randombit/botan | Build 12805544433 | source/src/lib/prov/pkcs11/p11.h | Coveralls

1

/*

2

* PKCS #11

3

* (C) 2016 Daniel Neus, Sirrix AG

4

* (C) 2016 Philipp Weber, Sirrix AG

5

* (C) 2025 Fabian Albert, Rohde & Schwarz Cybersecurity

6

7

* Botan is released under the Simplified BSD License (see license.txt)

8

*/

9

10

#ifndef BOTAN_P11_H_

11

#define BOTAN_P11_H_

12

13

#include <botan/exceptn.h>

14

#include <botan/secmem.h>

15

16

#include <map>

17

#include <string>

18

#include <vector>

19

20

#define CK_PTR *

21

22

#if defined(_MSC_VER)

23

   #define CK_DECLARE_FUNCTION(returnType, name) returnType __declspec(dllimport) name

24

#else

25

   #define CK_DECLARE_FUNCTION(returnType, name) returnType name

26

#endif

27

28

#if defined(_MSC_VER)

29

   #define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType __declspec(dllimport)(*name)

30

#else

31

   #define CK_DECLARE_FUNCTION_POINTER(returnType, name) returnType(*name)

32

#endif

33

34

#define CK_CALLBACK_FUNCTION(returnType, name) returnType(*name)

35

36

#ifndef NULL_PTR

37

   #define NULL_PTR nullptr

38

#endif

39

40

#if defined(_MSC_VER)

41

   #pragma pack(push, cryptoki, 1)

42

#endif

43

44

#include "pkcs11.h"

45

46

#if defined(_MSC_VER)

47

   #pragma pack(pop, cryptoki)

48

#endif

49

50

static_assert(CRYPTOKI_VERSION_MAJOR == 3 && CRYPTOKI_VERSION_MINOR == 2,

51

              "The Botan PKCS#11 module was implemented against PKCS#11 v3.2. Please use the correct PKCS#11 headers.");

52

53

namespace Botan {

54

55

class Dynamically_Loaded_Library;

56

57

namespace PKCS11 {

58

59

using secure_string = secure_vector<uint8_t>;

60

61

enum class AttributeType : CK_ATTRIBUTE_TYPE {

62

   Class = CKA_CLASS,

63

   Token = CKA_TOKEN,

64

   Private = CKA_PRIVATE,

65

   Label = CKA_LABEL,

66

   UniqueId = CKA_UNIQUE_ID,

67

   Application = CKA_APPLICATION,

68

   Value = CKA_VALUE,

69

   ObjectId = CKA_OBJECT_ID,

70

   CertificateType = CKA_CERTIFICATE_TYPE,

71

   Issuer = CKA_ISSUER,

72

   SerialNumber = CKA_SERIAL_NUMBER,

73

   AcIssuer = CKA_AC_ISSUER,

74

   Owner = CKA_OWNER,

75

   AttrTypes = CKA_ATTR_TYPES,

76

   Trusted = CKA_TRUSTED,

77

   CertificateCategory = CKA_CERTIFICATE_CATEGORY,

78

   JavaMidpSecurityDomain = CKA_JAVA_MIDP_SECURITY_DOMAIN,

79

   Url = CKA_URL,

80

   HashOfSubjectPublicKey = CKA_HASH_OF_SUBJECT_PUBLIC_KEY,

81

   HashOfIssuerPublicKey = CKA_HASH_OF_ISSUER_PUBLIC_KEY,

82

   NameHashAlgorithm = CKA_NAME_HASH_ALGORITHM,

83

   CheckValue = CKA_CHECK_VALUE,

84

   KeyType = CKA_KEY_TYPE,

85

   Subject = CKA_SUBJECT,

86

   Id = CKA_ID,

87

   Sensitive = CKA_SENSITIVE,

88

   Encrypt = CKA_ENCRYPT,

89

   Decrypt = CKA_DECRYPT,

90

   Wrap = CKA_WRAP,

91

   Unwrap = CKA_UNWRAP,

92

   Sign = CKA_SIGN,

93

   SignRecover = CKA_SIGN_RECOVER,

94

   Verify = CKA_VERIFY,

95

   VerifyRecover = CKA_VERIFY_RECOVER,

96

   Derive = CKA_DERIVE,

97

   StartDate = CKA_START_DATE,

98

   EndDate = CKA_END_DATE,

99

   Modulus = CKA_MODULUS,

100

   ModulusBits = CKA_MODULUS_BITS,

101

   PublicExponent = CKA_PUBLIC_EXPONENT,

102

   PrivateExponent = CKA_PRIVATE_EXPONENT,

103

   Prime1 = CKA_PRIME_1,

104

   Prime2 = CKA_PRIME_2,

105

   Exponent1 = CKA_EXPONENT_1,

106

   Exponent2 = CKA_EXPONENT_2,

107

   Coefficient = CKA_COEFFICIENT,

108

   PublicKeyInfo = CKA_PUBLIC_KEY_INFO,

109

   Prime = CKA_PRIME,

110

   Subprime = CKA_SUBPRIME,

111

   Base = CKA_BASE,

112

   PrimeBits = CKA_PRIME_BITS,

113

   SubprimeBits = CKA_SUBPRIME_BITS,

114

   SubPrimeBits = CKA_SUB_PRIME_BITS,

115

   ValueBits = CKA_VALUE_BITS,

116

   ValueLen = CKA_VALUE_LEN,

117

   Extractable = CKA_EXTRACTABLE,

118

   Local = CKA_LOCAL,

119

   NeverExtractable = CKA_NEVER_EXTRACTABLE,

120

   AlwaysSensitive = CKA_ALWAYS_SENSITIVE,

121

   KeyGenMechanism = CKA_KEY_GEN_MECHANISM,

122

   Modifiable = CKA_MODIFIABLE,

123

   Copyable = CKA_COPYABLE,

124

   Destroyable = CKA_DESTROYABLE,

125

   EcdsaParams = CKA_ECDSA_PARAMS,

126

   EcParams = CKA_EC_PARAMS,

127

   EcPoint = CKA_EC_POINT,

128

   SecondaryAuth = CKA_SECONDARY_AUTH,

129

   AuthPinFlags = CKA_AUTH_PIN_FLAGS,

130

   AlwaysAuthenticate = CKA_ALWAYS_AUTHENTICATE,

131

   WrapWithTrusted = CKA_WRAP_WITH_TRUSTED,

132

   WrapTemplate = CKA_WRAP_TEMPLATE,

133

   UnwrapTemplate = CKA_UNWRAP_TEMPLATE,

134

   DeriveTemplate = CKA_DERIVE_TEMPLATE,

135

   OtpFormat = CKA_OTP_FORMAT,

136

   OtpLength = CKA_OTP_LENGTH,

137

   OtpTimeInterval = CKA_OTP_TIME_INTERVAL,

138

   OtpUserFriendlyMode = CKA_OTP_USER_FRIENDLY_MODE,

139

   OtpChallengeRequirement = CKA_OTP_CHALLENGE_REQUIREMENT,

140

   OtpTimeRequirement = CKA_OTP_TIME_REQUIREMENT,

141

   OtpCounterRequirement = CKA_OTP_COUNTER_REQUIREMENT,

142

   OtpPinRequirement = CKA_OTP_PIN_REQUIREMENT,

143

   OtpCounter = CKA_OTP_COUNTER,

144

   OtpTime = CKA_OTP_TIME,

145

   OtpUserIdentifier = CKA_OTP_USER_IDENTIFIER,

146

   OtpServiceIdentifier = CKA_OTP_SERVICE_IDENTIFIER,

147

   OtpServiceLogo = CKA_OTP_SERVICE_LOGO,

148

   OtpServiceLogoType = CKA_OTP_SERVICE_LOGO_TYPE,

149

   Gostr3410Params = CKA_GOSTR3410_PARAMS,

150

   Gostr3411Params = CKA_GOSTR3411_PARAMS,

151

   Gost28147Params = CKA_GOST28147_PARAMS,

152

   HwFeatureType = CKA_HW_FEATURE_TYPE,

153

   ResetOnInit = CKA_RESET_ON_INIT,

154

   HasReset = CKA_HAS_RESET,

155

   PixelX = CKA_PIXEL_X,

156

   PixelY = CKA_PIXEL_Y,

157

   Resolution = CKA_RESOLUTION,

158

   CharRows = CKA_CHAR_ROWS,

159

   CharColumns = CKA_CHAR_COLUMNS,

160

   Color = CKA_COLOR,

161

   BitsPerPixel = CKA_BITS_PER_PIXEL,

162

   CharSets = CKA_CHAR_SETS,

163

   EncodingMethods = CKA_ENCODING_METHODS,

164

   MimeTypes = CKA_MIME_TYPES,

165

   MechanismType = CKA_MECHANISM_TYPE,

166

   RequiredCmsAttributes = CKA_REQUIRED_CMS_ATTRIBUTES,

167

   DefaultCmsAttributes = CKA_DEFAULT_CMS_ATTRIBUTES,

168

   SupportedCmsAttributes = CKA_SUPPORTED_CMS_ATTRIBUTES,

169

   AllowedMechanisms = CKA_ALLOWED_MECHANISMS,

170

   ProfileId = CKA_PROFILE_ID,

171

   X2ratchetBag = CKA_X2RATCHET_BAG,

172

   X2ratchetBagsize = CKA_X2RATCHET_BAGSIZE,

173

   X2ratchetBobs1stmsg = CKA_X2RATCHET_BOBS1STMSG,

174

   X2ratchetCkr = CKA_X2RATCHET_CKR,

175

   X2ratchetCks = CKA_X2RATCHET_CKS,

176

   X2ratchetDhp = CKA_X2RATCHET_DHP,

177

   X2ratchetDhr = CKA_X2RATCHET_DHR,

178

   X2ratchetDhs = CKA_X2RATCHET_DHS,

179

   X2ratchetHkr = CKA_X2RATCHET_HKR,

180

   X2ratchetHks = CKA_X2RATCHET_HKS,

181

   X2ratchetIsalice = CKA_X2RATCHET_ISALICE,

182

   X2ratchetNhkr = CKA_X2RATCHET_NHKR,

183

   X2ratchetNhks = CKA_X2RATCHET_NHKS,

184

   X2ratchetNr = CKA_X2RATCHET_NR,

185

   X2ratchetNs = CKA_X2RATCHET_NS,

186

   X2ratchetPns = CKA_X2RATCHET_PNS,

187

   X2ratchetRk = CKA_X2RATCHET_RK,

188

   HssLevels = CKA_HSS_LEVELS,

189

   HssLmsType = CKA_HSS_LMS_TYPE,

190

   HssLmotsType = CKA_HSS_LMOTS_TYPE,

191

   HssLmsTypes = CKA_HSS_LMS_TYPES,

192

   HssLmotsTypes = CKA_HSS_LMOTS_TYPES,

193

   HssKeysRemaining = CKA_HSS_KEYS_REMAINING,

194

   ParameterSet = CKA_PARAMETER_SET,

195

   ValidationFlags = CKA_VALIDATION_FLAGS,

196

   ValidationType = CKA_VALIDATION_TYPE,

197

   ValidationVersion = CKA_VALIDATION_VERSION,

198

   ValidationLevel = CKA_VALIDATION_LEVEL,

199

   ValidationModuleId = CKA_VALIDATION_MODULE_ID,

200

   ValidationFlag = CKA_VALIDATION_FLAG,

201

   ValidationAuthorityType = CKA_VALIDATION_AUTHORITY_TYPE,

202

   ValidationCountry = CKA_VALIDATION_COUNTRY,

203

   ValidationCertificateIdentifier = CKA_VALIDATION_CERTIFICATE_IDENTIFIER,

204

   ValidationCertificateUri = CKA_VALIDATION_CERTIFICATE_URI,

205

   ValidationVendor = CKA_VALIDATION_VENDOR,

206

   ValidationProfile = CKA_VALIDATION_PROFILE,

207

   EncapsulateTemplate = CKA_ENCAPSULATE_TEMPLATE,

208

   DecapsulateTemplate = CKA_DECAPSULATE_TEMPLATE,

209

   TrustServerAuth = CKA_TRUST_SERVER_AUTH,

210

   TrustClientAuth = CKA_TRUST_CLIENT_AUTH,

211

   TrustCodeSigning = CKA_TRUST_CODE_SIGNING,

212

   TrustEmailProtection = CKA_TRUST_EMAIL_PROTECTION,

213

   TrustIpsecIke = CKA_TRUST_IPSEC_IKE,

214

   TrustTimeStamping = CKA_TRUST_TIME_STAMPING,

215

   TrustOcspSigning = CKA_TRUST_OCSP_SIGNING,

216

   Encapsulate = CKA_ENCAPSULATE,

217

   Decapsulate = CKA_DECAPSULATE,

218

   HashOfCertificate = CKA_HASH_OF_CERTIFICATE,

219

   VendorDefined = CKA_VENDOR_DEFINED,

220

};

221

222

enum class CertificateType : CK_CERTIFICATE_TYPE {

223

   X509 = CKC_X_509,

224

   X509AttrCert = CKC_X_509_ATTR_CERT,

225

   Wtls = CKC_WTLS,

226

   VendorDefined = CKC_VENDOR_DEFINED,

227

};

228

229

/// Indicates if a stored certificate is a user certificate for which the corresponding private key is available

230

/// on the token ("token user"), a CA certificate ("authority"), or another end-entity certificate ("other entity").

231

enum class CertificateCategory : CK_ULONG {

232

   Unspecified = CK_CERTIFICATE_CATEGORY_UNSPECIFIED,

233

   TokenUser = CK_CERTIFICATE_CATEGORY_TOKEN_USER,

234

   Authority = CK_CERTIFICATE_CATEGORY_AUTHORITY,

235

   OtherEntity = CK_CERTIFICATE_CATEGORY_OTHER_ENTITY

236

};

237

238

enum class KeyDerivation : CK_ULONG {

239

   Null = CKD_NULL,

240

   Sha1Kdf = CKD_SHA1_KDF,

241

   Sha1KdfAsn1 = CKD_SHA1_KDF_ASN1,

242

   Sha1KdfConcatenate = CKD_SHA1_KDF_CONCATENATE,

243

   Sha224Kdf = CKD_SHA224_KDF,

244

   Sha256Kdf = CKD_SHA256_KDF,

245

   Sha384Kdf = CKD_SHA384_KDF,

246

   Sha512Kdf = CKD_SHA512_KDF,

247

   CpdiversifyKdf = CKD_CPDIVERSIFY_KDF,

248

   Sha3_224Kdf = CKD_SHA3_224_KDF,

249

   Sha3_256Kdf = CKD_SHA3_256_KDF,

250

   Sha3_384Kdf = CKD_SHA3_384_KDF,

251

   Sha3_512Kdf = CKD_SHA3_512_KDF,

252

   Sha1KdfSp800 = CKD_SHA1_KDF_SP800,

253

   Sha224KdfSp800 = CKD_SHA224_KDF_SP800,

254

   Sha256KdfSp800 = CKD_SHA256_KDF_SP800,

255

   Sha384KdfSp800 = CKD_SHA384_KDF_SP800,

256

   Sha512KdfSp800 = CKD_SHA512_KDF_SP800,

257

   Sha3_224KdfSp800 = CKD_SHA3_224_KDF_SP800,

258

   Sha3_256KdfSp800 = CKD_SHA3_256_KDF_SP800,

259

   Sha3_384KdfSp800 = CKD_SHA3_384_KDF_SP800,

260

   Sha3_512KdfSp800 = CKD_SHA3_512_KDF_SP800,

261

   Blake2b160Kdf = CKD_BLAKE2B_160_KDF,

262

   Blake2b256Kdf = CKD_BLAKE2B_256_KDF,

263

   Blake2b384Kdf = CKD_BLAKE2B_384_KDF,

264

   Blake2b512Kdf = CKD_BLAKE2B_512_KDF,

265

};

266

267

enum class Flag : CK_FLAGS {

268

   None = 0,

269

   TokenPresent = CKF_TOKEN_PRESENT,

270

   RemovableDevice = CKF_REMOVABLE_DEVICE,

271

   HwSlot = CKF_HW_SLOT,

272

   Rng = CKF_RNG,

273

   WriteProtected = CKF_WRITE_PROTECTED,

274

   LoginRequired = CKF_LOGIN_REQUIRED,

275

   UserPinInitialized = CKF_USER_PIN_INITIALIZED,

276

   RestoreKeyNotNeeded = CKF_RESTORE_KEY_NOT_NEEDED,

277

   ClockOnToken = CKF_CLOCK_ON_TOKEN,

278

   ProtectedAuthenticationPath = CKF_PROTECTED_AUTHENTICATION_PATH,

279

   DualCryptoOperations = CKF_DUAL_CRYPTO_OPERATIONS,

280

   TokenInitialized = CKF_TOKEN_INITIALIZED,

281

   SecondaryAuthentication = CKF_SECONDARY_AUTHENTICATION,

282

   UserPinCountLow = CKF_USER_PIN_COUNT_LOW,

283

   UserPinFinalTry = CKF_USER_PIN_FINAL_TRY,

284

   UserPinLocked = CKF_USER_PIN_LOCKED,

285

   UserPinToBeChanged = CKF_USER_PIN_TO_BE_CHANGED,

286

   SoPinCountLow = CKF_SO_PIN_COUNT_LOW,

287

   SoPinFinalTry = CKF_SO_PIN_FINAL_TRY,

288

   SoPinLocked = CKF_SO_PIN_LOCKED,

289

   SoPinToBeChanged = CKF_SO_PIN_TO_BE_CHANGED,

290

   ErrorState = CKF_ERROR_STATE,

291

   SeedRandomRequired = CKF_SEED_RANDOM_REQUIRED,

292

   AsyncSessionSupported = CKF_ASYNC_SESSION_SUPPORTED,

293

   RwSession = CKF_RW_SESSION,

294

   SerialSession = CKF_SERIAL_SESSION,

295

   AsyncSession = CKF_ASYNC_SESSION,

296

   ArrayAttribute = CKF_ARRAY_ATTRIBUTE,

297

   Hw = CKF_HW,

298

   MessageEncrypt = CKF_MESSAGE_ENCRYPT,

299

   MessageDecrypt = CKF_MESSAGE_DECRYPT,

300

   MessageSign = CKF_MESSAGE_SIGN,

301

   MessageVerify = CKF_MESSAGE_VERIFY,

302

   MultiMessage = CKF_MULTI_MESSAGE,

303

   MultiMessge = CKF_MULTI_MESSGE,

304

   FindObjects = CKF_FIND_OBJECTS,

305

   Encrypt = CKF_ENCRYPT,

306

   Decrypt = CKF_DECRYPT,

307

   Digest = CKF_DIGEST,

308

   Sign = CKF_SIGN,

309

   SignRecover = CKF_SIGN_RECOVER,

310

   Verify = CKF_VERIFY,

311

   VerifyRecover = CKF_VERIFY_RECOVER,

312

   Generate = CKF_GENERATE,

313

   GenerateKeyPair = CKF_GENERATE_KEY_PAIR,

314

   Wrap = CKF_WRAP,

315

   Unwrap = CKF_UNWRAP,

316

   Derive = CKF_DERIVE,

317

   EcFP = CKF_EC_F_P,

318

   EcF2m = CKF_EC_F_2M,

319

   EcEcparameters = CKF_EC_ECPARAMETERS,

320

   EcOid = CKF_EC_OID,

321

   EcNamedcurve = CKF_EC_NAMEDCURVE,

322

   EcUncompress = CKF_EC_UNCOMPRESS,

323

   EcCompress = CKF_EC_COMPRESS,

324

   EcCurvename = CKF_EC_CURVENAME,

325

   Encapsulate = CKF_ENCAPSULATE,

326

   Decapsulate = CKF_DECAPSULATE,

327

   Extension = CKF_EXTENSION,

328

   EndOfMessage = CKF_END_OF_MESSAGE,

329

   InterfaceForkSafe = CKF_INTERFACE_FORK_SAFE,

330

   LibraryCantCreateOsThreads = CKF_LIBRARY_CANT_CREATE_OS_THREADS,

331

   OsLockingOk = CKF_OS_LOCKING_OK,

332

   DontBlock = CKF_DONT_BLOCK,

333

   NextOtp = CKF_NEXT_OTP,

334

   ExcludeTime = CKF_EXCLUDE_TIME,

335

   ExcludeCounter = CKF_EXCLUDE_COUNTER,

336

   ExcludeChallenge = CKF_EXCLUDE_CHALLENGE,

337

   ExcludePin = CKF_EXCLUDE_PIN,

338

   UserFriendlyOtp = CKF_USER_FRIENDLY_OTP,

339

   HkdfSaltNull = CKF_HKDF_SALT_NULL,

340

   HkdfSaltData = CKF_HKDF_SALT_DATA,

341

   HkdfSaltKey = CKF_HKDF_SALT_KEY,

342

};

