[Opendnssec-user] Question about P11Attributes checks

[Dave Fine]

Hello,

I have a question regarding P11Attributes.h the SoftHSMv2 code base. In
this file, there is an enum that defines a number of `ck` checks. As an
example, ck1 seems to be reserved for when an attribute is required while
creating an object. Therefore, I would expect ck1 to be set on P11Attribute
child classes such as P11AttrClass, and P11AttrToken (to enforce requiring
CKA_CLASS and CKA_TOKEN). However, I see that ck1 is not used for
P11AttrToken. Instead I see P11AttrCertificateType uses a ck1 check, which
is not something I would think be required when creating an object. For
example, why would CKA_CERTIFICATE_TYPE be required, if you were creating a
key object?

Could someone clear up how the `ck` checks are supposed to be used? Perhaps
I am not understanding it correctly.

Thank you,
-Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opendnssec.org/pipermail/opendnssec-user/attachments/20171011/2f9fa3c9/attachment.htm>