PKCS#11
|
| Cryptographic Token Interface Standard |
PKCS#11 |
SHA-1-PBA for SHA-1-HMAC, denoted CKM_PBA_SHA1_WITH_SHA1_HMAC, is a mechanism used for generating a 160-bit generic secret key from a password and a salt value by using the SHA-1 digest algorithm and an iteration count. The method used to generate the key is described above.
It has a parameter, a CK_PBE_PARAMS structure. The parameter specifies the input information for the key generation process. The parameter also has a field to hold the location of an application-supplied buffer which will receive an IV; for this mechanism, the contents of this field are ignored, since authentication with SHA-1-HMAC does not require an IV.
The key generated by this mechanism will typically be used for computing a SHA-1 HMAC to perform password-based authentication (not password-based encryption). At the time of this writing, this is primarily done to ensure the integrity of a PKCS #12 PDU.