343

345

   // NOLINTNEXTLINE(clang-analyzer-optin.core.EnumCastOutOfRange)

347

348

349

enum class MGF : CK_RSA_PKCS_MGF_TYPE {

350

   MgfUnused = 0,

351

   Mgf1Sha1 = CKG_MGF1_SHA1,

352

   Mgf1Sha256 = CKG_MGF1_SHA256,

353

   Mgf1Sha384 = CKG_MGF1_SHA384,

354

   Mgf1Sha512 = CKG_MGF1_SHA512,

355

   Mgf1Sha224 = CKG_MGF1_SHA224,

356

   Mgf1Sha3_224 = CKG_MGF1_SHA3_224,

357

   Mgf1Sha3_256 = CKG_MGF1_SHA3_256,

358

   Mgf1Sha3_384 = CKG_MGF1_SHA3_384,

359

   Mgf1Sha3_512 = CKG_MGF1_SHA3_512,

360

};

361

362

enum class HardwareType : CK_HW_FEATURE_TYPE {

363

   MonotonicCounter = CKH_MONOTONIC_COUNTER,

364

   Clock = CKH_CLOCK,

365

   UserInterface = CKH_USER_INTERFACE,

366

   VendorDefined = CKH_VENDOR_DEFINED,

367

};

368

369

enum class KeyType : CK_KEY_TYPE {

370

   Rsa = CKK_RSA,

371

   Dsa = CKK_DSA,

372

   Dh = CKK_DH,

373

   Ecdsa = CKK_ECDSA,

374

   Ec = CKK_EC,

375

   X942Dh = CKK_X9_42_DH,

376

   Kea = CKK_KEA,

377

   GenericSecret = CKK_GENERIC_SECRET,

378

   Rc2 = CKK_RC2,

379

   Rc4 = CKK_RC4,

380

   Des = CKK_DES,

381

   Des2 = CKK_DES2,

382

   Des3 = CKK_DES3,

383

   Cast = CKK_CAST,

384

   Cast3 = CKK_CAST3,

385

   Cast5 = CKK_CAST5,

386

   Cast128 = CKK_CAST128,

387

   Rc5 = CKK_RC5,

388

   Idea = CKK_IDEA,

389

   Skipjack = CKK_SKIPJACK,

390

   Baton = CKK_BATON,

391

   Juniper = CKK_JUNIPER,

392

   Cdmf = CKK_CDMF,

393

   Aes = CKK_AES,

394

   Blowfish = CKK_BLOWFISH,

395

   Twofish = CKK_TWOFISH,

396

   Securid = CKK_SECURID,

397

   Hotp = CKK_HOTP,

398

   Acti = CKK_ACTI,

399

   Camellia = CKK_CAMELLIA,

400

   Aria = CKK_ARIA,

401

   Md5Hmac = CKK_MD5_HMAC,

402

   Sha1Hmac = CKK_SHA_1_HMAC,

403

   Ripemd128Hmac = CKK_RIPEMD128_HMAC,

404

   Ripemd160Hmac = CKK_RIPEMD160_HMAC,

405

   Sha256Hmac = CKK_SHA256_HMAC,

406

   Sha384Hmac = CKK_SHA384_HMAC,

407

   Sha512Hmac = CKK_SHA512_HMAC,

408

   Sha224Hmac = CKK_SHA224_HMAC,

409

   Seed = CKK_SEED,

410

   Gostr3410 = CKK_GOSTR3410,

411

   Gostr3411 = CKK_GOSTR3411,

412

   Gost28147 = CKK_GOST28147,

413

   Chacha20 = CKK_CHACHA20,

414

   Poly1305 = CKK_POLY1305,

415

   AesXts = CKK_AES_XTS,

416

   Sha3_224Hmac = CKK_SHA3_224_HMAC,

417

   Sha3_256Hmac = CKK_SHA3_256_HMAC,

418

   Sha3_384Hmac = CKK_SHA3_384_HMAC,

419

   Sha3_512Hmac = CKK_SHA3_512_HMAC,

420

   Blake2b160Hmac = CKK_BLAKE2B_160_HMAC,

421

   Blake2b256Hmac = CKK_BLAKE2B_256_HMAC,

422

   Blake2b384Hmac = CKK_BLAKE2B_384_HMAC,

423

   Blake2b512Hmac = CKK_BLAKE2B_512_HMAC,

424

   Salsa20 = CKK_SALSA20,

425

   X2ratchet = CKK_X2RATCHET,

426

   EcEdwards = CKK_EC_EDWARDS,

427

   EcMontgomery = CKK_EC_MONTGOMERY,

428

   Hkdf = CKK_HKDF,

429

   Sha512_224Hmac = CKK_SHA512_224_HMAC,

430

   Sha512_256Hmac = CKK_SHA512_256_HMAC,

431

   Sha512THmac = CKK_SHA512_T_HMAC,

432

   Hss = CKK_HSS,

433

   Xmss = CKK_XMSS,

434

   Xmssmt = CKK_XMSSMT,

435

   MlKem = CKK_ML_KEM,

436

   MlDsa = CKK_ML_DSA,

437

   SlhDsa = CKK_SLH_DSA,

438

   VendorDefined = CKK_VENDOR_DEFINED,

439

};

