Just a few comments: 1. How about change ""userKey" to "<tokenType>", and "signing" to "<keyType>? +The following property specifies the CUID shown in the certificate. + +.B op.enroll.userKey.keyGen.signing.cuid_label + +The following property specifies the token name. +All resulting labels for co-existing keys on the same token must be unique. + +.B op.enroll.userKey.keyGen.signing.label 2. How about replace all reference of "RA" (an outdated name for "TPS") with "TPS"? 3. We added support for ECC, so a couple params added to the mix (I have my understanding of what they are, but it's best to ask Jack to provide official info on those two) : +The following properties specify the key usage and which PIN user should be granted. + +.nf *+.B op.enroll.<tokenType>.keyGen.<keyType>.alg=1** **+.B op.enroll.<tokenType>.keyGen.<keyType>.keySize=1024* +.B op.enroll.<tokenType>.keyGen.<keyType>.keyUsage=0 +.B op.enroll.<tokenType>.keyGen.<keyType>.keyUser=0 +.fi 3. Same comment from 1 for the following: +There is a special case of tokenType userKeyTemporary. +Make sure the profile specified by the profileId to have +short validity period (e.g. 7 days) for the certificate. + +.nf +.B op.enroll.userKey.keyGen.signing.publisherId=fileBasedPublisher +.B op.enroll.userKeyTemporary.keyGen.signing.publisherId=fileBasedPublisher +.f 4. You asked me about the following, I think I just realized what it was now. Its for things like op.enroll.userKey.keyGen.signing.recovery.destroyed.scheme=GenerateNewKey so, a generic thing is: op.enroll.<tokenType>.keyGen.<keyType>.recovery.<tokenState>.scheme=GenerateNewKey +The three recovery schemes supported are: + \fBGenerateNewKey\fR - Generate a new cert for the encryption cert. + \fBRecoverLast\fR - Recover the most recent cert for the encryption cert. + \fBGenerateNewKeyandRecoverLast\fR - Generate new cert AND recover last for encryption cert. 5. for the following you might want to add a generic thing as well: e.g. op.enroll.<tokenType>.renewal.* +.SS Token Renewal 5. There seems to be profile-related comments for "Format Operation For tokenKey" and "Pin Reset Operation For CoolKey". Are they significant enough to be added? thanks, Christina On 05/07/2014 10:49 AM, Endi Sukma Dewata wrote:

Edewata info about ecc params below: thanks, jack ----- Original Message ----- For ECC the keySizes we support are 256, 384. Theoretically we could do 521, but I'm not sure we tested that yet, so just put the first two. The algs are as follows: ALG_EC_F2M = 4, ALG_EC_FP = 5 These are just two different types of EC algs. We really only support ALG_EC_FP_5 = 5 though. so you can either emphasize that or just leave out the other one for now.

Hi Endi, Just a couple things: 1. I still see "userKey" in the patch, like +.B op.pinReset.userKey.update.applet.emptyToken.enable=false, do you think need to be made generic <tokenType>? 2. also, what happened to the "ECC alg should use 5" message? It's supposed to be in there right? 3. for this line: +.B op.format.tokenKey.update.applet.emptyToken.enable=false, is "tokenKey" supposed to be "<tokenType>"? ACK. thanks, Christina On 05/15/2014 02:21 PM, Endi Sukma Dewata wrote: