Subject: pktool symmetric key enhancements [PSARC/2007/465 FastTrack timeout 08/23/2007]
To:      PSARC-ext@Sun.Com
Cc:      kmf-core@sun.com
Bcc:     one-pager-list@sac.sfbay one-pager-log@sac.sfbay sac-bar@sac.sfbay


Template Version: @(#)sac_nextcase 1.64 07/13/07 SMI
This information is Copyright 2007 Sun Microsystems
1. Introduction
    1.1. Project/Component Working Name:
	 pktool symmetric key enhancements
    1.2. Name of Document Author/Supplier:
	 Author:  Wyllys Ingersoll
    1.3  Date of This Document:
	16 August, 2007
4. Technical Description

Fast Track Proposal:  pktool symmetric key import/export enhancements

Summary:
   The ability to import and export symmetric keys to and from 
PKCS#11 tokens is limited in the current pktool(1) utility.  This
case proposes new command line options to enhance this ability.  
This case documents the changes to the CLI that are required 
to implement the import/export feature properly.

Release Taxonomy:  micro/patch
Interface Taxonomy: Evolving

Changes:
	Export operation:
	* add ability to specify the object type as a 'cert' or a 'key'.
	* add ability specify "raw" as the output format when exporting
	  symmetric keys to a file.  A "raw" file is just the raw binary
	  key data, it has no meta-data associated with it.

	Import operation:
	* Add ability to specify a keytype for importing  symmetric keys.
	  This is needed because raw binary symmetric key data has no
	  metadata to identify it as a particular type of key.  The caller
	  can specify any format (as long as the size of the data does not
	  conflict with the type of key being assigned).
	* Add ability to specify a symmetric key as "sensitive" or "not-extractable"
	  when the object is stored in the PKCS#11 token.

Man Page Differences:
            pktool export keystore=pkcs11
                         outfile=output-fn
-                        [label=cert-label]
+                        [label=label]
+                        [objtype=cert|key]
                         [subject=subject-DN]
                         [issuer=issuer-DN]
                         [serial=hex-serial-number]
-                        [outformat=pem|der|pkcs12]
+                        [outformat=pem|der|pkcs12|raw]
                         [token=token[:manuf[:serial]]]

            pktool import [keystore=pkcs11]
                         infile=input-fn
-                        label=cert-label
+                        label=object-label
+                        [keytype=aes|arcfour|des|3des|generic]
+                        [sensitive=y|n]
+                        [extractable=y|n]
                         [token=token[:manuf[:serial]]]
-                        [objtype=cert]
+                        [objtype=cert|key]

6. Resources and Schedule
    6.4. Steering Committee requested information
   	6.4.1. Consolidation C-team Name:
		ON
    6.5. ARC review type: FastTrack
    6.6. ARC Exposure: open