Subject: [KEYPROV] Mapping PKCS #11 to On-line Provisioning

From: Anders Rundgren <[email-masked]>
Date: Sun, 14 Mar 2010 17:53:55 +0100

For token tech freaks only:

Another reason why I have come to the conclusion that existing token APIs
should be kept as is, and rather be augmented by a specific 
*Provisioning API*,
is the fact that token "initialization" is usually performed by an SO 
(Security Officer
using PKCS #11 terminology), which squarely matches a scenario with a User
associated with any number of independent Issuers/Service Providers.

Upgrading the middleware to become an SO or making the User an implicit SO
seems like a pretty nasty hack; it is more logical transforming the 
"technical" part
of the SO role to a thing between the *token* and the Issuer, at least 
if we are
talking cloud services.

That though presumes that tokens become slightly more "intelligent" than
they are today.  Based on my initial experiments, this looks quite 
doable and
shouldn't be particularly costly either.

thanx
Anders