440

441

enum class MechanismType : CK_MECHANISM_TYPE {

442

   RsaPkcsKeyPairGen = CKM_RSA_PKCS_KEY_PAIR_GEN,

443

   RsaPkcs = CKM_RSA_PKCS,

444

   Rsa9796 = CKM_RSA_9796,

445

   RsaX509 = CKM_RSA_X_509,

446

   Md2RsaPkcs = CKM_MD2_RSA_PKCS,

447

   Md5RsaPkcs = CKM_MD5_RSA_PKCS,

448

   Sha1RsaPkcs = CKM_SHA1_RSA_PKCS,

449

   Ripemd128RsaPkcs = CKM_RIPEMD128_RSA_PKCS,

450

   Ripemd160RsaPkcs = CKM_RIPEMD160_RSA_PKCS,

451

   RsaPkcsOaep = CKM_RSA_PKCS_OAEP,

452

   RsaX931KeyPairGen = CKM_RSA_X9_31_KEY_PAIR_GEN,

453

   RsaX931 = CKM_RSA_X9_31,

454

   Sha1RsaX931 = CKM_SHA1_RSA_X9_31,

455

   RsaPkcsPss = CKM_RSA_PKCS_PSS,

456

   Sha1RsaPkcsPss = CKM_SHA1_RSA_PKCS_PSS,

457

   DsaKeyPairGen = CKM_DSA_KEY_PAIR_GEN,

458

   Dsa = CKM_DSA,

459

   DsaSha1 = CKM_DSA_SHA1,

460

   DsaSha224 = CKM_DSA_SHA224,

461

   DsaSha256 = CKM_DSA_SHA256,

462

   DsaSha384 = CKM_DSA_SHA384,

463

   DsaSha512 = CKM_DSA_SHA512,

464

   DsaSha3_224 = CKM_DSA_SHA3_224,

465

   DsaSha3_256 = CKM_DSA_SHA3_256,

466

   DsaSha3_384 = CKM_DSA_SHA3_384,

467

   DsaSha3_512 = CKM_DSA_SHA3_512,

468

   DhPkcsKeyPairGen = CKM_DH_PKCS_KEY_PAIR_GEN,

469

   DhPkcsDerive = CKM_DH_PKCS_DERIVE,

470

   X942DhKeyPairGen = CKM_X9_42_DH_KEY_PAIR_GEN,

471

   X942DhDerive = CKM_X9_42_DH_DERIVE,

472

   X942DhHybridDerive = CKM_X9_42_DH_HYBRID_DERIVE,

473

   X942MqvDerive = CKM_X9_42_MQV_DERIVE,

474

   Sha256RsaPkcs = CKM_SHA256_RSA_PKCS,

475

   Sha384RsaPkcs = CKM_SHA384_RSA_PKCS,

476

   Sha512RsaPkcs = CKM_SHA512_RSA_PKCS,

477

   Sha256RsaPkcsPss = CKM_SHA256_RSA_PKCS_PSS,

478

   Sha384RsaPkcsPss = CKM_SHA384_RSA_PKCS_PSS,

479

   Sha512RsaPkcsPss = CKM_SHA512_RSA_PKCS_PSS,

480

   Sha224RsaPkcs = CKM_SHA224_RSA_PKCS,

481

   Sha224RsaPkcsPss = CKM_SHA224_RSA_PKCS_PSS,

482

   Sha512224 = CKM_SHA512_224,

483

   Sha512224Hmac = CKM_SHA512_224_HMAC,

484

   Sha512224HmacGeneral = CKM_SHA512_224_HMAC_GENERAL,

485

   Sha512224KeyDerivation = CKM_SHA512_224_KEY_DERIVATION,

486

   Sha512256 = CKM_SHA512_256,

487

   Sha512256Hmac = CKM_SHA512_256_HMAC,

488

   Sha512256HmacGeneral = CKM_SHA512_256_HMAC_GENERAL,

489

   Sha512256KeyDerivation = CKM_SHA512_256_KEY_DERIVATION,

490

   Sha512T = CKM_SHA512_T,

491

   Sha512THmac = CKM_SHA512_T_HMAC,

492

   Sha512THmacGeneral = CKM_SHA512_T_HMAC_GENERAL,

493

   Sha512TKeyDerivation = CKM_SHA512_T_KEY_DERIVATION,

494

   Sha3_256RsaPkcs = CKM_SHA3_256_RSA_PKCS,

495

   Sha3_384RsaPkcs = CKM_SHA3_384_RSA_PKCS,

496

   Sha3_512RsaPkcs = CKM_SHA3_512_RSA_PKCS,

497

   Sha3_256RsaPkcsPss = CKM_SHA3_256_RSA_PKCS_PSS,

498

   Sha3_384RsaPkcsPss = CKM_SHA3_384_RSA_PKCS_PSS,

499

   Sha3_512RsaPkcsPss = CKM_SHA3_512_RSA_PKCS_PSS,

500

   Sha3_224RsaPkcs = CKM_SHA3_224_RSA_PKCS,

501

   Sha3_224RsaPkcsPss = CKM_SHA3_224_RSA_PKCS_PSS,

502

   Rc2KeyGen = CKM_RC2_KEY_GEN,

503

   Rc2Ecb = CKM_RC2_ECB,

504

   Rc2Cbc = CKM_RC2_CBC,

505

   Rc2Mac = CKM_RC2_MAC,

506

   Rc2MacGeneral = CKM_RC2_MAC_GENERAL,

507

   Rc2CbcPad = CKM_RC2_CBC_PAD,

508

   Rc4KeyGen = CKM_RC4_KEY_GEN,

509

   Rc4 = CKM_RC4,

510

   DesKeyGen = CKM_DES_KEY_GEN,

511

   DesEcb = CKM_DES_ECB,

512

   DesCbc = CKM_DES_CBC,

513

   DesMac = CKM_DES_MAC,

514

   DesMacGeneral = CKM_DES_MAC_GENERAL,

515

   DesCbcPad = CKM_DES_CBC_PAD,

516

   Des2KeyGen = CKM_DES2_KEY_GEN,

517

   Des3KeyGen = CKM_DES3_KEY_GEN,

518

   Des3Ecb = CKM_DES3_ECB,

519

   Des3Cbc = CKM_DES3_CBC,

520

   Des3Mac = CKM_DES3_MAC,

521

   Des3MacGeneral = CKM_DES3_MAC_GENERAL,

522

   Des3CbcPad = CKM_DES3_CBC_PAD,

523

   Des3CmacGeneral = CKM_DES3_CMAC_GENERAL,

524

   Des3Cmac = CKM_DES3_CMAC,

525

   CdmfKeyGen = CKM_CDMF_KEY_GEN,

526

   CdmfEcb = CKM_CDMF_ECB,

527

   CdmfCbc = CKM_CDMF_CBC,

528

   CdmfMac = CKM_CDMF_MAC,

529

   CdmfMacGeneral = CKM_CDMF_MAC_GENERAL,

530

   CdmfCbcPad = CKM_CDMF_CBC_PAD,

531

   DesOfb64 = CKM_DES_OFB64,

532

   DesOfb8 = CKM_DES_OFB8,

533

   DesCfb64 = CKM_DES_CFB64,

534

   DesCfb8 = CKM_DES_CFB8,

535

   Md2 = CKM_MD2,

536

   Md2Hmac = CKM_MD2_HMAC,

537

   Md2HmacGeneral = CKM_MD2_HMAC_GENERAL,

538

   Md5 = CKM_MD5,

539

   Md5Hmac = CKM_MD5_HMAC,

540

   Md5HmacGeneral = CKM_MD5_HMAC_GENERAL,

541

   Sha1 = CKM_SHA_1,

542

   Sha1Hmac = CKM_SHA_1_HMAC,

543

   Sha1HmacGeneral = CKM_SHA_1_HMAC_GENERAL,

544

   Ripemd128 = CKM_RIPEMD128,

545

   Ripemd128Hmac = CKM_RIPEMD128_HMAC,

546

   Ripemd128HmacGeneral = CKM_RIPEMD128_HMAC_GENERAL,

547

   Ripemd160 = CKM_RIPEMD160,

548

   Ripemd160Hmac = CKM_RIPEMD160_HMAC,

549

   Ripemd160HmacGeneral = CKM_RIPEMD160_HMAC_GENERAL,

550

   Sha256 = CKM_SHA256,

551

   Sha256Hmac = CKM_SHA256_HMAC,

552

   Sha256HmacGeneral = CKM_SHA256_HMAC_GENERAL,

553

   Sha224 = CKM_SHA224,

554

   Sha224Hmac = CKM_SHA224_HMAC,

555

   Sha224HmacGeneral = CKM_SHA224_HMAC_GENERAL,

556

   Sha384 = CKM_SHA384,

557

   Sha384Hmac = CKM_SHA384_HMAC,

558

   Sha384HmacGeneral = CKM_SHA384_HMAC_GENERAL,

559

   Sha512 = CKM_SHA512,

560

   Sha512Hmac = CKM_SHA512_HMAC,

561

   Sha512HmacGeneral = CKM_SHA512_HMAC_GENERAL,

562

   SecuridKeyGen = CKM_SECURID_KEY_GEN,

563

   Securid = CKM_SECURID,

564

   HotpKeyGen = CKM_HOTP_KEY_GEN,

565

   Hotp = CKM_HOTP,

566

   Acti = CKM_ACTI,

567

   ActiKeyGen = CKM_ACTI_KEY_GEN,

568

   Sha3_256 = CKM_SHA3_256,

569

   Sha3_256Hmac = CKM_SHA3_256_HMAC,

570

   Sha3_256HmacGeneral = CKM_SHA3_256_HMAC_GENERAL,

571

   Sha3_256KeyGen = CKM_SHA3_256_KEY_GEN,

572

   Sha3_224 = CKM_SHA3_224,

573

   Sha3_224Hmac = CKM_SHA3_224_HMAC,

574

   Sha3_224HmacGeneral = CKM_SHA3_224_HMAC_GENERAL,

575

   Sha3_224KeyGen = CKM_SHA3_224_KEY_GEN,

576

   Sha3_384 = CKM_SHA3_384,

577

   Sha3_384Hmac = CKM_SHA3_384_HMAC,

578

   Sha3_384HmacGeneral = CKM_SHA3_384_HMAC_GENERAL,

579

   Sha3_384KeyGen = CKM_SHA3_384_KEY_GEN,

580

   Sha3_512 = CKM_SHA3_512,

581

   Sha3_512Hmac = CKM_SHA3_512_HMAC,

582

   Sha3_512HmacGeneral = CKM_SHA3_512_HMAC_GENERAL,

583

   Sha3_512KeyGen = CKM_SHA3_512_KEY_GEN,

584

   CastKeyGen = CKM_CAST_KEY_GEN,

585

   CastEcb = CKM_CAST_ECB,

586

   CastCbc = CKM_CAST_CBC,

587

   CastMac = CKM_CAST_MAC,

588

   CastMacGeneral = CKM_CAST_MAC_GENERAL,

589

   CastCbcPad = CKM_CAST_CBC_PAD,

590

   Cast3KeyGen = CKM_CAST3_KEY_GEN,

591

   Cast3Ecb = CKM_CAST3_ECB,

592

   Cast3Cbc = CKM_CAST3_CBC,

593

   Cast3Mac = CKM_CAST3_MAC,

594

   Cast3MacGeneral = CKM_CAST3_MAC_GENERAL,

595

   Cast3CbcPad = CKM_CAST3_CBC_PAD,

596

   Cast5KeyGen = CKM_CAST5_KEY_GEN,

597

   Cast128KeyGen = CKM_CAST128_KEY_GEN,

598

   Cast5Ecb = CKM_CAST5_ECB,

599

   Cast128Ecb = CKM_CAST128_ECB,

600

   Cast5Cbc = CKM_CAST5_CBC,

601

   Cast128Cbc = CKM_CAST128_CBC,

602

   Cast5Mac = CKM_CAST5_MAC,

603

   Cast128Mac = CKM_CAST128_MAC,

604

   Cast5MacGeneral = CKM_CAST5_MAC_GENERAL,

605

   Cast128MacGeneral = CKM_CAST128_MAC_GENERAL,

606

   Cast5CbcPad = CKM_CAST5_CBC_PAD,

607

   Cast128CbcPad = CKM_CAST128_CBC_PAD,

608

   Rc5KeyGen = CKM_RC5_KEY_GEN,

609

   Rc5Ecb = CKM_RC5_ECB,

610

   Rc5Cbc = CKM_RC5_CBC,

611

   Rc5Mac = CKM_RC5_MAC,

612

   Rc5MacGeneral = CKM_RC5_MAC_GENERAL,

613

   Rc5CbcPad = CKM_RC5_CBC_PAD,

614

   IdeaKeyGen = CKM_IDEA_KEY_GEN,

615

   IdeaEcb = CKM_IDEA_ECB,

616

   IdeaCbc = CKM_IDEA_CBC,

617

   IdeaMac = CKM_IDEA_MAC,

618

   IdeaMacGeneral = CKM_IDEA_MAC_GENERAL,

619

   IdeaCbcPad = CKM_IDEA_CBC_PAD,

620

   GenericSecretKeyGen = CKM_GENERIC_SECRET_KEY_GEN,

621

   ConcatenateBaseAndKey = CKM_CONCATENATE_BASE_AND_KEY,

622

   ConcatenateBaseAndData = CKM_CONCATENATE_BASE_AND_DATA,

623

   ConcatenateDataAndBase = CKM_CONCATENATE_DATA_AND_BASE,

624

   XorBaseAndData = CKM_XOR_BASE_AND_DATA,

625

   ExtractKeyFromKey = CKM_EXTRACT_KEY_FROM_KEY,

626

   Ssl3PreMasterKeyGen = CKM_SSL3_PRE_MASTER_KEY_GEN,

627

   Ssl3MasterKeyDerive = CKM_SSL3_MASTER_KEY_DERIVE,

628

   Ssl3KeyAndMacDerive = CKM_SSL3_KEY_AND_MAC_DERIVE,

629

   Ssl3MasterKeyDeriveDh = CKM_SSL3_MASTER_KEY_DERIVE_DH,

630

   TlsPreMasterKeyGen = CKM_TLS_PRE_MASTER_KEY_GEN,

631

   TlsMasterKeyDerive = CKM_TLS_MASTER_KEY_DERIVE,

632

   TlsKeyAndMacDerive = CKM_TLS_KEY_AND_MAC_DERIVE,

633

   TlsMasterKeyDeriveDh = CKM_TLS_MASTER_KEY_DERIVE_DH,

634

   TlsPrf = CKM_TLS_PRF,

635

   Ssl3Md5Mac = CKM_SSL3_MD5_MAC,

636

   Ssl3Sha1Mac = CKM_SSL3_SHA1_MAC,

637

   Md5KeyDerivation = CKM_MD5_KEY_DERIVATION,

638

   Md2KeyDerivation = CKM_MD2_KEY_DERIVATION,

639

   Sha1KeyDerivation = CKM_SHA1_KEY_DERIVATION,

640

   Sha256KeyDerivation = CKM_SHA256_KEY_DERIVATION,

641

   Sha384KeyDerivation = CKM_SHA384_KEY_DERIVATION,

642

   Sha512KeyDerivation = CKM_SHA512_KEY_DERIVATION,

643

   Sha224KeyDerivation = CKM_SHA224_KEY_DERIVATION,

644

   Sha3_256KeyDerivation = CKM_SHA3_256_KEY_DERIVATION,

645

   Sha3_224KeyDerivation = CKM_SHA3_224_KEY_DERIVATION,

646

   Sha3_384KeyDerivation = CKM_SHA3_384_KEY_DERIVATION,

647

   Sha3_512KeyDerivation = CKM_SHA3_512_KEY_DERIVATION,

648

   Shake128KeyDerivation = CKM_SHAKE_128_KEY_DERIVATION,

649

   Shake256KeyDerivation = CKM_SHAKE_256_KEY_DERIVATION,

650

   PbeMd2DesCbc = CKM_PBE_MD2_DES_CBC,

651

   PbeMd5DesCbc = CKM_PBE_MD5_DES_CBC,

652

   PbeMd5CastCbc = CKM_PBE_MD5_CAST_CBC,

653

   PbeMd5Cast3Cbc = CKM_PBE_MD5_CAST3_CBC,

654

   PbeMd5Cast5Cbc = CKM_PBE_MD5_CAST5_CBC,

655

   PbeMd5Cast128Cbc = CKM_PBE_MD5_CAST128_CBC,

656

   PbeSha1Cast5Cbc = CKM_PBE_SHA1_CAST5_CBC,

657

   PbeSha1Cast128Cbc = CKM_PBE_SHA1_CAST128_CBC,

658

   PbeSha1Rc4128 = CKM_PBE_SHA1_RC4_128,

659

   PbeSha1Rc440 = CKM_PBE_SHA1_RC4_40,

660

   PbeSha1Des3EdeCbc = CKM_PBE_SHA1_DES3_EDE_CBC,

661

   PbeSha1Des2EdeCbc = CKM_PBE_SHA1_DES2_EDE_CBC,

662

   PbeSha1Rc2128Cbc = CKM_PBE_SHA1_RC2_128_CBC,

663

   PbeSha1Rc240Cbc = CKM_PBE_SHA1_RC2_40_CBC,

664

   Pkcs5Pbkd2 = CKM_PKCS5_PBKD2,

665

   PbaSha1WithSha1Hmac = CKM_PBA_SHA1_WITH_SHA1_HMAC,

666

   WtlsPreMasterKeyGen = CKM_WTLS_PRE_MASTER_KEY_GEN,

667

   WtlsMasterKeyDerive = CKM_WTLS_MASTER_KEY_DERIVE,

668

   WtlsMasterKeyDeriveDhEcc = CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC,

669

   WtlsPrf = CKM_WTLS_PRF,

670

   WtlsServerKeyAndMacDerive = CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE,

671

   WtlsClientKeyAndMacDerive = CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE,

672

   Tls10MacServer = CKM_TLS10_MAC_SERVER,

673

   Tls10MacClient = CKM_TLS10_MAC_CLIENT,

674

   Tls12Mac = CKM_TLS12_MAC,

675

   Tls12Kdf = CKM_TLS12_KDF,

676

   Tls12MasterKeyDerive = CKM_TLS12_MASTER_KEY_DERIVE,

677

   Tls12KeyAndMacDerive = CKM_TLS12_KEY_AND_MAC_DERIVE,

678

   Tls12MasterKeyDeriveDh = CKM_TLS12_MASTER_KEY_DERIVE_DH,

679

   Tls12KeySafeDerive = CKM_TLS12_KEY_SAFE_DERIVE,

680

   TlsMac = CKM_TLS_MAC,

681

   TlsKdf = CKM_TLS_KDF,

682

   KeyWrapLynks = CKM_KEY_WRAP_LYNKS,

683

   KeyWrapSetOaep = CKM_KEY_WRAP_SET_OAEP,

684

   CmsSig = CKM_CMS_SIG,

685

   KipDerive = CKM_KIP_DERIVE,

686

   KipWrap = CKM_KIP_WRAP,

687

   KipMac = CKM_KIP_MAC,

688

   CamelliaKeyGen = CKM_CAMELLIA_KEY_GEN,

689

   CamelliaEcb = CKM_CAMELLIA_ECB,

690

   CamelliaCbc = CKM_CAMELLIA_CBC,

691

   CamelliaMac = CKM_CAMELLIA_MAC,

692

   CamelliaMacGeneral = CKM_CAMELLIA_MAC_GENERAL,

693

   CamelliaCbcPad = CKM_CAMELLIA_CBC_PAD,

694

   CamelliaEcbEncryptData = CKM_CAMELLIA_ECB_ENCRYPT_DATA,

695

   CamelliaCbcEncryptData = CKM_CAMELLIA_CBC_ENCRYPT_DATA,

696

   CamelliaCtr = CKM_CAMELLIA_CTR,

697

   AriaKeyGen = CKM_ARIA_KEY_GEN,

698

   AriaEcb = CKM_ARIA_ECB,

699

   AriaCbc = CKM_ARIA_CBC,

700

   AriaMac = CKM_ARIA_MAC,

701

   AriaMacGeneral = CKM_ARIA_MAC_GENERAL,

702

   AriaCbcPad = CKM_ARIA_CBC_PAD,

703

   AriaEcbEncryptData = CKM_ARIA_ECB_ENCRYPT_DATA,

704

   AriaCbcEncryptData = CKM_ARIA_CBC_ENCRYPT_DATA,

705

   SeedKeyGen = CKM_SEED_KEY_GEN,

706

   SeedEcb = CKM_SEED_ECB,

707

   SeedCbc = CKM_SEED_CBC,

708

   SeedMac = CKM_SEED_MAC,

709

   SeedMacGeneral = CKM_SEED_MAC_GENERAL,

710

   SeedCbcPad = CKM_SEED_CBC_PAD,

711

   SeedEcbEncryptData = CKM_SEED_ECB_ENCRYPT_DATA,

712

   SeedCbcEncryptData = CKM_SEED_CBC_ENCRYPT_DATA,

713

   SkipjackKeyGen = CKM_SKIPJACK_KEY_GEN,

714

   SkipjackEcb64 = CKM_SKIPJACK_ECB64,

715

   SkipjackCbc64 = CKM_SKIPJACK_CBC64,

716

   SkipjackOfb64 = CKM_SKIPJACK_OFB64,

717

   SkipjackCfb64 = CKM_SKIPJACK_CFB64,

718

   SkipjackCfb32 = CKM_SKIPJACK_CFB32,

719

   SkipjackCfb16 = CKM_SKIPJACK_CFB16,

720

   SkipjackCfb8 = CKM_SKIPJACK_CFB8,

721

   SkipjackWrap = CKM_SKIPJACK_WRAP,

722

   SkipjackPrivateWrap = CKM_SKIPJACK_PRIVATE_WRAP,

723

   SkipjackRelayx = CKM_SKIPJACK_RELAYX,

724

   KeaKeyPairGen = CKM_KEA_KEY_PAIR_GEN,

725

   KeaKeyDerive = CKM_KEA_KEY_DERIVE,

726

   KeaDerive = CKM_KEA_DERIVE,

727

   FortezzaTimestamp = CKM_FORTEZZA_TIMESTAMP,

728

   BatonKeyGen = CKM_BATON_KEY_GEN,

729

   BatonEcb128 = CKM_BATON_ECB128,

730

   BatonEcb96 = CKM_BATON_ECB96,

731

   BatonCbc128 = CKM_BATON_CBC128,

732

   BatonCounter = CKM_BATON_COUNTER,

733

   BatonShuffle = CKM_BATON_SHUFFLE,

734

   BatonWrap = CKM_BATON_WRAP,

735

   EcdsaKeyPairGen = CKM_ECDSA_KEY_PAIR_GEN,

736

   EcKeyPairGen = CKM_EC_KEY_PAIR_GEN,

737

   Ecdsa = CKM_ECDSA,

738

   EcdsaSha1 = CKM_ECDSA_SHA1,

739

   EcdsaSha224 = CKM_ECDSA_SHA224,

740

   EcdsaSha256 = CKM_ECDSA_SHA256,

741

   EcdsaSha384 = CKM_ECDSA_SHA384,

742

   EcdsaSha512 = CKM_ECDSA_SHA512,

743

   EcKeyPairGenWExtraBits = CKM_EC_KEY_PAIR_GEN_W_EXTRA_BITS,

744

   Ecdh1Derive = CKM_ECDH1_DERIVE,

745

   Ecdh1CofactorDerive = CKM_ECDH1_COFACTOR_DERIVE,

746

   EcmqvDerive = CKM_ECMQV_DERIVE,

747

   EcdhAesKeyWrap = CKM_ECDH_AES_KEY_WRAP,

748

   RsaAesKeyWrap = CKM_RSA_AES_KEY_WRAP,

749

   JuniperKeyGen = CKM_JUNIPER_KEY_GEN,

750

   JuniperEcb128 = CKM_JUNIPER_ECB128,

751

   JuniperCbc128 = CKM_JUNIPER_CBC128,

752

   JuniperCounter = CKM_JUNIPER_COUNTER,

753

   JuniperShuffle = CKM_JUNIPER_SHUFFLE,

754

   JuniperWrap = CKM_JUNIPER_WRAP,

755

   Fasthash = CKM_FASTHASH,

756

   AesXts = CKM_AES_XTS,

757

   AesXtsKeyGen = CKM_AES_XTS_KEY_GEN,

758

   AesKeyGen = CKM_AES_KEY_GEN,

759

   AesEcb = CKM_AES_ECB,

760

   AesCbc = CKM_AES_CBC,

761

   AesMac = CKM_AES_MAC,

762

   AesMacGeneral = CKM_AES_MAC_GENERAL,

763

   AesCbcPad = CKM_AES_CBC_PAD,

764

   AesCtr = CKM_AES_CTR,

765

   AesGcm = CKM_AES_GCM,

766

   AesCcm = CKM_AES_CCM,

767

   AesCts = CKM_AES_CTS,

768

   AesCmac = CKM_AES_CMAC,

769

   AesCmacGeneral = CKM_AES_CMAC_GENERAL,

770

   AesXcbcMac = CKM_AES_XCBC_MAC,

771

   AesXcbcMac96 = CKM_AES_XCBC_MAC_96,

772

   AesGmac = CKM_AES_GMAC,

773

   BlowfishKeyGen = CKM_BLOWFISH_KEY_GEN,

774

   BlowfishCbc = CKM_BLOWFISH_CBC,

775

   TwofishKeyGen = CKM_TWOFISH_KEY_GEN,

776

   TwofishCbc = CKM_TWOFISH_CBC,

777

   BlowfishCbcPad = CKM_BLOWFISH_CBC_PAD,

778

   TwofishCbcPad = CKM_TWOFISH_CBC_PAD,

779

   DesEcbEncryptData = CKM_DES_ECB_ENCRYPT_DATA,

780

   DesCbcEncryptData = CKM_DES_CBC_ENCRYPT_DATA,

781

   Des3EcbEncryptData = CKM_DES3_ECB_ENCRYPT_DATA,

782

   Des3CbcEncryptData = CKM_DES3_CBC_ENCRYPT_DATA,

783

   AesEcbEncryptData = CKM_AES_ECB_ENCRYPT_DATA,

784

   AesCbcEncryptData = CKM_AES_CBC_ENCRYPT_DATA,

785

   Gostr3410KeyPairGen = CKM_GOSTR3410_KEY_PAIR_GEN,

786

   Gostr3410 = CKM_GOSTR3410,

787

   Gostr3410WithGostr3411 = CKM_GOSTR3410_WITH_GOSTR3411,

788

   Gostr3410KeyWrap = CKM_GOSTR3410_KEY_WRAP,

789

   Gostr3410Derive = CKM_GOSTR3410_DERIVE,

790

   Gostr3411 = CKM_GOSTR3411,

791

   Gostr3411Hmac = CKM_GOSTR3411_HMAC,

792

   Gost28147KeyGen = CKM_GOST28147_KEY_GEN,

793

   Gost28147Ecb = CKM_GOST28147_ECB,

794

   Gost28147 = CKM_GOST28147,

795

   Gost28147Mac = CKM_GOST28147_MAC,

796

   Gost28147KeyWrap = CKM_GOST28147_KEY_WRAP,

797

   Chacha20KeyGen = CKM_CHACHA20_KEY_GEN,

798

   Chacha20 = CKM_CHACHA20,

799

   Poly1305KeyGen = CKM_POLY1305_KEY_GEN,

800

   Poly1305 = CKM_POLY1305,

801

   DsaParameterGen = CKM_DSA_PARAMETER_GEN,

802

   DhPkcsParameterGen = CKM_DH_PKCS_PARAMETER_GEN,

803

   X942DhParameterGen = CKM_X9_42_DH_PARAMETER_GEN,

804

   DsaProbablisticParameterGen = CKM_DSA_PROBABILISTIC_PARAMETER_GEN,

805

   DsaShaweTaylorParameterGen = CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN,

