Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-11551

p11tool manpage is not in line with 'PKCS #11 URI Matching Guidelines'

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • rhel-9.0.0
    • gnutls
    • None
    • Low
    • rhel-sst-security-crypto
    • ssg_security
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None

      Description of problem:

      p11tool manpage is written in a way that implies that only one Token is specified by URL, however, PKCS #11 URI allows matching rules (see https://datatracker.ietf.org/doc/html/rfc7512#section-2.5) that allows one URI to match multiple tokens. This should be reflected in p11tool manpage. Incorrect wording is present in multiple sections of manpage and whole manpage should be reviewed. Couple of picked examples and suggested improvements are below.

      Version-Release number of selected component (if applicable):
      gnutls-utils-3.6.14-7.el8_3.x86_64

      Actual state:
      1) Object listing
      --list-all
      List all available objects in a token.
      All objects available in the token will be listed.

      2) Key generation
      --generate-privkey=string
      Generate private-public key pair of given type.
      Generates a private-public key pair in the specified token.

      Suggested improvement:
      1a) Object listing
      --list-all
      List all available objects.
      All available objects will be listed.
      1b) Object listing
      --list-all
      List all available objects in a tokens matching specified URI.
      All objects available in the tokens matching URI will be listed.

      2) Key generation
      --generate-privkey=string
      Generate private-public key pair of given type.
      Generates a private-public key pair in the specified token. Provided URI must match single token.

      Additional info:
      In SYNOPSIS or DESCRIPTION section of manpage, it could be clarified that URI may match multiple tokens and for some operation URI matching single token should be provided. Sentence saying something like "For more details about URIs and matching rules see The PKCS #11 URI Scheme" could be added.

              dueno@redhat.com Daiki Ueno
              mhavrila Marek Havrila (Inactive)
              Daiki Ueno Daiki Ueno
              Alexander Sosedkin Alexander Sosedkin
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: