
<DIV>> software API though they are both using PKCS#11, keys in HSM devices must be</DIV>
<DIV>> created manually with administrator permission and it is the same case with</DIV>
<DIV> </DIV>
<DIV>Generating keys is defined in pkcs#11, not doing it would mean you are not</DIV>
<DIV>supporting pkcs#11.</DIV>
<DIV> </DIV>
<DIV>> And we also found out that HSM device do not support <TokenLabel> which is used</DIV>
<DIV>> by</DIV>
<DIV>> SoftHSM's slot, only KeyLabel is supported, that means it designate a specific</DIV>
<DIV>> key to do the signing work instead of the keys in a slot. </DIV>
<DIV>> </DIV>
<DIV>> people can do their own programming work with your APIs if they exist in order</DIV>
<DIV>> to adapt with HSM devices?</DIV>
<DIV> </DIV>
<DIV>"your APIs" = pkcs#11 and HSM vendors should support that.</DIV>
<DIV> </DIV>
<DIV>> Are there any body ever met the problem as ours?</DIV>
<DIV> </DIV>
<DIV>OpenDNSSEC lists a bunch a HSMs that work with it and AFAICT they all</DIV>
<DIV>do pkcs#11.</DIV>
<DIV> </DIV>
<DIV> Regards,</DIV>
<DIV> </DIV>
<DIV>-- </DIV>
<DIV> Miek Gieben http://miek.nl</DIV>
<DIV> </DIV></DIV></BODY></HTML>