When verifying an OTP value using the CKM_ACTI mechanism, pSignature shall be set to the OTP value itself, e.g. the value of the CK_OTP_VALUE component of a CK_OTP_PARAMS structure in the case of an earlier call to C_Sign. CT-KIP Principles of Operation Figure : PKCS #11 and CT-KIP integration Figure 3 shows an integration of PKCS #11 into an application that generates cryptographic keys through the use of CT-KIP. The application invokes C_DeriveKey to derive a key of a particular type on the token. The key may subsequently be used as a basis to e.g., generate one-time password values. The application communicates with a CT-KIP server that participates in the key derivation and stores a copy of the key in its database. The key is transferred to the server in wrapped form, after a call to C_WrapKey. The server authenticates itself to the client and the client verifies the authentication by calls to C_Verify. Mechanisms The following table shows, for the mechanisms defined in this document, their support by different cryptographic operations. For any particular token, of course, a particular operation may well support only a subset of the mechanisms listed. There is also no guarantee that a token that supports one mechanism for some operation supports any other mechanism for any other operation (or even supports that same mechanism for any other operation). Table 137: CT-KIP Mechanisms vs. applicable functions Functions Encrypt Sign SR Gen. Wrap Mechanism & & & Digest & Derive Key/ Decrypt Verify VR1 Unwrap Key Pair CKM_KIP_DERIVE CKM_KIP_WRAP CKM_KIP_MAC The remainder of this section will present in detail the mechanisms and the parameters that are supplied to them. Definitions Mechanisms: CKM_KIP_DERIVE CKM_KIP_WRAP CKM_KIP_MAC
When verifying an OTP value using the CKM_ACTI mechanism, pSignature shall be set to the OTP value itself, e.g. the value of the CK_OTP_VALUE component of a CK_OTP_PARAMS structure in the case of an earlier call to C_Sign. CT-KIP Principles of Operation Figure : PKCS #11 and CT-KIP integration Figure 3 shows an integration of PKCS #11 into an application that generates cryptographic keys through the use of CT-KIP. The application invokes C_DeriveKey to derive a key of a particular type on the token. The key may subsequently be used as a basis to e.g., generate one-time password values. The application communicates with a CT-KIP server that participates in the key derivation and stores a copy of the key in its database. The key is transferred to the server in wrapped form, after a call to C_WrapKey. The server authenticates itself to the client and the client verifies the authentication by calls to C_Verify. Mechanisms The following table shows, for the mechanisms defined in this document, their support by different cryptographic operations. For any particular token, of course, a particular operation may well support only a subset of the mechanisms listed. There is also no guarantee that a token that supports one mechanism for some operation supports any other mechanism for any other operation (or even supports that same mechanism for any other operation). Table 137: CT-KIP Mechanisms vs. applicable functions Functions Mechanism Encrypt & Decrypt Sign & Verify SR & VR1 Digest Gen. Key/ Key Pair Wrap & Unwrap Derive CKM_KIP_DERIVE CKM_KIP_WRAP CKM_KIP_MAC The remainder of this section will present in detail the mechanisms and the parameters that are supplied to them. Definitions Mechanisms: CKM_KIP_DERIVE CKM_KIP_WRAP CKM_KIP_MAC