806

   DsaFipsGGen = CKM_DSA_FIPS_G_GEN,

807

   AesOfb = CKM_AES_OFB,

808

   AesCfb64 = CKM_AES_CFB64,

809

   AesCfb8 = CKM_AES_CFB8,

810

   AesCfb128 = CKM_AES_CFB128,

811

   AesCfb1 = CKM_AES_CFB1,

812

   AesKeyWrap = CKM_AES_KEY_WRAP,

813

   AesKeyWrapPad = CKM_AES_KEY_WRAP_PAD,

814

   AesKeyWrapKwp = CKM_AES_KEY_WRAP_KWP,

815

   AesKeyWrapPkcs7 = CKM_AES_KEY_WRAP_PKCS7,

816

   RsaPkcsTpm11 = CKM_RSA_PKCS_TPM_1_1,

817

   RsaPkcsOaepTpm11 = CKM_RSA_PKCS_OAEP_TPM_1_1,

818

   Sha1KeyGen = CKM_SHA_1_KEY_GEN,

819

   Sha224KeyGen = CKM_SHA224_KEY_GEN,

820

   Sha256KeyGen = CKM_SHA256_KEY_GEN,

821

   Sha384KeyGen = CKM_SHA384_KEY_GEN,

822

   Sha512KeyGen = CKM_SHA512_KEY_GEN,

823

   Sha512_224KeyGen = CKM_SHA512_224_KEY_GEN,

824

   Sha512_256KeyGen = CKM_SHA512_256_KEY_GEN,

825

   Sha512TKeyGen = CKM_SHA512_T_KEY_GEN,

826

   Null = CKM_NULL,

827

   Blake2b160 = CKM_BLAKE2B_160,

828

   Blake2b160Hmac = CKM_BLAKE2B_160_HMAC,

829

   Blake2b160HmacGeneral = CKM_BLAKE2B_160_HMAC_GENERAL,

830

   Blake2b160KeyDerive = CKM_BLAKE2B_160_KEY_DERIVE,

831

   Blake2b160KeyGen = CKM_BLAKE2B_160_KEY_GEN,

832

   Blake2b256 = CKM_BLAKE2B_256,

833

   Blake2b256Hmac = CKM_BLAKE2B_256_HMAC,

834

   Blake2b256HmacGeneral = CKM_BLAKE2B_256_HMAC_GENERAL,

835

   Blake2b256KeyDerive = CKM_BLAKE2B_256_KEY_DERIVE,

836

   Blake2b256KeyGen = CKM_BLAKE2B_256_KEY_GEN,

837

   Blake2b384 = CKM_BLAKE2B_384,

838

   Blake2b384Hmac = CKM_BLAKE2B_384_HMAC,

839

   Blake2b384HmacGeneral = CKM_BLAKE2B_384_HMAC_GENERAL,

840

   Blake2b384KeyDerive = CKM_BLAKE2B_384_KEY_DERIVE,

841

   Blake2b384KeyGen = CKM_BLAKE2B_384_KEY_GEN,

842

   Blake2b512 = CKM_BLAKE2B_512,

843

   Blake2b512Hmac = CKM_BLAKE2B_512_HMAC,

844

   Blake2b512HmacGeneral = CKM_BLAKE2B_512_HMAC_GENERAL,

845

   Blake2b512KeyDerive = CKM_BLAKE2B_512_KEY_DERIVE,

846

   Blake2b512KeyGen = CKM_BLAKE2B_512_KEY_GEN,

847

   Salsa20 = CKM_SALSA20,

848

   Chacha20Poly1305 = CKM_CHACHA20_POLY1305,

849

   Salsa20Poly1305 = CKM_SALSA20_POLY1305,

850

   X3dhInitialize = CKM_X3DH_INITIALIZE,

851

   X3dhRespond = CKM_X3DH_RESPOND,

852

   X2ratchetInitialize = CKM_X2RATCHET_INITIALIZE,

853

   X2ratchetRespond = CKM_X2RATCHET_RESPOND,

854

   X2ratchetEncrypt = CKM_X2RATCHET_ENCRYPT,

855

   X2ratchetDecrypt = CKM_X2RATCHET_DECRYPT,

856

   Xeddsa = CKM_XEDDSA,

857

   HkdfDerive = CKM_HKDF_DERIVE,

858

   HkdfData = CKM_HKDF_DATA,

859

   HkdfKeyGen = CKM_HKDF_KEY_GEN,

860

   Salsa20_KeyGen = CKM_SALSA20_KEY_GEN,

861

   EcdsaSha3_224 = CKM_ECDSA_SHA3_224,

862

   EcdsaSha3_256 = CKM_ECDSA_SHA3_256,

863

   EcdsaSha3_384 = CKM_ECDSA_SHA3_384,

864

   EcdsaSha3_512 = CKM_ECDSA_SHA3_512,

865

   EcEdwardsKeyPairGen = CKM_EC_EDWARDS_KEY_PAIR_GEN,

866

   EcMontgomeryKeyPairGen = CKM_EC_MONTGOMERY_KEY_PAIR_GEN,

867

   Eddsa = CKM_EDDSA,

868

   Sp800_108CounterKdf = CKM_SP800_108_COUNTER_KDF,

869

   Sp800_108FeedbackKdf = CKM_SP800_108_FEEDBACK_KDF,

870

   Sp800_108DoublePipelineKdf = CKM_SP800_108_DOUBLE_PIPELINE_KDF,

871

   Ike2PrfPlusDerive = CKM_IKE2_PRF_PLUS_DERIVE,

872

   IkePrfDerive = CKM_IKE_PRF_DERIVE,

873

   Ike1PrfDerive = CKM_IKE1_PRF_DERIVE,

874

   Ike1ExtendedDerive = CKM_IKE1_EXTENDED_DERIVE,

875

   HssKeyPairGen = CKM_HSS_KEY_PAIR_GEN,

876

   Hss = CKM_HSS,

877

   XmssKeyPairGen = CKM_XMSS_KEY_PAIR_GEN,

878

   XmssmtKeyPairGen = CKM_XMSSMT_KEY_PAIR_GEN,

879

   Xmss = CKM_XMSS,

880

   Xmssmt = CKM_XMSSMT,

881

   EcdhXAesKeyWrap = CKM_ECDH_X_AES_KEY_WRAP,

882

   EcdhCofAesKeyWrap = CKM_ECDH_COF_AES_KEY_WRAP,

883

   PubKeyFromPrivKey = CKM_PUB_KEY_FROM_PRIV_KEY,

884

   MlKemKeyPairGen = CKM_ML_KEM_KEY_PAIR_GEN,

885

   MlKem = CKM_ML_KEM,

886

   MlDsaKeyPairGen = CKM_ML_DSA_KEY_PAIR_GEN,

887

   MlDsa = CKM_ML_DSA,

888

   HashMlDsa = CKM_HASH_ML_DSA,

889

   HashMlDsaSha224 = CKM_HASH_ML_DSA_SHA224,

890

   HashMlDsaSha256 = CKM_HASH_ML_DSA_SHA256,

891

   HashMlDsaSha384 = CKM_HASH_ML_DSA_SHA384,

892

   HashMlDsaSha512 = CKM_HASH_ML_DSA_SHA512,

893

   HashMlDsaSha3_224 = CKM_HASH_ML_DSA_SHA3_224,

894

   HashMlDsaSha3_256 = CKM_HASH_ML_DSA_SHA3_256,

895

   HashMlDsaSha3_384 = CKM_HASH_ML_DSA_SHA3_384,

896

   HashMlDsaSha3_512 = CKM_HASH_ML_DSA_SHA3_512,

897

   HashMlDsaShake128 = CKM_HASH_ML_DSA_SHAKE128,

898

   HashMlDsaShake256 = CKM_HASH_ML_DSA_SHAKE256,

899

   SlhDsaKeyPairGen = CKM_SLH_DSA_KEY_PAIR_GEN,

900

   SlhDsa = CKM_SLH_DSA,

901

   HashSlhDsa = CKM_HASH_SLH_DSA,

902

   HashSlhDsaSha224 = CKM_HASH_SLH_DSA_SHA224,

903

   HashSlhDsaSha256 = CKM_HASH_SLH_DSA_SHA256,

904

   HashSlhDsaSha384 = CKM_HASH_SLH_DSA_SHA384,

905

   HashSlhDsaSha512 = CKM_HASH_SLH_DSA_SHA512,

906

   HashSlhDsaSha3_224 = CKM_HASH_SLH_DSA_SHA3_224,

907

   HashSlhDsaSha3_256 = CKM_HASH_SLH_DSA_SHA3_256,

908

   HashSlhDsaSha3_384 = CKM_HASH_SLH_DSA_SHA3_384,

909

   HashSlhDsaSha3_512 = CKM_HASH_SLH_DSA_SHA3_512,

910

   HashSlhDsaShake128 = CKM_HASH_SLH_DSA_SHAKE128,

911

   HashSlhDsaShake256 = CKM_HASH_SLH_DSA_SHAKE256,

912

   Tls12ExtendedMasterKeyDerive = CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE,

913

   Tls12ExtendedMasterKeyDeriveDh = CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE_DH,

914

   VendorDefined = CKM_VENDOR_DEFINED,

915

};

916

917

enum class Notification : CK_NOTIFICATION {

918

   Surrender = CKN_SURRENDER,

919

   OtpChanged = CKN_OTP_CHANGED,

920

};

921

922

enum class ObjectClass : CK_OBJECT_CLASS {

923

   Data = CKO_DATA,

924

   Certificate = CKO_CERTIFICATE,

925

   PublicKey = CKO_PUBLIC_KEY,

926

   PrivateKey = CKO_PRIVATE_KEY,

927

   SecretKey = CKO_SECRET_KEY,

928

   HwFeature = CKO_HW_FEATURE,

929

   DomainParameters = CKO_DOMAIN_PARAMETERS,

930

   Mechanism = CKO_MECHANISM,

931

   OtpKey = CKO_OTP_KEY,

932

   Profile = CKO_PROFILE,

933

   Validation = CKO_VALIDATION,

934

   Trust = CKO_TRUST,

935

   VendorDefined = CKO_VENDOR_DEFINED,

936

};

937

938

enum class PseudoRandom : CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE {

939

   Pkcs5Pbkd2HmacSha1 = CKP_PKCS5_PBKD2_HMAC_SHA1,

940

   Pkcs5Pbkd2HmacGostr3411 = CKP_PKCS5_PBKD2_HMAC_GOSTR3411,

941

   Pkcs5Pbkd2HmacSha224 = CKP_PKCS5_PBKD2_HMAC_SHA224,

942

   Pkcs5Pbkd2HmacSha256 = CKP_PKCS5_PBKD2_HMAC_SHA256,

943

   Pkcs5Pbkd2HmacSha384 = CKP_PKCS5_PBKD2_HMAC_SHA384,

944

   Pkcs5Pbkd2HmacSha512 = CKP_PKCS5_PBKD2_HMAC_SHA512,

945

   Pkcs5Pbkd2HmacSha512224 = CKP_PKCS5_PBKD2_HMAC_SHA512_224,

946

   Pkcs5Pbkd2HmacSha512256 = CKP_PKCS5_PBKD2_HMAC_SHA512_256,

947

};

948

949

enum class MlDsaParameterSet : CK_ML_DSA_PARAMETER_SET_TYPE {

950

   MlDsa44 = CKP_ML_DSA_44,

951

   MlDsa65 = CKP_ML_DSA_65,

952

   MlDsa87 = CKP_ML_DSA_87,

953

};

954

955

enum class SlhDsaParameterSet : CK_SLH_DSA_PARAMETER_SET_TYPE {

956

   SlhDsaSha2_128s = CKP_SLH_DSA_SHA2_128S,

957

   SlhDsaShake128s = CKP_SLH_DSA_SHAKE_128S,

958

   SlhDsaSha2_128f = CKP_SLH_DSA_SHA2_128F,

959

   SlhDsaShake128f = CKP_SLH_DSA_SHAKE_128F,

960

   SlhDsaSha2_192s = CKP_SLH_DSA_SHA2_192S,

961

   SlhDsaShake192s = CKP_SLH_DSA_SHAKE_192S,

962

   SlhDsaSha2_192f = CKP_SLH_DSA_SHA2_192F,

963

   SlhDsaShake192f = CKP_SLH_DSA_SHAKE_192F,

964

   SlhDsaSha2_256s = CKP_SLH_DSA_SHA2_256S,

965

   SlhDsaShake256s = CKP_SLH_DSA_SHAKE_256S,

966

   SlhDsaSha2_256f = CKP_SLH_DSA_SHA2_256F,

967

   SlhDsaShake256f = CKP_SLH_DSA_SHAKE_256F,

968

};

969

970

enum class MlKemParameterSet : CK_ML_KEM_PARAMETER_SET_TYPE {

971

   MlKem512 = CKP_ML_KEM_512,

972

   MlKem768 = CKP_ML_KEM_768,

973

   MlKem1024 = CKP_ML_KEM_1024,

974

};

975

976

enum class SessionState : CK_STATE {

977

   RoPublicSession = CKS_RO_PUBLIC_SESSION,

978

   RoUserFunctions = CKS_RO_USER_FUNCTIONS,

979

   RwPublicSession = CKS_RW_PUBLIC_SESSION,

980

   RwUserFunctions = CKS_RW_USER_FUNCTIONS,

981

   RwSoFunctions = CKS_RW_SO_FUNCTIONS,

982

};

983

984

enum class ReturnValue : CK_RV {

985

   OK = CKR_OK,

986

   Cancel = CKR_CANCEL,

987

   HostMemory = CKR_HOST_MEMORY,

988

   SlotIdInvalid = CKR_SLOT_ID_INVALID,

989

   GeneralError = CKR_GENERAL_ERROR,

990

   FunctionFailed = CKR_FUNCTION_FAILED,

991

   ArgumentsBad = CKR_ARGUMENTS_BAD,

992

   NoEvent = CKR_NO_EVENT,

993

   NeedToCreateThreads = CKR_NEED_TO_CREATE_THREADS,

994

   CantLock = CKR_CANT_LOCK,

995

   AttributeReadOnly = CKR_ATTRIBUTE_READ_ONLY,

996

   AttributeSensitive = CKR_ATTRIBUTE_SENSITIVE,

997

   AttributeTypeInvalid = CKR_ATTRIBUTE_TYPE_INVALID,

998

   AttributeValueInvalid = CKR_ATTRIBUTE_VALUE_INVALID,

999

   ActionProhibited = CKR_ACTION_PROHIBITED,

1000

   DataInvalid = CKR_DATA_INVALID,

1001

   DataLenRange = CKR_DATA_LEN_RANGE,

1002

   DeviceError = CKR_DEVICE_ERROR,

1003

   DeviceMemory = CKR_DEVICE_MEMORY,

1004

   DeviceRemoved = CKR_DEVICE_REMOVED,

1005

   EncryptedDataInvalid = CKR_ENCRYPTED_DATA_INVALID,

1006

   EncryptedDataLenRange = CKR_ENCRYPTED_DATA_LEN_RANGE,

1007

   AeadDecryptFailed = CKR_AEAD_DECRYPT_FAILED,

1008

   FunctionCanceled = CKR_FUNCTION_CANCELED,

1009

   FunctionNotParallel = CKR_FUNCTION_NOT_PARALLEL,

1010

   FunctionNotSupported = CKR_FUNCTION_NOT_SUPPORTED,

1011

   KeyHandleInvalid = CKR_KEY_HANDLE_INVALID,

1012

   KeySizeRange = CKR_KEY_SIZE_RANGE,

1013

   KeyTypeInconsistent = CKR_KEY_TYPE_INCONSISTENT,

1014

   KeyNotNeeded = CKR_KEY_NOT_NEEDED,

1015

   KeyChanged = CKR_KEY_CHANGED,

1016

   KeyNeeded = CKR_KEY_NEEDED,

1017

   KeyIndigestible = CKR_KEY_INDIGESTIBLE,

1018

   KeyFunctionNotPermitted = CKR_KEY_FUNCTION_NOT_PERMITTED,

1019

   KeyNotWrappable = CKR_KEY_NOT_WRAPPABLE,

1020

   KeyUnextractable = CKR_KEY_UNEXTRACTABLE,

1021

   MechanismInvalid = CKR_MECHANISM_INVALID,

1022

   MechanismParamInvalid = CKR_MECHANISM_PARAM_INVALID,

1023

   ObjectHandleInvalid = CKR_OBJECT_HANDLE_INVALID,

1024

   OperationActive = CKR_OPERATION_ACTIVE,

1025

   OperationNotInitialized = CKR_OPERATION_NOT_INITIALIZED,

1026

   PinIncorrect = CKR_PIN_INCORRECT,

1027

   PinInvalid = CKR_PIN_INVALID,

1028

   PinLenRange = CKR_PIN_LEN_RANGE,

1029

   PinExpired = CKR_PIN_EXPIRED,

1030

   PinLocked = CKR_PIN_LOCKED,

1031

   SessionClosed = CKR_SESSION_CLOSED,

1032

   SessionCount = CKR_SESSION_COUNT,

1033

   SessionHandleInvalid = CKR_SESSION_HANDLE_INVALID,

1034

   SessionParallelNotSupported = CKR_SESSION_PARALLEL_NOT_SUPPORTED,

1035

   SessionReadOnly = CKR_SESSION_READ_ONLY,

1036

   SessionExists = CKR_SESSION_EXISTS,

1037

   SessionReadOnlyExists = CKR_SESSION_READ_ONLY_EXISTS,

1038

   SessionReadWriteSoExists = CKR_SESSION_READ_WRITE_SO_EXISTS,

1039

   SignatureInvalid = CKR_SIGNATURE_INVALID,

1040

   SignatureLenRange = CKR_SIGNATURE_LEN_RANGE,

1041

   TemplateIncomplete = CKR_TEMPLATE_INCOMPLETE,

1042

   TemplateInconsistent = CKR_TEMPLATE_INCONSISTENT,

1043

   TokenNotPresent = CKR_TOKEN_NOT_PRESENT,

1044

   TokenNotRecognized = CKR_TOKEN_NOT_RECOGNIZED,

1045

   TokenWriteProtected = CKR_TOKEN_WRITE_PROTECTED,

1046

   UnwrappingKeyHandleInvalid = CKR_UNWRAPPING_KEY_HANDLE_INVALID,

1047

   UnwrappingKeySizeRange = CKR_UNWRAPPING_KEY_SIZE_RANGE,

1048

   UnwrappingKeyTypeInconsistent = CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT,

1049

   UserAlreadyLoggedIn = CKR_USER_ALREADY_LOGGED_IN,

1050

   UserNotLoggedIn = CKR_USER_NOT_LOGGED_IN,

1051

   UserPinNotInitialized = CKR_USER_PIN_NOT_INITIALIZED,

1052

   UserTypeInvalid = CKR_USER_TYPE_INVALID,

1053

   UserAnotherAlreadyLoggedIn = CKR_USER_ANOTHER_ALREADY_LOGGED_IN,

1054

   UserTooManyTypes = CKR_USER_TOO_MANY_TYPES,

1055

   WrappedKeyInvalid = CKR_WRAPPED_KEY_INVALID,

1056

   WrappedKeyLenRange = CKR_WRAPPED_KEY_LEN_RANGE,

1057

   WrappingKeyHandleInvalid = CKR_WRAPPING_KEY_HANDLE_INVALID,

1058

   WrappingKeySizeRange = CKR_WRAPPING_KEY_SIZE_RANGE,

1059

   WrappingKeyTypeInconsistent = CKR_WRAPPING_KEY_TYPE_INCONSISTENT,

1060

   RandomSeedNotSupported = CKR_RANDOM_SEED_NOT_SUPPORTED,

1061

   RandomNoRng = CKR_RANDOM_NO_RNG,

1062

   DomainParamsInvalid = CKR_DOMAIN_PARAMS_INVALID,

1063

   CurveNotSupported = CKR_CURVE_NOT_SUPPORTED,

1064

   BufferTooSmall = CKR_BUFFER_TOO_SMALL,

1065

   SavedStateInvalid = CKR_SAVED_STATE_INVALID,

1066

   InformationSensitive = CKR_INFORMATION_SENSITIVE,

1067

   StateUnsaveable = CKR_STATE_UNSAVEABLE,

1068

   CryptokiNotInitialized = CKR_CRYPTOKI_NOT_INITIALIZED,

1069

   CryptokiAlreadyInitialized = CKR_CRYPTOKI_ALREADY_INITIALIZED,

1070

   MutexBad = CKR_MUTEX_BAD,

1071

   MutexNotLocked = CKR_MUTEX_NOT_LOCKED,

1072

   NewPinMode = CKR_NEW_PIN_MODE,

1073

   NextOtp = CKR_NEXT_OTP,

1074

   ExceededMaxIterations = CKR_EXCEEDED_MAX_ITERATIONS,

1075

   FipsSelfTestFailed = CKR_FIPS_SELF_TEST_FAILED,

1076

   LibraryLoadFailed = CKR_LIBRARY_LOAD_FAILED,

1077

   PinTooWeak = CKR_PIN_TOO_WEAK,

1078

   PublicKeyInvalid = CKR_PUBLIC_KEY_INVALID,

1079

   FunctionRejected = CKR_FUNCTION_REJECTED,

1080

   TokenResourceExceeded = CKR_TOKEN_RESOURCE_EXCEEDED,

1081

   OperationCancelFailed = CKR_OPERATION_CANCEL_FAILED,

1082

   KeyExhausted = CKR_KEY_EXHAUSTED,

1083

   Pending = CKR_PENDING,

1084

   SessionAsyncNotSupported = CKR_SESSION_ASYNC_NOT_SUPPORTED,

1085

   SeedRandomRequired = CKR_SEED_RANDOM_REQUIRED,

1086

   OperationNotValidated = CKR_OPERATION_NOT_VALIDATED,

1087

   TokenNotInitialized = CKR_TOKEN_NOT_INITIALIZED,

1088

   VendorDefined = CKR_VENDOR_DEFINED,

1089

};

