<div dir="ltr">Potentially. They're definitely part of the spec ( <a href="http://www.emc.com/emc-plus/rsa-labs/standards-initiatives/otp-pcks-11-pkcs-11-for-one-time-password-tokens.htm">http://www.emc.com/emc-plus/rsa-labs/standards-initiatives/otp-pcks-11-pkcs-11-for-one-time-password-tokens.htm</a> )</div> <div class="gmail_extra"> <div class="gmail_quote">On Thu, Apr 17, 2014 at 10:37 AM, Daniel Kahn Gillmor <<a href="mailto:dkg@fifthhorseman.net" target="_blank">dkg@fifthhorseman.net</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi p11-kit folks-- i was looking at the source for truecrypt [0], and it appears to use pkcs11.h. Looking at their source code, Common/SecurityToken.cpp appears to rely on two #defines that seem like they should belong to PKCS#11, but aren't in pkcs11.h from p11-kit. In particular, the following two symbols aren't resolved: CKR_NEW_PIN_MODE and CKR_NEXT_OTP I don't understand the history of PCKS#11 well enough to know what the background is here. But i do note that bind9 appears to define them this way: /* The following return values are new for PKCS #11 v2.20 amendment 3 */ #define CKR_NEW_PIN_MODE 0x000001B0 #define CKR_NEXT_OTP 0x000001B1 Should these be added to pkcs11.h for p11-kit? Regards, --dkg [0] <a href="http://www.truecrypt.org/downloads2" target="_blank">http://www.truecrypt.org/downloads2</a> [1] <a href="http://sources.debian.net/src/bind9/1:9.9.3.dfsg.P2-4/bin/pkcs11/include/pkcs11t.h?hl=1194#L1194" target="_blank">http://sources.debian.net/src/bind9/1:9.9.3.dfsg.P2-4/bin/pkcs11/include/pkcs11t.h?hl=1194#L1194</a> _______________________________________________ p11-glue mailing list <a href="mailto:p11-glue@lists.freedesktop.org">p11-glue@lists.freedesktop.org</a> <a href="http://lists.freedesktop.org/mailman/listinfo/p11-glue" target="_blank">http://lists.freedesktop.org/mailman/listinfo/p11-glue</a> </blockquote></div> </div>