Disabling Key object usage in PKCS#11

Question

I wanted to know if there is a way a disable a particular operation on a PKCS#11 Object. For instance, I create an Object (AES Key) using C_CreateObject. I would want to set some property in this object that pauses/ disables the use of this object for any encryption/ decryption use. Is this possible? Can we set the CKA_DECRYPT value to CK_FALSE to disable Decrypt operations? Also can this be changed multiple times using C_SetAttributeValue

Answer 1

Theoretically PKCS#11 standard don't restrict your from changing values of properties.

Practically your possibility to change the values after object created dependent on your PKCS#11 provider.

My suggestion that this property is immutable.

Try to set this values during creation of key or change values during copying of key object using C_CopyObject .

Another solution is to implement your own PKCS#11 proxy library with custom logic inside of PKCS#11 exported functions.