1090

1091

enum class UserType : CK_USER_TYPE {

1092

   SO = CKU_SO,

1093

   User = CKU_USER,

1094

   ContextSpecific = CKU_CONTEXT_SPECIFIC,

1095

};

1096

1097

enum class PublicPointEncoding : uint32_t { Raw, Der };

1098

1099

using FunctionList = CK_FUNCTION_LIST;

1100

using FunctionListPtr = CK_FUNCTION_LIST_PTR;

1101

using FunctionList30 = CK_FUNCTION_LIST_3_0;

1102

using FunctionList32 = CK_FUNCTION_LIST_3_2;

1103

using Interface = CK_INTERFACE;

1104

using VoidPtr = CK_VOID_PTR;

1105

using C_InitializeArgs = CK_C_INITIALIZE_ARGS;

1106

using CreateMutex = CK_CREATEMUTEX;

1107

using DestroyMutex = CK_DESTROYMUTEX;

1108

using LockMutex = CK_LOCKMUTEX;

1109

using UnlockMutex = CK_UNLOCKMUTEX;

1110

using Flags = CK_FLAGS;

1111

using Info = CK_INFO;

1112

using Version = CK_VERSION;

1113

using Bbool = CK_BBOOL;

1114

using SlotId = CK_SLOT_ID;

1115

using Ulong = CK_ULONG;

1116

using SlotInfo = CK_SLOT_INFO;

1117

using TokenInfo = CK_TOKEN_INFO;

1118

using Mechanism = CK_MECHANISM;

1119

using MechanismInfo = CK_MECHANISM_INFO;

1120

using Utf8Char = CK_UTF8CHAR;

1121

using Notify = CK_NOTIFY;

1122

using SessionHandle = CK_SESSION_HANDLE;

1123

using SessionInfo = CK_SESSION_INFO;

1124

using Attribute = CK_ATTRIBUTE;

1125

using ObjectHandle = CK_OBJECT_HANDLE;

1126

using Byte = CK_BYTE;

1127

using RsaPkcsOaepParams = CK_RSA_PKCS_OAEP_PARAMS;

1128

using RsaPkcsPssParams = CK_RSA_PKCS_PSS_PARAMS;

1129

using Ecdh1DeriveParams = CK_ECDH1_DERIVE_PARAMS;

1130

using Date = CK_DATE;

1131

using AsyncData = CK_ASYNC_DATA;

1132

1133

BOTAN_PUBLIC_API(2, 0) extern ReturnValue* ThrowException;

1134

1135

const Bbool True = CK_TRUE;

1136

const Bbool False = CK_FALSE;

1137

1140

1141

1142

class Slot;

1143

1144

/**

1145

* Initializes a token

1146

* @param slot The slot with the attached token that should be initialized

1147

* @param label The token label

1148

* @param so_pin PIN of the security officer. Will be set if the token is uninitialized other this has to be the current SO_PIN

1149

* @param pin The user PIN that will be set

1150

*/

1151

BOTAN_PUBLIC_API(2, 0)

1152

void initialize_token(Slot& slot, std::string_view label, const secure_string& so_pin, const secure_string& pin);

1153

1154

/**

1155

* Change PIN with old PIN to new PIN

1156

* @param slot The slot with the attached token

1157

* @param old_pin The old user PIN

1158

* @param new_pin The new user PIN

1159

*/

1160

1161

BOTAN_PUBLIC_API(2, 0) void change_pin(Slot& slot, const secure_string& old_pin, const secure_string& new_pin);

1162

1163

/**

1164

* Change SO_PIN with old SO_PIN to new SO_PIN

1165

* @param slot The slot with the attached token

1166

* @param old_so_pin The old SO_PIN

1167

* @param new_so_pin The new SO_PIN

1168

*/

1169

BOTAN_PUBLIC_API(2, 0) void change_so_pin(Slot& slot, const secure_string& old_so_pin, const secure_string& new_so_pin);

1170

1171

/**

1172

* Sets user PIN with SO_PIN

1173

* @param slot The slot with the attached token

1174

* @param so_pin PIN of the security officer

1175

* @param pin The user PIN that should be set

1176

*/

1177

BOTAN_PUBLIC_API(2, 0) void set_pin(Slot& slot, const secure_string& so_pin, const secure_string& pin);

1178

1179

/**

1180

 * @brief Wraps a PKCS #11 Interface object.

1181

1182

 * This class provides an interface to access PKCS#11 functions of various versions.

1183

 * For example func_3_0() returns the PKCS#11 v3.0 function list for a loaded interface.

1184

 * The default implementation only supports the official "PKCS 11" named

1185

 * interfaces .

1186

1187

 * When using vendor defined interfaces, this class can be subclassed to specify access

1188

 * to the official PKCS#11 functions while vendor defined function lists can be added.

1189

 * In this case, the LowLevel class can be subclassed as well to provide access to the

1190

 * default PKCS#11 functions (via func_2_40(), func_3_0(), etc.) which is extended by

1191

 * the vendor defined ones.

1192

*/

1193

class BOTAN_PUBLIC_API(3, 7) InterfaceWrapper {

1194

   private:

1195

      Interface m_interface;

1196

1197

   public:

1198

      /// Basic constructor using an interface.

1200

1201

      InterfaceWrapper(const InterfaceWrapper&) = default;

1202

      InterfaceWrapper& operator=(const InterfaceWrapper&) = default;

1203

      InterfaceWrapper(InterfaceWrapper&&) = default;

1204

      InterfaceWrapper& operator=(InterfaceWrapper&&) = default;

1206

1207

      /// Access the underlying interface object

1208

      const Interface& raw_interface() const { return m_interface; }

1209

1210

      /// Access the version of the interface

1211

      Version version() const;

1212

1213

      /// Access the name of the interface

1214

      std::basic_string_view<Utf8Char> name() const;

1215

1216

      /// Access a function list that contains all methods since PKCS #11 v.2.40

1217

      virtual const FunctionList& func_2_40() const;

1218

1219

      /// Access a function list that contains all methods since PKCS #11 v.3.0

1220

      virtual const FunctionList30& func_3_0() const;

1221

1222

      /// Access a function list that contains all methods since PKCS #11 v.3.2

1223

      virtual const FunctionList32& func_3_2() const;

1224

1225

      /// Find the latest supported "PKCS 11" interface. Fork safe interfaces

1226

      /// are prefered over non fork safe ones of the same version.

1227

      static std::unique_ptr<InterfaceWrapper> latest_p11_interface(Dynamically_Loaded_Library& library);

1228

1229

/**

1230

       * Returns an immortal pointer to the Utf8Char string "PKCS 11".

1231

       * Used to define an interface object.

1232

1233

       * @warning Unfortunately, the interface object requires a non constant

1234

       * pointer. However, this string MUST NOT be modified!

1235

*/

1236

      static Utf8Char* p11_interface_name_ptr();

1237

};

1238

1239

/// Provides access to all PKCS#11 functions

1241

   public:

1242

      /// @param ptr the functon list pointer to use. Can be retrieved via `LowLevel::C_GetFunctionList`

1243

      BOTAN_DEPRECATED("Use LowLevel(InterfaceWrapperDefault::latest_p11_interface(module.library()))")

1244

      explicit LowLevel(FunctionList* ptr);

1245

1246

      explicit LowLevel(std::unique_ptr<InterfaceWrapper> interface_wrapper);

1247

1248

      /****************************** General purpose functions ******************************/

1249

1250

/**

1251

      * C_Initialize initializes the Cryptoki library.

1252

      * @param init_args if this is not nullptr, it gets cast to (`C_InitializeArgs`) and dereferenced

1253

      * @param return_value default value (`ThrowException`): throw exception on error.

1254

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1255

      * At least the following PKCS#11 return values may be returned:

1256

      *     \li ArgumentsBad \li CantLock \li CryptokiAlreadyInitialized

1257

      *     \li FunctionFailed \li GeneralError \li HostMemory

1258

      *     \li NeedToCreateThreads \li OK

1259

      * @return true on success, false otherwise

1260

*/

1261

      bool C_Initialize(const void* init_args, ReturnValue* return_value = ThrowException) const;

1262

1263

/**

1264

      * C_Finalize indicates that an application is done with the Cryptoki library.

1265

      * @param reserved reserved.  Should be nullptr

1266

      * @param return_value default value (`ThrowException`): throw exception on error.

1267

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1268

      * At least the following PKCS#11 return values may be returned:

1269

      *     \li ArgumentsBad \li CryptokiNotInitialized \li FunctionFailed

1270

      *     \li GeneralError \li HostMemory \li OK

1271

      * @return true on success, false otherwise

1272

*/

1273

      bool C_Finalize(void* reserved, ReturnValue* return_value = ThrowException) const;

1274

1275

/**

1276

      * C_GetInfo returns general information about Cryptoki.

1277

      * @param info_ptr location that receives information

1278

      * @param return_value default value (`ThrowException`): throw exception on error.

1279

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1280

      * At least the following PKCS#11 return values may be returned:

1281

      *     \li ArgumentsBad \li CryptokiNotInitialized \li FunctionFailed

1282

      *     \li GeneralError \li HostMemory \li OK

1283

      * @return true on success, false otherwise

1284

*/

1285

      bool C_GetInfo(Info* info_ptr, ReturnValue* return_value = ThrowException) const;

1286

1287

/**

1288

      * C_GetFunctionList returns the function list.

1289

      * @param pkcs11_module The PKCS#11 module

1290

      * @param function_list_ptr_ptr receives pointer to function list

1291

      * @param return_value default value (`ThrowException`): throw exception on error.

1292

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1293

      * At least the following PKCS#11 return values may be returned:

1294

      *     \li ArgumentsBad \li FunctionFailed \li GeneralError

1295

      *     \li HostMemory \li OK

1296

      * @return true on success, false otherwise

1297

*/

1298

      static bool C_GetFunctionList(const Dynamically_Loaded_Library& pkcs11_module,

1299

                                    FunctionList** function_list_ptr_ptr,

1300

                                    ReturnValue* return_value = ThrowException);

1301

1302

/**

1303

       * C_GetInterfaceList is used to obtain a list of interfaces supported by

1304

       * a Cryptoki library. count_ptr points to the location that receives the

1305

       * number of interfaces. There are two ways for an application to call

1306

       * C_GetInterfaceList:

1307

       *  1. If interface_list_ptr is NULL_PTR, then all that C_GetInterfaceList

1308

       *     does is return (in *count_ptr) the number of interfaces, without

1309

       *     actually returning a list of interfaces. The contents of *count_ptr

1310

       *     on entry to C_GetInterfaceList has no meaning in this case, and the

1311

       *     call returns the value CKR_OK.

1312

       *  2. If pIntrerfaceList is not NULL_PTR, then *count_ptr MUST contain the

1313

       *     size (in terms of CK_INTERFACE elements) of the buffer pointed to

1314

       *     by interface_list_ptr. If that buffer is large enough to  hold the

1315

       *     list of interfaces, then the list is returned in it, and CKR_OK is

1316

       *     returned. If not, then the call to C_GetInterfaceList returns the

1317

       *     value CKR_BUFFER_TOO_SMALL. In either case, the value *count_ptr is

1318

       *     set to hold the number of interfaces.

1319

1320

       * Because C_GetInterfaceList does not allocate any space of its own, an

1321

       * application will often call C_GetInterfaceList twice. However, this

1322

       * behavior is by no means required. C_GetInterfaceList obtains

1323

       * (in *pFunctionList of each interface) a pointer to the Cryptoki

1324

       * library’s list of function pointers. The pointer thus obtained may

1325

       * point into memory which is owned by the Cryptoki library, and which

1326

       * may or may not be writable. Whether or not this is the case, no attempt

1327

       * should be made to write to this memory. The same caveat applies to

1328

       * the interface names returned.

1329

1330

       * @param pkcs11_module The PKCS#11 module

1331

       * @param interface_list_ptr returned interfaces

1332

       * @param count_ptr number of interfaces returned

1333

       * @param return_value default value (`ThrowException`): throw exception on error.

1334

       * @return true on success, false otherwise

1335

*/

1336

      static bool C_GetInterfaceList(const Dynamically_Loaded_Library& pkcs11_module,

1337

                                     Interface* interface_list_ptr,

1338

                                     Ulong* count_ptr,

1339

                                     ReturnValue* return_value = ThrowException);

1340

1341

/**

1342

       * C_GetInterface is used to obtain an interface supported by a Cryptoki

1343

       * library. pInterfaceName specifies  the name of the interface, pVersion

1344

       * specifies the interface version, ppInterface points to the location

1345

       * that  receives the interface, flags specifies the required interface

1346

       * flags. There are multiple ways for an application to specify a

1347

       * particular interface when calling C_GetInterface:

1348

       * 1. If pInterfaceName is not NULL_PTR, the name of the interface

1349

       *    returned must match. If  pInterfaceName is NULL_PTR, the cryptoki

1350

       *    library can return a default interface of its choice

1351

       * 2. If pVersion is not NULL_PTR, the version of the interface returned

1352

       *    must match. If pVersion is  NULL_PTR, the cryptoki library can

1353

       *    return an interface of any version

1354

       * 3. If flags is non-zero, the interface returned must match all of the

1355

       *    supplied flag values (but may include  additional flags not

1356

       *    specified). If flags is 0, the cryptoki library can return an

1357

       *    interface with any flags

1358

1359

       * @param pkcs11_module The PKCS#11 module

1360

       * @param interface_name_ptr name of the interface

1361

       * @param version_ptr version of the interface

1362

       * @param interface_ptr_ptr returned interface

1363

       * @param flags flags controlling the semantics of the interface

1364

       * @param return_value default value (`ThrowException`): throw exception on error.

1365

       * @return true on success, false otherwise

1366

*/

1367

      static bool C_GetInterface(const Dynamically_Loaded_Library& pkcs11_module,

1368

                                 const Utf8Char* interface_name_ptr,

1369

                                 const Version* version_ptr,

1370

                                 Interface* interface_ptr_ptr,

1371

                                 Flags flags,

1372

                                 ReturnValue* return_value = ThrowException);

1373

1374

      /****************************** Slot and token management functions ******************************/

1375

1376

/**

1377

      * C_GetSlotList obtains a list of slots in the system.

1378

      * @param token_present only slots with tokens

1379

      * @param slot_list_ptr receives array of slot IDs

1380

      * @param count_ptr receives number of slots

1381

      * @param return_value default value (`ThrowException`): throw exception on error.

1382

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1383

      * At least the following PKCS#11 return values may be returned:

1384

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

1385

      *     \li FunctionFailed \li GeneralError \li HostMemory

1386

      *     \li OK

1387

      * @return true on success, false otherwise

1388

*/

1389

      bool C_GetSlotList(Bbool token_present,

1390

                         SlotId* slot_list_ptr,

1391

                         Ulong* count_ptr,

1392

                         ReturnValue* return_value = ThrowException) const;

1393

1394

/**

1395

      * C_GetSlotList obtains a list of slots in the system.

1396

      * @param token_present only slots with tokens

1397

      * @param slot_ids receives vector of slot IDs

1398

      * @param return_value default value (`ThrowException`): throw exception on error.

1399

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1400

      * At least the following PKCS#11 return values may be returned:

1401

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

1402

      *     \li FunctionFailed \li GeneralError \li HostMemory

1403

      *     \li OK

1404

      * @return true on success, false otherwise

1405

*/

1406

      bool C_GetSlotList(bool token_present,

1407

                         std::vector<SlotId>& slot_ids,

1408

                         ReturnValue* return_value = ThrowException) const;

1409

1410

/**

1411

      * C_GetSlotInfo obtains information about a particular slot in the system.

1412

      * @param slot_id the ID of the slot

1413

      * @param info_ptr receives the slot information

1414

      * @param return_value default value (`ThrowException`): throw exception on error.

1415

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1416

      * At least the following PKCS#11 return values may be returned:

1417

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

1418

      *     \li FunctionFailed \li GeneralError \li HostMemory

1419

      *     \li OK \li SlotIdInvalid

1420

      * @return true on success, false otherwise

1421

*/

1422

      bool C_GetSlotInfo(SlotId slot_id, SlotInfo* info_ptr, ReturnValue* return_value = ThrowException) const;

1423

1424

/**

1425

      * C_GetTokenInfo obtains information about a particular token in the system.

1426

      * @param slot_id ID of the token's slot

1427

      * @param info_ptr receives the token information

1428

      * @param return_value default value (`ThrowException`): throw exception on error.

1429

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1430

      * At least the following PKCS#11 return values may be returned:

1431

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1432

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1433

      *     \li HostMemory \li OK \li SlotIdInvalid

1434

      *     \li TokenNotPresent \li TokenNotRecognized \li ArgumentsBad

1435

      * @return true on success, false otherwise

1436

*/

1437

      bool C_GetTokenInfo(SlotId slot_id, TokenInfo* info_ptr, ReturnValue* return_value = ThrowException) const;

1438

1439

/**

1440

      * C_WaitForSlotEvent waits for a slot event (token insertion, removal, etc.) to occur.

1441

      * @param flags blocking/nonblocking flag

1442

      * @param slot_ptr location that receives the slot ID

1443

      * @param reserved reserved.  Should be NULL_PTR

1444

      * @param return_value default value (`ThrowException`): throw exception on error.

1445

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1446

      * At least the following PKCS#11 return values may be returned:

1447

      *     \li ArgumentsBad \li CryptokiNotInitialized \li FunctionFailed

1448

      *     \li GeneralError \li HostMemory \li NoEvent

1449

      *     \li OK

1450

      * @return true on success, false otherwise

1451

*/

1452

      bool C_WaitForSlotEvent(Flags flags,

1453

                              SlotId* slot_ptr,

1454

                              void* reserved,

1455

                              ReturnValue* return_value = ThrowException) const;

1456

1457

/**

1458

      * C_GetMechanismList obtains a list of mechanism types supported by a token.

1459

      * @param slot_id ID of token's slot

1460

      * @param mechanism_list_ptr gets mech. array

1461

      * @param count_ptr gets # of mechs.

1462

      * @param return_value default value (`ThrowException`): throw exception on error.

1463

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1464

      * At least the following PKCS#11 return values may be returned:

1465

      *     \li BufferTooSmall \li CryptokiNotInitialized \li DeviceError

1466

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

1467

      *     \li GeneralError \li HostMemory \li OK

1468

      *     \li SlotIdInvalid \li TokenNotPresent \li TokenNotRecognized

1469

      *     \li ArgumentsBad

1470

      * @return true on success, false otherwise

1471

*/

1472

      bool C_GetMechanismList(SlotId slot_id,

1473

                              MechanismType* mechanism_list_ptr,

1474

                              Ulong* count_ptr,

1475

                              ReturnValue* return_value = ThrowException) const;

1476

1477

/**

1478

      * C_GetMechanismList obtains a list of mechanism types supported by a token.

1479

      * @param slot_id ID of token's slot

1480

      * @param mechanisms receives vector of supported mechanisms

1481

      * @param return_value default value (`ThrowException`): throw exception on error.

