181570 - Implement PKCS 11 mechanisms for ANSI X9.31

Status: NEW

(NSS :: Libraries, enhancement, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

PKCS11 v2.11 defines the following mechanisms that cite ANSI X9.31

CKM_RSA_X9_31_KEY_PAIR_GEN     0x0000000A
CKM_RSA_X9_31                  0x0000000B
CKM_SHA1_RSA_X9_31             0x0000000C

The latter two mechanisms are used with C_Sign and C_Verify.
X9.31 key pair gen has additional requirements on the prime numbers used
to form the modulus.

It is now desired to add these mechanisms to NSS.

It is not yet known what higher layer security protocols and or certificates
will use X9.31 signatures, and hence what higher layer NSS software will
need to be modified to use these mechanisms.  Perhaps that information
should also be determined before work proceeds on this enhancement.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Marking P3.  Not a vulnerability (It's an RFE), and no known need for it yet.