Security Officer (SO)

Many users may be assigned this role. There will be one per user slot. The SO has the following abilities:

>Set the initial User PIN value (SO cannot change it later)

>Reset (re-initialize) the Token (destroys all keys and the User PIN on the Token) and set a new label

>Set the CKA_TRUSTED attribute on a Public object

>Set the CKA_EXPORT attribute on a Public object

>Exercise cryptographic services with Public objects

>Create, destroy, import, export, generate and derive Public objects

>May change his/her own PIN