1482

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1483

      * At least the following PKCS#11 return values may be returned:

1484

      *     \li BufferTooSmall \li CryptokiNotInitialized \li DeviceError

1485

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

1486

      *     \li GeneralError \li HostMemory \li OK

1487

      *     \li SlotIdInvalid \li TokenNotPresent \li TokenNotRecognized

1488

      *     \li ArgumentsBad

1489

      * @return true on success, false otherwise

1490

*/

1491

      bool C_GetMechanismList(SlotId slot_id,

1492

                              std::vector<MechanismType>& mechanisms,

1493

                              ReturnValue* return_value = ThrowException) const;

1494

1495

/**

1496

      * C_GetMechanismInfo obtains information about a particular mechanism possibly supported by a token.

1497

      * @param slot_id ID of the token's slot

1498

      * @param type type of mechanism

1499

      * @param info_ptr receives mechanism info

1500

      * @param return_value default value (`ThrowException`): throw exception on error.

1501

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1502

      * At least the following PKCS#11 return values may be returned:

1503

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1504

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1505

      *     \li HostMemory \li MechanismInvalid \li OK

1506

      *     \li SlotIdInvalid \li TokenNotPresent \li TokenNotRecognized

1507

      *     \li ArgumentsBad

1508

      * @return true on success, false otherwise

1509

*/

1510

      bool C_GetMechanismInfo(SlotId slot_id,

1511

                              MechanismType type,

1512

                              MechanismInfo* info_ptr,

1513

                              ReturnValue* return_value = ThrowException) const;

1514

1515

/**

1516

      * C_InitToken initializes a token.

1517

      * @param slot_id ID of the token's slot

1518

      * @param so_pin_ptr the SO's initial PIN

1519

      * @param so_pin_len length in bytes of the SO_PIN

1520

      * @param label_ptr 32-byte token label (blank padded)

1521

      * @param return_value default value (`ThrowException`): throw exception on error.

1522

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1523

      * At least the following PKCS#11 return values may be returned:

1524

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1525

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

1526

      *     \li GeneralError \li HostMemory \li OK

1527

      *     \li PinIncorrect \li PinLocked \li SessionExists

1528

      *     \li SlotIdInvalid \li TokenNotPresent \li TokenNotRecognized

1529

      *     \li TokenWriteProtected \li ArgumentsBad

1530

      * @return true on success, false otherwise

1531

*/

1532

      bool C_InitToken(SlotId slot_id,

1533

                       const Utf8Char* so_pin_ptr,

1534

                       Ulong so_pin_len,

1535

                       const Utf8Char* label_ptr,

1536

                       ReturnValue* return_value = ThrowException) const;

1537

1538

/**

1539

      * C_InitToken initializes a token.

1540

      * @param slot_id ID of the token's slot

1541

      * @param so_pin the SO's initial PIN

1542

      * @param label token label (at max 32 bytes long)

1543

      * @param return_value default value (`ThrowException`): throw exception on error.

1544

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1545

      * At least the following PKCS#11 return values may be returned:

1546

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1547

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

1548

      *     \li GeneralError \li HostMemory \li OK

1549

      *     \li PinIncorrect \li PinLocked \li SessionExists

1550

      *     \li SlotIdInvalid \li TokenNotPresent \li TokenNotRecognized

1551

      *     \li TokenWriteProtected \li ArgumentsBad

1552

      * @return true on success, false otherwise

1553

*/

1554

      template <typename TAlloc>

1556

                       const std::vector<uint8_t, TAlloc>& so_pin,

1557

                       std::string_view label,

1558

                       ReturnValue* return_value = ThrowException) const {

1562

1563

1570

1571

/**

1572

      * C_InitPIN initializes the normal user's PIN.

1573

      * @param session the session's handle

1574

      * @param pin_ptr the normal user's PIN

1575

      * @param pin_len length in bytes of the PIN

1576

      * @param return_value default value (`ThrowException`): throw exception on error.

1577

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1578

      * At least the following PKCS#11 return values may be returned:

1579

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1580

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

1581

      *     \li GeneralError \li HostMemory \li OK

1582

      *     \li PinInvalid \li PinLenRange \li SessionClosed

1583

      *     \li SessionReadOnly \li SessionHandleInvalid \li TokenWriteProtected

1584

      *     \li UserNotLoggedIn \li ArgumentsBad

1585

      * @return true on success, false otherwise

1586

*/

1587

      bool C_InitPIN(SessionHandle session,

1588

                     const Utf8Char* pin_ptr,

1589

                     Ulong pin_len,

1590

                     ReturnValue* return_value = ThrowException) const;

1591

1592

/**

1593

      * C_InitPIN initializes the normal user's PIN.

1594

      * @param session the session's handle

1595

      * @param pin the normal user's PIN

1596

      * @param return_value default value (`ThrowException`): throw exception on error.

1597

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1598

      * At least the following PKCS#11 return values may be returned:

1599

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1600

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

1601

      *     \li GeneralError \li HostMemory \li OK

1602

      *     \li PinInvalid \li PinLenRange \li SessionClosed

1603

      *     \li SessionReadOnly \li SessionHandleInvalid \li TokenWriteProtected

1604

      *     \li UserNotLoggedIn \li ArgumentsBad

1605

      * @return true on success, false otherwise

1606

*/

1607

      template <typename TAlloc>

1609

                     const std::vector<uint8_t, TAlloc>& pin,

1610

                     ReturnValue* return_value = ThrowException) const {

1615

1616

1617

/**

1618

      * C_SetPIN modifies the PIN of the user who is logged in.

1619

      * @param session the session's handle

1620

      * @param old_pin_ptr the old PIN

1621

      * @param old_len length of the old PIN

1622

      * @param new_pin_ptr the new PIN

1623

      * @param new_len length of the new PIN

1624

      * @param return_value default value (`ThrowException`): throw exception on error.

1625

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1626

      * At least the following PKCS#11 return values may be returned:

1627

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1628

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

1629

      *     \li GeneralError \li HostMemory \li OK

1630

      *     \li PinIncorrect \li PinInvalid \li PinLenRange

1631

      *     \li PinLocked \li SessionClosed \li SessionHandleInvalid

1632

      *     \li SessionReadOnly \li TokenWriteProtected \li ArgumentsBad

1633

      * @return true on success, false otherwise

1634

*/

1635

      bool C_SetPIN(SessionHandle session,

1636

                    const Utf8Char* old_pin_ptr,

1637

                    Ulong old_len,

1638

                    const Utf8Char* new_pin_ptr,

1639

                    Ulong new_len,

1640

                    ReturnValue* return_value = ThrowException) const;

1641

1642

/**

1643

      * C_SetPIN modifies the PIN of the user who is logged in.

1644

      * @param session the session's handle

1645

      * @param old_pin the old PIN

1646

      * @param new_pin the new PIN

1647

      * @param return_value default value (`ThrowException`): throw exception on error.

1648

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1649

      * At least the following PKCS#11 return values may be returned:

1650

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1651

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

1652

      *     \li GeneralError \li HostMemory \li OK

1653

      *     \li PinIncorrect \li PinInvalid \li PinLenRange

1654

      *     \li PinLocked \li SessionClosed \li SessionHandleInvalid

1655

      *     \li SessionReadOnly \li TokenWriteProtected \li ArgumentsBad

1656

      * @return true on success, false otherwise

1657

*/

1658

      template <typename TAlloc>

1660

                    const std::vector<uint8_t, TAlloc>& old_pin,

1661

                    const std::vector<uint8_t, TAlloc>& new_pin,

1662

                    ReturnValue* return_value = ThrowException) const {

1669

1670

1671

      /****************************** Session management ******************************/

1672

1673

/**

1674

      * C_OpenSession opens a session between an application and a token.

1675

      * @param slot_id the slot's ID

1676

      * @param flags from CK_SESSION_INFO

1677

      * @param application passed to callback

1678

      * @param notify callback function

1679

      * @param session_ptr gets session handle

1680

      * @param return_value default value (`ThrowException`): throw exception on error.

1681

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1682

      * At least the following PKCS#11 return values may be returned:

1683

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1684

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1685

      *     \li HostMemory \li OK \li SessionCount

1686

      *     \li SessionParallelNotSupported \li SessionReadWriteSoExists \li SlotIdInvalid

1687

      *     \li TokenNotPresent \li TokenNotRecognized \li TokenWriteProtected

1688

      *     \li ArgumentsBad

1689

      * @return true on success, false otherwise

1690

*/

1691

      bool C_OpenSession(SlotId slot_id,

1692

                         Flags flags,

1693

                         void* application,

1694

                         Notify notify,

1695

                         SessionHandle* session_ptr,

1696

                         ReturnValue* return_value = ThrowException) const;

1697

1698

/**

1699

      * C_CloseSession closes a session between an application and a token.

1700

      * @param session the session's handle

1701

      * @param return_value default value (`ThrowException`): throw exception on error.

1702

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1703

      * At least the following PKCS#11 return values may be returned:

1704

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1705

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1706

      *     \li HostMemory \li OK \li SessionClosed

1707

      *     \li SessionHandleInvalid

1708

      * @return true on success, false otherwise

1709

*/

1710

      bool C_CloseSession(SessionHandle session, ReturnValue* return_value = ThrowException) const;

1711

1712

/**

1713

      * C_CloseAllSessions closes all sessions with a token.

1714

      * @param slot_id the token's slot

1715

      * @param return_value default value (`ThrowException`): throw exception on error.

1716

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1717

      * At least the following PKCS#11 return values may be returned:

1718

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1719

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1720

      *     \li HostMemory \li OK \li SlotIdInvalid

1721

      *     \li TokenNotPresent

1722

      * @return true on success, false otherwise

1723

*/

1724

      bool C_CloseAllSessions(SlotId slot_id, ReturnValue* return_value = ThrowException) const;

1725

1726

/**

1727

      * C_GetSessionInfo obtains information about the session.

1728

      * @param session the session's handle

1729

      * @param info_ptr receives session info

1730

      * @param return_value default value (`ThrowException`): throw exception on error.

1731

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1732

      * At least the following PKCS#11 return values may be returned:

1733

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1734

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1735

      *     \li HostMemory \li OK \li SessionClosed

1736

      *     \li SessionHandleInvalid \li ArgumentsBad

1737

      * @return true on success, false otherwise

1738

*/

1739

      bool C_GetSessionInfo(SessionHandle session,

1740

                            SessionInfo* info_ptr,

1741

                            ReturnValue* return_value = ThrowException) const;

1742

1743

/**

1744

       * C_SessionCancel terminates active session based operations.

1745

1746

       * @param session the session's handle

1747

       * @param flags flags control which sessions are cancelled

1748

       * @param return_value default value (`ThrowException`): throw exception on error

1749

       * @return true on success, false otherwise

1750

*/

1751

      bool C_SessionCancel(SessionHandle session, Flags flags, ReturnValue* return_value = ThrowException);

1752

1753

/**

1754

      * C_GetOperationState obtains the state of the cryptographic operation in a session.

1755

      * @param session session's handle

1756

      * @param operation_state_ptr gets state

1757

      * @param operation_state_len_ptr gets state length

1758

      * @param return_value default value (`ThrowException`): throw exception on error.

1759

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1760

      * At least the following PKCS#11 return values may be returned:

1761

      *     \li BufferTooSmall \li CryptokiNotInitialized \li DeviceError

1762

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

1763

      *     \li GeneralError \li HostMemory \li OK

1764

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

1765

      *     \li StateUnsaveable \li ArgumentsBad

1766

      * @return true on success, false otherwise

1767

*/

1768

      bool C_GetOperationState(SessionHandle session,

1769

                               Byte* operation_state_ptr,

1770

                               Ulong* operation_state_len_ptr,

1771

                               ReturnValue* return_value = ThrowException) const;

1772

1773

/**

1774

      * C_SetOperationState restores the state of the cryptographic operation in a session.

1775

      * @param session session's handle

1776

      * @param operation_state_ptr holds state

1777

      * @param operation_state_len holds state length

1778

      * @param encryption_key en/decryption key

1779

      * @param authentication_key sign/verify key

1780

      * @param return_value default value (`ThrowException`): throw exception on error.

1781

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1782

      * At least the following PKCS#11 return values may be returned:

1783

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1784

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1785

      *     \li HostMemory \li KeyChanged \li KeyNeeded

1786

      *     \li KeyNotNeeded \li OK \li SavedStateInvalid

1787

      *     \li SessionClosed \li SessionHandleInvalid \li ArgumentsBad

1788

      * @return true on success, false otherwise

1789

*/

1790

      bool C_SetOperationState(SessionHandle session,

1791

                               const Byte* operation_state_ptr,

1792

                               Ulong operation_state_len,

1793

                               ObjectHandle encryption_key,

1794

                               ObjectHandle authentication_key,

1795

                               ReturnValue* return_value = ThrowException) const;

1796

1797

/**

1798

      * C_Login logs a user into a token.

1799

      * @param session the session's handle

1800

      * @param user_type the user type

1801

      * @param pin_ptr the user's PIN

1802

      * @param pin_len the length of the PIN

1803

      * @param return_value default value (`ThrowException`): throw exception on error.

1804

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1805

      * At least the following PKCS#11 return values may be returned:

1806

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

1807

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

1808

      *     \li FunctionFailed \li GeneralError \li HostMemory

1809

      *     \li OK \li OperationNotInitialized \li PinIncorrect

1810

      *     \li PinLocked \li SessionClosed \li SessionHandleInvalid

1811

      *     \li SessionReadOnlyExists \li UserAlreadyLoggedIn \li UserAnotherAlreadyLoggedIn

1812

      *     \li UserPinNotInitialized \li UserTooManyTypes \li UserTypeInvalid

1813

      * @return true on success, false otherwise

1814

*/

1815

      bool C_Login(SessionHandle session,

1816

                   UserType user_type,

1817

                   const Utf8Char* pin_ptr,

1818

                   Ulong pin_len,

1819

                   ReturnValue* return_value = ThrowException) const;

1820

1821

/**

1822

      * C_Login logs a user into a token.

1823

      * @param session the session's handle

1824

      * @param user_type the user type

1825

      * @param pin the user or security officer's PIN

1826

      * @param return_value default value (`ThrowException`): throw exception on error.

1827

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1828

      * At least the following PKCS#11 return values may be returned:

1829

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

1830

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

1831

      *     \li FunctionFailed \li GeneralError \li HostMemory

1832

      *     \li OK \li OperationNotInitialized \li PinIncorrect

1833

      *     \li PinLocked \li SessionClosed \li SessionHandleInvalid

1834

      *     \li SessionReadOnlyExists \li UserAlreadyLoggedIn \li UserAnotherAlreadyLoggedIn

1835

      *     \li UserPinNotInitialized \li UserTooManyTypes \li UserTypeInvalid

1836

      * @return true on success, false otherwise

1837

*/

1838

      template <typename TAlloc>

1840

                   UserType user_type,

1841

                   const std::vector<uint8_t, TAlloc>& pin,

1842

                   ReturnValue* return_value = ThrowException) const {

1844

                        user_type,

1848

1849

1850

/**

1851

       * C_LoginUser logs a user into a token.

1852

1853

       * @param session the session's handle

1854

       * @param user_type the user type

1855

       * @param pin_ptr the user's PIN

1856

       * @param pin_len the length of the PIN

1857

       * @param username_ptr the user's name

1858

       * @param username_len the length of the user's name

1859

       * @param return_value default value (`ThrowException`): throw exception on error

1860

       * @return true on success, false otherwise

1861

*/

1862

      bool C_LoginUser(SessionHandle session,

1863

                       UserType user_type,

1864

                       const Utf8Char* pin_ptr,

1865

                       Ulong pin_len,

1866

                       const Utf8Char* username_ptr,

1867

                       Ulong username_len,

1868

                       ReturnValue* return_value = ThrowException);

1869

1870

/**

1871

      * C_Logout logs a user out from a token.

1872

      * @param session the session's handle

1873

      * @param return_value default value (`ThrowException`): throw exception on error.

1874

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1875

      * At least the following PKCS#11 return values may be returned:

1876

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

1877

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

1878

      *     \li HostMemory \li OK \li SessionClosed

1879

      *     \li SessionHandleInvalid \li UserNotLoggedIn

1880

      * @return true on success, false otherwise

1881

*/

1882

      bool C_Logout(SessionHandle session, ReturnValue* return_value = ThrowException) const;

1883

1884

/**

1885

       * C_GetSessionValidationFlags fetches the requested flags from the session. See

1886

       * Validation indicators (section4.15.3.1) for meaning and semantics for these

1887

       * flags. Applications are responsible for the appropriate locking to protect

1888

       * session to get a meaningful result from this call.

1889

1890

       * @param session the session's handle

1891

       * @param type which state of flags

1892

       * @param flags_ptr validation flags

1893

       * @param return_value default value (`ThrowException`): throw exception on error

1894

       * @return true on success, false otherwise

1895

*/

1896

      bool C_GetSessionValidationFlags(SessionHandle session,

1897

                                       Ulong type,

1898

                                       Flags* flags_ptr,

1899

                                       ReturnValue* return_value = ThrowException);

1900

1901

      /****************************** Object management functions ******************************/

1902

1903

/**

1904

      * C_CreateObject creates a new object.

1905

      * @param session the session's handle

1906

      * @param attribute_template_ptr the object's template

1907

      * @param count attributes in template

1908

      * @param object_ptr gets new object's handle.

1909

      * @param return_value default value (`ThrowException`): throw exception on error.

1910

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1911

      * At least the following PKCS#11 return values may be returned:

1912

      *     \li ArgumentsBad \li AttributeReadOnly \li AttributeTypeInvalid

1913

      *     \li AttributeValueInvalid \li CryptokiNotInitialized \li CurveNotSupported

1914

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

1915

      *     \li DomainParamsInvalid \li FunctionFailed \li GeneralError

1916

      *     \li HostMemory \li OK \li PinExpired

1917

      *     \li SessionClosed \li SessionHandleInvalid \li SessionReadOnly

1918

      *     \li TemplateIncomplete \li TemplateInconsistent \li TokenWriteProtected

1919

      *     \li UserNotLoggedIn

1920

      * @return true on success, false otherwise

1921

*/

1922

      bool C_CreateObject(SessionHandle session,

1923

                          Attribute* attribute_template_ptr,

1924

                          Ulong count,

1925

                          ObjectHandle* object_ptr,

1926

                          ReturnValue* return_value = ThrowException) const;

1927

1928

/**

1929

      * C_CopyObject copies an object, creating a new object for the copy.

1930

      * @param session the session's handle

1931

      * @param object the object's handle

1932

      * @param attribute_template_ptr template for new object

1933

      * @param count attributes in template

1934

      * @param new_object_ptr receives handle of copy

1935

      * @param return_value default value (`ThrowException`): throw exception on error.

