General-length SHA-224-HMAC

The general-length SHA-224-HMAC mechanism, denoted CKM_SHA224_HMAC_GENERAL, is the same as the general-length SHA-1-HMAC mechanism except that it uses the HMAC construction based on the SHA-224 hash function and length of the output should be in the range 0-28. The keys it uses are generic secret keys and CKK_SHA224_HMAC. FIPS-198 compliant tokens may require the key length to be at least 14 bytes; that is, half the size of the SHA-224 hash output.

It has a parameter, a CK_MAC_GENERAL_PARAMS, which holds the length in bytes of the desired output. This length should be in the range 0-28 (the output size of SHA-224 is 28 bytes). FIPS-198 compliant tokens may constrain the output length to be at least 4 or 14 (half the maximum length). Signatures (MACs) produced by this mechanism will be taken from the start of the full 28-byte HMAC output.

Table 258, General-length SHA-224-HMAC: Key And Data Length
Function Key type Data length Signature length

C_Sign generic secret Any 0-28, depending on parameters

C_Verify generic secret Any 0-28, depending on parameters

RSA Security Inc. Public-Key Cryptography Standards - PKCS#11 - v230

Function	Key type	Data length	Signature length
C_Sign	generic secret	Any	0-28, depending on parameters
C_Verify	generic secret	Any	0-28, depending on parameters