1936

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1937

      * At least the following PKCS#11 return values may be returned:

1938

      *     \li ActionProhibited \li ArgumentsBad \li AttributeReadOnly

1939

      *     \li AttributeTypeInvalid \li AttributeValueInvalid \li CryptokiNotInitialized

1940

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

1941

      *     \li FunctionFailed \li GeneralError \li HostMemory

1942

      *     \li ObjectHandleInvalid \li OK \li PinExpired

1943

      *     \li SessionClosed \li SessionHandleInvalid \li SessionReadOnly

1944

      *     \li TemplateInconsistent \li TokenWriteProtected \li UserNotLoggedIn

1945

      * @return true on success, false otherwise

1946

*/

1947

      bool C_CopyObject(SessionHandle session,

1948

                        ObjectHandle object,

1949

                        Attribute* attribute_template_ptr,

1950

                        Ulong count,

1951

                        ObjectHandle* new_object_ptr,

1952

                        ReturnValue* return_value = ThrowException) const;

1953

1954

/**

1955

      * C_DestroyObject destroys an object.

1956

      * @param session the session's handle

1957

      * @param object the object's handle

1958

      * @param return_value default value (`ThrowException`): throw exception on error.

1959

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1960

      * At least the following PKCS#11 return values may be returned:

1961

      *     \li ActionProhibited \li CryptokiNotInitialized \li DeviceError

1962

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

1963

      *     \li GeneralError \li HostMemory \li ObjectHandleInvalid

1964

      *     \li OK \li PinExpired \li SessionClosed

1965

      *     \li SessionHandleInvalid \li SessionReadOnly \li TokenWriteProtected

1966

      * @return true on success, false otherwise

1967

*/

1968

      bool C_DestroyObject(SessionHandle session,

1969

                           ObjectHandle object,

1970

                           ReturnValue* return_value = ThrowException) const;

1971

1972

/**

1973

      * C_GetObjectSize gets the size of an object in bytes.

1974

      * @param session the session's handle

1975

      * @param object the object's handle

1976

      * @param size_ptr receives size of object

1977

      * @param return_value default value (`ThrowException`): throw exception on error.

1978

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

1979

      * At least the following PKCS#11 return values may be returned:

1980

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

1981

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

1982

      *     \li GeneralError \li HostMemory \li InformationSensitive

1983

      *     \li ObjectHandleInvalid \li OK \li SessionClosed

1984

      *     \li SessionHandleInvalid

1985

      * @return true on success, false otherwise

1986

*/

1987

      bool C_GetObjectSize(SessionHandle session,

1988

                           ObjectHandle object,

1989

                           Ulong* size_ptr,

1990

                           ReturnValue* return_value = ThrowException) const;

1991

1992

/**

1993

      * C_GetAttributeValue obtains the value of one or more object attributes.

1994

      * @param session the session's handle

1995

      * @param object the object's handle

1996

      * @param attribute_template_ptr specifies attrs; gets vals

1997

      * @param count attributes in template

1998

      * @param return_value default value (`ThrowException`): throw exception on error.

1999

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2000

      * At least the following PKCS#11 return values may be returned:

2001

      *     \li ArgumentsBad \li AttributeSensitive \li AttributeTypeInvalid

2002

      *     \li BufferTooSmall \li CryptokiNotInitialized \li DeviceError

2003

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

2004

      *     \li GeneralError \li HostMemory \li ObjectHandleInvalid

2005

      *     \li OK \li SessionClosed \li SessionHandleInvalid

2006

      * @return true on success, false otherwise

2007

*/

2008

      bool C_GetAttributeValue(SessionHandle session,

2009

                               ObjectHandle object,

2010

                               Attribute* attribute_template_ptr,

2011

                               Ulong count,

2012

                               ReturnValue* return_value = ThrowException) const;

2013

2014

/**

2015

      * C_GetAttributeValue obtains the value of one or more object attributes.

2016

      * @param session the session's handle

2017

      * @param object the object's handle

2018

      * @param attribute_values specifies attrs; gets vals

2019

      * @param return_value default value (`ThrowException`): throw exception on error.

2020

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2021

      * At least the following PKCS#11 return values may be returned:

2022

      *     \li ArgumentsBad \li AttributeSensitive \li AttributeTypeInvalid

2023

      *     \li BufferTooSmall \li CryptokiNotInitialized \li DeviceError

2024

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

2025

      *     \li GeneralError \li HostMemory \li ObjectHandleInvalid

2026

      *     \li OK \li SessionClosed \li SessionHandleInvalid

2027

      * @return true on success, false otherwise

2028

*/

2029

      template <typename TAlloc>

2031

                               ObjectHandle object,

2032

                               std::map<AttributeType, std::vector<uint8_t, TAlloc>>& attribute_values,

2033

                               ReturnValue* return_value = ThrowException) const {

2035

2038

2039

2041

                                            object,

2044

                                            return_value);

2045

2047

            return success;

2048

2049

2056

2057

2059

                                    object,

2062

                                    return_value);

2064

2065

/**

2066

      * C_SetAttributeValue modifies the value of one or more object attributes.

2067

      * @param session the session's handle

2068

      * @param object the object's handle

2069

      * @param attribute_template_ptr specifies attrs and values

2070

      * @param count attributes in template

2071

      * @param return_value default value (`ThrowException`): throw exception on error.

2072

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2073

      * At least the following PKCS#11 return values may be returned:

2074

      *     \li ActionProhibited \li ArgumentsBad \li AttributeReadOnly

2075

      *     \li AttributeTypeInvalid \li AttributeValueInvalid \li CryptokiNotInitialized

2076

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2077

      *     \li FunctionFailed \li GeneralError \li HostMemory

2078

      *     \li ObjectHandleInvalid \li OK \li SessionClosed

2079

      *     \li SessionHandleInvalid \li SessionReadOnly \li TemplateInconsistent

2080

      *     \li TokenWriteProtected \li UserNotLoggedIn

2081

      * @return true on success, false otherwise

2082

*/

2083

      bool C_SetAttributeValue(SessionHandle session,

2084

                               ObjectHandle object,

2085

                               Attribute* attribute_template_ptr,

2086

                               Ulong count,

2087

                               ReturnValue* return_value = ThrowException) const;

2088

2089

/**

2090

      * C_SetAttributeValue modifies the value of one or more object attributes.

2091

      * @param session the session's handle

2092

      * @param object the object's handle

2093

      * @param attribute_values specifies attrs and values

2094

      * @param return_value default value (`ThrowException`): throw exception on error.

2095

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2096

      * At least the following PKCS#11 return values may be returned:

2097

      *     \li ActionProhibited \li ArgumentsBad \li AttributeReadOnly

2098

      *     \li AttributeTypeInvalid \li AttributeValueInvalid \li CryptokiNotInitialized

2099

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2100

      *     \li FunctionFailed \li GeneralError \li HostMemory

2101

      *     \li ObjectHandleInvalid \li OK \li SessionClosed

2102

      *     \li SessionHandleInvalid \li SessionReadOnly \li TemplateInconsistent

2103

      *     \li TokenWriteProtected \li UserNotLoggedIn

2104

      * @return true on success, false otherwise

2105

*/

2106

      template <typename TAlloc>

2108

                               ObjectHandle object,

2109

                               std::map<AttributeType, std::vector<uint8_t, TAlloc>>& attribute_values,

2110

                               ReturnValue* return_value = ThrowException) const {

2112

2117

2118

2120

                                    object,

2125

2126

/**

2127

      * C_FindObjectsInit initializes a search for token and session objects that match a template.

2128

      * @param session the session's handle

2129

      * @param attribute_template_ptr attribute values to match

2130

      * @param count attrs in search template

2131

      * @param return_value default value (`ThrowException`): throw exception on error.

2132

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2133

      * At least the following PKCS#11 return values may be returned:

2134

      *     \li ArgumentsBad \li AttributeTypeInvalid \li AttributeValueInvalid

2135

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

2136

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

2137

      *     \li HostMemory \li OK \li OperationActive

2138

      *     \li PinExpired \li SessionClosed \li SessionHandleInvalid

2139

      * @return true on success, false otherwise

2140

*/

2141

      bool C_FindObjectsInit(SessionHandle session,

2142

                             Attribute* attribute_template_ptr,

2143

                             Ulong count,

2144

                             ReturnValue* return_value = ThrowException) const;

2145

2146

/**

2147

      * C_FindObjects continues a search for token and session objects that match a template, obtaining additional object handles.

2148

      * @param session session's handle

2149

      * @param object_ptr gets obj. handles

2150

      * @param max_object_count max handles to get

2151

      * @param object_count_ptr actual # returned

2152

      * @param return_value default value (`ThrowException`): throw exception on error.

2153

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2154

      * At least the following PKCS#11 return values may be returned:

2155

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

2156

      *     \li DeviceMemory \li DeviceRemoved \li FunctionFailed

2157

      *     \li GeneralError \li HostMemory \li OK

2158

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

2159

      * @return true on success, false otherwise

2160

*/

2161

      bool C_FindObjects(SessionHandle session,

2162

                         ObjectHandle* object_ptr,

2163

                         Ulong max_object_count,

2164

                         Ulong* object_count_ptr,

2165

                         ReturnValue* return_value = ThrowException) const;

2166

2167

/**

2168

      * C_FindObjectsFinal finishes a search for token and session objects.

2169

      * @param session the session's handle

2170

      * @param return_value default value (`ThrowException`): throw exception on error.

2171

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2172

      * At least the following PKCS#11 return values may be returned:

2173

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

2174

      *     \li DeviceRemoved \li FunctionFailed \li GeneralError

2175

      *     \li HostMemory \li OK \li OperationNotInitialized

2176

      *     \li SessionClosed \li SessionHandleInvalid

2177

      * @return true on success, false otherwise

2178

*/

2179

      bool C_FindObjectsFinal(SessionHandle session, ReturnValue* return_value = ThrowException) const;

2180

2181

      /****************************** Encryption functions ******************************/

2182

2183

/**

2184

      * C_EncryptInit initializes an encryption operation.

2185

      * @param session the session's handle

2186

      * @param mechanism_ptr the encryption mechanism

2187

      * @param key handle of encryption key

2188

      * @param return_value default value (`ThrowException`): throw exception on error.

2189

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2190

      * At least the following PKCS#11 return values may be returned:

2191

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

2192

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

2193

      *     \li GeneralError \li HostMemory \li KeyFunctionNotPermitted

2194

      *     \li KeyHandleInvalid \li KeySizeRange \li KeyTypeInconsistent

2195

      *     \li MechanismInvalid \li MechanismParamInvalid \li OK

2196

      *     \li OperationActive \li PinExpired \li SessionClosed

2197

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2198

      * @return true on success, false otherwise

2199

*/

2200

      bool C_EncryptInit(SessionHandle session,

2201

                         const Mechanism* mechanism_ptr,

2202

                         ObjectHandle key,

2203

                         ReturnValue* return_value = ThrowException) const;

2204

2205

/**

2206

      * C_Encrypt encrypts single-part data.

2207

      * @param session session's handle

2208

      * @param data_ptr the plaintext data

2209

      * @param data_len size of plaintext data in bytes

2210

      * @param encrypted_data gets ciphertext

2211

      * @param encrypted_data_len_ptr gets c-text size

2212

      * @param return_value default value (`ThrowException`): throw exception on error.

2213

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2214

      * At least the following PKCS#11 return values may be returned:

2215

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2216

      *     \li DataInvalid \li DataLenRange \li DeviceError

2217

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2218

      *     \li FunctionFailed \li GeneralError \li HostMemory

2219

      *     \li OK \li OperationNotInitialized \li SessionClosed

2220

      *     \li SessionHandleInvalid

2221

      * @return true on success, false otherwise

2222

*/

2223

      bool C_Encrypt(SessionHandle session,

2224

                     const Byte* data_ptr,

2225

                     Ulong data_len,

2226

                     Byte* encrypted_data,

2227

                     Ulong* encrypted_data_len_ptr,

2228

                     ReturnValue* return_value = ThrowException) const;

2229

2230

/**

2231

      * C_Encrypt encrypts single-part data.

2232

      * @param session session's handle

2233

      * @param plaintext_data the plaintext data

2234

      * @param encrypted_data gets ciphertext

2235

      * @param return_value default value (`ThrowException`): throw exception on error.

2236

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2237

      * At least the following PKCS#11 return values may be returned:

2238

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2239

      *     \li DataInvalid \li DataLenRange \li DeviceError

2240

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2241

      *     \li FunctionFailed \li GeneralError \li HostMemory

2242

      *     \li OK \li OperationNotInitialized \li SessionClosed

2243

      *     \li SessionHandleInvalid

2244

      * @return true on success, false otherwise

2245

*/

2246

      template <typename TAllocA, typename TAllocB>

2248

                     const std::vector<uint8_t, TAllocA>& plaintext_data,

2249

                     std::vector<uint8_t, TAllocB>& encrypted_data,

2250

                     ReturnValue* return_value = ThrowException) const {

2255

                       nullptr,

2256

                       &encrypted_size,

2257

                       return_value)) {

2258

            return false;

2259

2260

2265

                       encrypted_data.data(),

2266

                       &encrypted_size,

2267

                       return_value)) {

2268

            return false;

2269

2271

         return true;

2272

2273

2274

/**

2275

      * C_EncryptUpdate continues a multiple-part encryption operation.

2276

      * @param session session's handle

2277

      * @param part_ptr the plaintext data

2278

      * @param part_len plaintext data len

2279

      * @param encrypted_part_ptr gets ciphertext

2280

      * @param encrypted_part_len_ptr gets c-text size

2281

      * @param return_value default value (`ThrowException`): throw exception on error.

2282

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2283

      * At least the following PKCS#11 return values may be returned:

2284

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2285

      *     \li DataLenRange \li DeviceError \li DeviceMemory

2286

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

2287

      *     \li GeneralError \li HostMemory \li OK

2288

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

2289

      * @return true on success, false otherwise

2290

*/

2291

      bool C_EncryptUpdate(SessionHandle session,

2292

                           const Byte* part_ptr,

2293

                           Ulong part_len,

2294

                           Byte* encrypted_part_ptr,

2295

                           Ulong* encrypted_part_len_ptr,

2296

                           ReturnValue* return_value = ThrowException) const;

2297

2298

/**

2299

      * C_EncryptFinal finishes a multiple-part encryption operation.

2300

      * @param session session handle

2301

      * @param last_encrypted_part_ptr last c-text

2302

      * @param last_encrypted_part_len_ptr gets last size

2303

      * @param return_value default value (`ThrowException`): throw exception on error.

2304

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2305

      * At least the following PKCS#11 return values may be returned:

2306

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2307

      *     \li DataLenRange \li DeviceError \li DeviceMemory

2308

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

2309

      *     \li GeneralError \li HostMemory \li OK

2310

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

2311

      * @return true on success, false otherwise

2312

*/

2313

      bool C_EncryptFinal(SessionHandle session,

2314

                          Byte* last_encrypted_part_ptr,

2315

                          Ulong* last_encrypted_part_len_ptr,

2316

                          ReturnValue* return_value = ThrowException) const;

2317

2318

      /*********************** Message-based encryption functions ***********************/

2319

2320

/**

2321

       * C_MessageEncryptInit prepares a session for one or more encryption

2322

       * operations that use the same encryption mechanism and

2323

       * encryption key.

2324

2325

       * @param session the session's handle

2326

       * @param mechanism_ptr the encryption mechanism

2327

       * @param key handle of encryption key

2328

       * @param return_value default value (`ThrowException`): throw exception on error

2329

       * @return true on success, false otherwise

2330

*/

2331

      bool C_MessageEncryptInit(SessionHandle session,

2332

                                const Mechanism* mechanism_ptr,

2333

                                ObjectHandle key,

2334

                                ReturnValue* return_value = ThrowException);

2335

2336

/**

2337

       * C_EncryptMessage encrypts a message in a single part.

2338

2339

       * @param session the session's handle

2340

       * @param parameter_ptr message specific parameter

2341

       * @param parameter_len length of message specific parameter

2342

       * @param associated_data_ptr AEAD Associated data

2343

       * @param associated_data_len AEAD Associated data length

2344

       * @param plaintext_ptr plain text

2345

       * @param plaintext_len plain text length

2346

       * @param ciphertext_ptr gets cipher text

2347

       * @param ciphertext_len_ptr gets cipher text length

2348

       * @param return_value default value (`ThrowException`): throw exception on error

2349

       * @return true on success, false otherwise

2350

*/

2351

      bool C_EncryptMessage(SessionHandle session,

2352

                            const void* parameter_ptr,

2353

                            Ulong parameter_len,

2354

                            const Byte* associated_data_ptr,

2355

                            Ulong associated_data_len,

2356

                            const Byte* plaintext_ptr,

2357

                            Ulong plaintext_len,

2358

                            Byte* ciphertext_ptr,

2359

                            Ulong* ciphertext_len_ptr,

2360

                            ReturnValue* return_value = ThrowException);

2361

2362

/**

2363

       * C_EncryptMessageBegin begins a multiple-part message encryption operation.

2364

2365

       * @param session the session's handle

2366

       * @param parameter_ptr message specific parameter

2367

       * @param parameter_len length of message specific parameter

2368

       * @param associated_data_ptr AEAD Associated data

2369

       * @param associated_data_len AEAD Associated data length

2370

       * @param return_value default value (`ThrowException`): throw exception on error

2371

       * @return true on success, false otherwise

2372

*/

2373

      bool C_EncryptMessageBegin(SessionHandle session,

2374

                                 const void* parameter_ptr,

2375

                                 Ulong parameter_len,

2376

                                 const Byte* associated_data_ptr,

2377

                                 Ulong associated_data_len,

2378

                                 ReturnValue* return_value = ThrowException);

2379

2380

/**

2381

       * C_EncryptMessageNext continues a multiple-part message encryption operation,

2382

       * processing another message part.

2383

2384

       * @param session the session's handle

2385

       * @param parameter_ptr message specific parameter

2386

       * @param parameter_len length of message specific parameter

2387

       * @param plaintext_part_ptr plain text

2388

       * @param plaintext_part_len plain text length

2389

       * @param ciphertext_ptr gets cipher text

2390

       * @param ciphertext_part_len_ptr gets cipher text length

2391

       * @param flags multi mode flag

2392

       * @param return_value default value (`ThrowException`): throw exception on error

2393

       * @return true on success, false otherwise

2394

*/

2395

      bool C_EncryptMessageNext(SessionHandle session,

2396

                                const void* parameter_ptr,

2397

                                Ulong parameter_len,

2398

                                const Byte* plaintext_part_ptr,

2399

                                Ulong plaintext_part_len,

2400

                                Byte* ciphertext_ptr,

2401

                                Ulong* ciphertext_part_len_ptr,

2402

                                Flags flags,

2403

                                ReturnValue* return_value = ThrowException);

2404

2405

/**

2406

       * C_MessageDecryptFinal finishes a message-based decryption process.

2407

2408

       * @param session the session's handle

2409

       * @param return_value default value (`ThrowException`): throw exception on error

2410

       * @return true on success, false otherwise

2411

*/

2412

      bool C_MessageEncryptFinal(SessionHandle session, ReturnValue* return_value = ThrowException);

2413

2414

      /****************************** Decryption functions ******************************/

2415

2416

/**

2417

      * C_DecryptInit initializes a decryption operation.

2418

      * @param session the session's handle

2419

      * @param mechanism_ptr the decryption mechanism

2420

      * @param key handle of decryption key

2421

      * @param return_value default value (`ThrowException`): throw exception on error.

2422

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2423

      * At least the following PKCS#11 return values may be returned:

2424

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

2425

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2426

      *     \li FunctionFailed \li GeneralError \li HostMemory

2427

      *     \li KeyFunctionNotPermitted \li KeyHandleInvalid \li KeySizeRange

2428

      *     \li KeyTypeInconsistent \li MechanismInvalid \li MechanismParamInvalid

2429

      *     \li OK \li OperationActive \li PinExpired

2430

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

2431

      * @return true on success, false otherwise

2432

*/

2433

      bool C_DecryptInit(SessionHandle session,

2434

                         const Mechanism* mechanism_ptr,

2435

                         ObjectHandle key,

2436

                         ReturnValue* return_value = ThrowException) const;

2437

2438

/**

2439

      * C_Decrypt decrypts encrypted data in a single part.

2440

      * @param session session's handle

2441

      * @param encrypted_data_ptr ciphertext

2442

      * @param encrypted_data_len ciphertext length

2443

      * @param data_ptr gets plaintext

2444

      * @param data_len_ptr gets p-text size

2445

      * @param return_value default value (`ThrowException`): throw exception on error.

2446

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2447

      * At least the following PKCS#11 return values may be returned:

2448

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2449

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2450

      *     \li EncryptedDataInvalid \li EncryptedDataLenRange \li FunctionCanceled

2451

      *     \li FunctionFailed \li GeneralError \li HostMemory

2452

      *     \li OK \li OperationNotInitialized \li SessionClosed

2453

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2454

      * @return true on success, false otherwise

2455

*/

2456

      bool C_Decrypt(SessionHandle session,

2457

                     const Byte* encrypted_data_ptr,

2458

                     Ulong encrypted_data_len,

2459

                     Byte* data_ptr,

2460

                     Ulong* data_len_ptr,

2461

                     ReturnValue* return_value = ThrowException) const;

2462

2463

/**

2464

      * C_Decrypt decrypts encrypted data in a single part.

2465

      * @param session session's handle

2466

      * @param encrypted_data ciphertext

2467

      * @param decrypted_data gets plaintext

2468

      * @param return_value default value (`ThrowException`): throw exception on error.

2469

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2470

      * At least the following PKCS#11 return values may be returned:

2471

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2472

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2473

      *     \li EncryptedDataInvalid \li EncryptedDataLenRange \li FunctionCanceled

2474

      *     \li FunctionFailed \li GeneralError \li HostMemory

2475

      *     \li OK \li OperationNotInitialized \li SessionClosed

2476

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2477

      * @return true on success, false otherwise

2478

*/

2479

      template <typename TAllocA, typename TAllocB>

2481

                     const std::vector<uint8_t, TAllocA>& encrypted_data,

2482

                     std::vector<uint8_t, TAllocB>& decrypted_data,

2483

                     ReturnValue* return_value = ThrowException) const {

2488

                       nullptr,

2489

                       &decrypted_size,

2490

                       return_value)) {

2491

            return false;

2492

2493

2498

                       decrypted_data.data(),

2499

                       &decrypted_size,

2500

                       return_value)) {

2501

            return false;

2502

2504

         return true;

2505

2506

2507

/**

2508

      * C_DecryptUpdate continues a multiple-part decryption operation.

2509

      * @param session session's handle

2510

      * @param encrypted_part_ptr encrypted data

2511

      * @param encrypted_part_len input length

2512

      * @param part_ptr gets plaintext

2513

      * @param part_len_ptr p-text size

2514

      * @param return_value default value (`ThrowException`): throw exception on error.

2515

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2516

      * At least the following PKCS#11 return values may be returned:

2517

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2518

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2519

      *     \li EncryptedDataInvalid \li EncryptedDataLenRange \li FunctionCanceled

2520

      *     \li FunctionFailed \li GeneralError \li HostMemory

2521

      *     \li OK \li OperationNotInitialized \li SessionClosed

2522

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2523

      * @return true on success, false otherwise

2524

*/

2525

      bool C_DecryptUpdate(SessionHandle session,

2526

                           const Byte* encrypted_part_ptr,

2527

                           Ulong encrypted_part_len,

2528

                           Byte* part_ptr,

2529

                           Ulong* part_len_ptr,

2530

                           ReturnValue* return_value = ThrowException) const;

2531

2532

/**

2533

      * C_DecryptFinal finishes a multiple-part decryption operation.

2534

      * @param session the session's handle

2535

      * @param last_part_ptr gets plaintext

2536

      * @param last_part_len_ptr p-text size

2537

      * @param return_value default value (`ThrowException`): throw exception on error.

2538

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2539

      * At least the following PKCS#11 return values may be returned:

2540

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2541

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2542

      *     \li EncryptedDataInvalid \li EncryptedDataLenRange \li FunctionCanceled

2543

      *     \li FunctionFailed \li GeneralError \li HostMemory

2544

      *     \li OK \li OperationNotInitialized \li SessionClosed

2545

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2546

      * @return true on success, false otherwise

2547

*/

2548

      bool C_DecryptFinal(SessionHandle session,

2549

                          Byte* last_part_ptr,

2550

                          Ulong* last_part_len_ptr,

2551

                          ReturnValue* return_value = ThrowException) const;

2552

2553

      /*********************** Message-based decryption functions ***********************/

2554

2555

/**

2556

       * C_MessageDecryptInit initializes a message-based decryption process,

2557

       * preparing a session for one or more decryption operations that use the

2558

       * same decryption mechanism and decryption key.

2559

2560

       * @param session the session's handle

2561

       * @param mechanism_ptr the decryption mechanism

2562

       * @param key handle of decryption key

2563

       * @param return_value default value (`ThrowException`): throw exception on error

2564

       * @return true on success, false otherwise

2565

*/

2566

      bool C_MessageDecryptInit(SessionHandle session,

2567

                                const Mechanism* mechanism_ptr,

2568

                                ObjectHandle key,

2569

                                ReturnValue* return_value = ThrowException);

2570

2571

/**

2572

       * C_DecryptMessage decrypts an encrypted message in a single part.

2573

2574

       * @param session the session's handle

2575

       * @param parameter_ptr message specific parameter

2576

       * @param parameter_len length of message specific parameter

2577

       * @param associated_data_ptr AEAD Associated data

2578

       * @param associated_data_len AEAD Associated data length

2579

       * @param ciphertext_ptr cipher text

2580

       * @param ciphertext_len cipher text length

2581

       * @param plaintext_ptr gets plain text

2582

       * @param plaintext_len_ptr gets plain text length

2583

       * @param return_value default value (`ThrowException`): throw exception on error

2584

       * @return true on success, false otherwise

2585

*/

2586

      bool C_DecryptMessage(SessionHandle session,

2587

                            const void* parameter_ptr,

2588

                            Ulong parameter_len,

2589

                            const Byte* associated_data_ptr,

2590

                            Ulong associated_data_len,

2591

                            const Byte* ciphertext_ptr,

2592

                            Ulong ciphertext_len,

2593

                            Byte* plaintext_ptr,

2594

                            Ulong* plaintext_len_ptr,

2595

                            ReturnValue* return_value = ThrowException);

2596

2597

/**

2598

       * C_DecryptMessageBegin begins a multiple-part message decryption operation.

2599

2600

       * @param session the session's handle

2601

       * @param parameter_ptr message specific parameter

2602

       * @param parameter_len length of message specific parameter

2603

       * @param associated_data_ptr AEAD Associated data

2604

       * @param associated_data_len AEAD Associated data length

2605

       * @param return_value default value (`ThrowException`): throw exception on error

2606

       * @return true on success, false otherwise

2607

*/

2608

      bool C_DecryptMessageBegin(SessionHandle session,

2609

                                 const void* parameter_ptr,

2610

                                 Ulong parameter_len,

2611

                                 const Byte* associated_data_ptr,

2612

                                 Ulong associated_data_len,

2613

                                 ReturnValue* return_value = ThrowException);

2614

2615

/**

2616

       * C_DecryptMessageNext continues a multiple-part message decryption operation,

2617

       * processing another encrypted message part.

2618

2619

       * @param session the session's handle

2620

       * @param parameter_ptr message specific parameter

2621

       * @param parameter_len length of message specific parameter

2622

       * @param ciphertext_part_ptr cipher text

2623

       * @param ciphertext_part_len cipher text length

2624

       * @param plaintext_ptr gets plain text

2625

       * @param plaintext_part_len_ptr gets plain text length

2626

       * @param flags multi mode flag

2627

       * @param return_value default value (`ThrowException`): throw exception on error

2628

       * @return true on success, false otherwise

2629

*/

2630

      bool C_DecryptMessageNext(SessionHandle session,

2631

                                const void* parameter_ptr,

2632

                                Ulong parameter_len,

2633

                                const Byte* ciphertext_part_ptr,

2634

                                Ulong ciphertext_part_len,

2635

                                Byte* plaintext_ptr,

2636

                                Ulong* plaintext_part_len_ptr,

2637

                                Flags flags,

2638

                                ReturnValue* return_value = ThrowException);

2639

2640

/**

2641

       * C_MessageDecryptFinal finishes a message-based decryption process.

2642

2643

       * @param session the session's handle

2644

       * @param return_value default value (`ThrowException`): throw exception on error

2645

       * @return true on success, false otherwise

2646

*/

2647

      bool C_MessageDecryptFinal(SessionHandle session, ReturnValue* return_value = ThrowException);

2648

2649

      /****************************** Message digesting functions ******************************/

2650

2651

/**

2652

      * C_DigestInit initializes a message-digesting operation.

2653

      * @param session the session's handle

2654

      * @param mechanism_ptr the digesting mechanism

2655

      * @param return_value default value (`ThrowException`): throw exception on error.

2656

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2657

      * At least the following PKCS#11 return values may be returned:

2658

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

2659

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2660

      *     \li FunctionFailed \li GeneralError \li HostMemory

2661

      *     \li MechanismInvalid \li MechanismParamInvalid \li OK

2662

      *     \li OperationActive \li PinExpired \li SessionClosed

2663

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2664

      * @return true on success, false otherwise

2665

*/

2666

      bool C_DigestInit(SessionHandle session,

2667

                        const Mechanism* mechanism_ptr,

2668

                        ReturnValue* return_value = ThrowException) const;

2669

2670

/**

2671

      * C_Digest digests data in a single part.

2672

      * @param session the session's handle

2673

      * @param data_ptr data to be digested

2674

      * @param data_len bytes of data to digest

2675

      * @param digest_ptr gets the message digest

2676

      * @param digest_len_ptr gets digest length

2677

      * @param return_value default value (`ThrowException`): throw exception on error.

2678

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2679

      * At least the following PKCS#11 return values may be returned:

2680

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2681

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2682

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

2683

      *     \li HostMemory \li OK \li OperationNotInitialized

2684

      *     \li SessionClosed \li SessionHandleInvalid

2685

      * @return true on success, false otherwise

2686

*/

2687

      bool C_Digest(SessionHandle session,

2688

                    const Byte* data_ptr,

2689

                    Ulong data_len,

2690

                    Byte* digest_ptr,

2691

                    Ulong* digest_len_ptr,

2692

                    ReturnValue* return_value = ThrowException) const;

2693

2694

/**

2695

      * C_DigestUpdate continues a multiple-part message-digesting operation.

2696

      * @param session the session's handle

2697

      * @param part_ptr data to be digested

2698

      * @param part_len bytes of data to be digested

2699

      * @param return_value default value (`ThrowException`): throw exception on error.

2700

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2701

      * At least the following PKCS#11 return values may be returned:

2702

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

2703

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2704

      *     \li FunctionFailed \li GeneralError \li HostMemory

2705

      *     \li OK \li OperationNotInitialized \li SessionClosed

2706

      *     \li SessionHandleInvalid

2707

      * @return true on success, false otherwise

2708

*/

2709

      bool C_DigestUpdate(SessionHandle session,

2710

                          const Byte* part_ptr,

2711

                          Ulong part_len,

2712

                          ReturnValue* return_value = ThrowException) const;

2713

2714

/**

2715

      * C_DigestKey continues a multi-part message-digesting operation, by digesting the value of a secret key as part of the data already digested.

2716

      * @param session the session's handle

2717

      * @param key secret key to digest

2718

      * @param return_value default value (`ThrowException`): throw exception on error.

2719

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2720

      * At least the following PKCS#11 return values may be returned:

2721

      *     \li CryptokiNotInitialized \li DeviceError \li DeviceMemory

2722

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

2723

      *     \li GeneralError \li HostMemory \li KeyHandleInvalid

2724

      *     \li KeyIndigestible \li KeySizeRange \li OK

2725

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

2726

      * @return true on success, false otherwise

2727

*/

2728

      bool C_DigestKey(SessionHandle session, ObjectHandle key, ReturnValue* return_value = ThrowException) const;

2729

2730

/**

2731

      * C_DigestFinal finishes a multiple-part message-digesting operation.

2732

      * @param session the session's handle

2733

      * @param digest_ptr gets the message digest

2734

      * @param digest_len_ptr gets uint8_t count of digest

2735

      * @param return_value default value (`ThrowException`): throw exception on error.

2736

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2737

      * At least the following PKCS#11 return values may be returned:

2738

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2739

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2740

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

2741

      *     \li HostMemory \li OK \li OperationNotInitialized

2742

      *     \li SessionClosed \li SessionHandleInvalid

2743

      * @return true on success, false otherwise

2744

*/

2745

      bool C_DigestFinal(SessionHandle session,

2746

                         Byte* digest_ptr,

2747

                         Ulong* digest_len_ptr,

2748

                         ReturnValue* return_value = ThrowException) const;

2749

2750

      /****************************** Signing and MACing functions ******************************/

2751

2752

/**

2753

      * C_SignInit initializes a signature (private key encryption) operation, where the signature is (will be) an appendix to the data, and plaintext cannot be recovered from the signature.

2754

      * @param session the session's handle

2755

      * @param mechanism_ptr the signature mechanism

2756

      * @param key handle of signature key

2757

      * @param return_value default value (`ThrowException`): throw exception on error.

2758

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2759

      * At least the following PKCS#11 return values may be returned:

2760

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

2761

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2762

      *     \li FunctionFailed \li GeneralError \li HostMemory

2763

      *     \li KeyFunctionNotPermitted \li KeyHandleInvalid \li KeySizeRange

2764

      *     \li KeyTypeInconsistent \li MechanismInvalid \li MechanismParamInvalid

2765

      *     \li OK \li OperationActive \li PinExpired

2766

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

2767

      * @return true on success, false otherwise

2768

*/

2769

      bool C_SignInit(SessionHandle session,

2770

                      const Mechanism* mechanism_ptr,

2771

                      ObjectHandle key,

2772

                      ReturnValue* return_value = ThrowException) const;

2773

2774

/**

2775

      * C_Sign signs (encrypts with private key) data in a single part, where the signature is (will be) an appendix to the data, and plaintext cannot be recovered from the signature.

2776

      * @param session the session's handle

2777

      * @param data_ptr the data to sign

2778

      * @param data_len count of bytes to sign

2779

      * @param signature_ptr gets the signature

2780

      * @param signature_len_ptr gets signature length

2781

      * @param return_value default value (`ThrowException`): throw exception on error.

2782

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2783

      * At least the following PKCS#11 return values may be returned:

2784

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2785

      *     \li DataInvalid \li DataLenRange \li DeviceError

2786

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2787

      *     \li FunctionFailed \li GeneralError \li HostMemory

2788

      *     \li OK \li OperationNotInitialized \li SessionClosed

2789

      *     \li SessionHandleInvalid \li UserNotLoggedIn \li FunctionRejected

2790

      * @return true on success, false otherwise

2791

*/

2792

      bool C_Sign(SessionHandle session,

2793

                  const Byte* data_ptr,

2794

                  Ulong data_len,

2795

                  Byte* signature_ptr,

2796

                  Ulong* signature_len_ptr,

2797

                  ReturnValue* return_value = ThrowException) const;

2798

2799

/**

2800

      * C_Sign signs (encrypts with private key) data in a single part, where the signature is (will be) an appendix to the data, and plaintext cannot be recovered from the signature.

2801

      * @param session the session's handle

2802

      * @param data the data to sign

2803

      * @param signature gets the signature

2804

      * @param return_value default value (`ThrowException`): throw exception on error.

2805

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2806

      * At least the following PKCS#11 return values may be returned:

2807

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2808

      *     \li DataInvalid \li DataLenRange \li DeviceError

2809

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2810

      *     \li FunctionFailed \li GeneralError \li HostMemory

2811

      *     \li OK \li OperationNotInitialized \li SessionClosed

2812

      *     \li SessionHandleInvalid \li UserNotLoggedIn \li FunctionRejected

2813

      * @return true on success, false otherwise

2814

*/

2815

      template <typename TAllocA, typename TAllocB>

2817

                  const std::vector<uint8_t, TAllocA>& data,

2818

                  std::vector<uint8_t, TAllocB>& signature,

2819

                  ReturnValue* return_value = ThrowException) const {

2822

            return false;

2823

2824

2827

                    data.data(),

2829

                    signature.data(),

2830

                    &signature_size,

2831

                    return_value)) {

2832

            return false;

2833

2835

         return true;

2836

2837

2838

/**

2839

      * C_SignUpdate continues a multiple-part signature operation, where the signature is (will be) an appendix to the data, and plaintext cannot be recovered from the signature.

2840

      * @param session the session's handle

2841

      * @param part_ptr the data to sign

2842

      * @param part_len count of bytes to sign

2843

      * @param return_value default value (`ThrowException`): throw exception on error.

2844

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2845

      * At least the following PKCS#11 return values may be returned:

2846

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataLenRange

2847

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2848

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

2849

      *     \li HostMemory \li OK \li OperationNotInitialized

2850

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

2851

      * @return true on success, false otherwise

2852

*/

2853

      bool C_SignUpdate(SessionHandle session,

2854

                        const Byte* part_ptr,

2855

                        Ulong part_len,

2856

                        ReturnValue* return_value = ThrowException) const;

2857

2858

/**

2859

      * C_SignUpdate continues a multiple-part signature operation, where the signature is (will be) an appendix to the data, and plaintext cannot be recovered from the signature.

2860

      * @param session the session's handle

2861

      * @param part the data to sign

2862

      * @param return_value default value (`ThrowException`): throw exception on error.

2863

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2864

      * At least the following PKCS#11 return values may be returned:

2865

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataLenRange

2866

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

2867

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

2868

      *     \li HostMemory \li OK \li OperationNotInitialized

2869

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

2870

      * @return true on success, false otherwise

2871

*/

2872

      template <typename TAlloc>

2874

                        const std::vector<uint8_t, TAlloc>& part,

2875

                        ReturnValue* return_value = ThrowException) const {

2877

2878

2879

/**

2880

      * C_SignFinal finishes a multiple-part signature operation, returning the signature.

2881

      * @param session the session's handle

2882

      * @param signature_ptr gets the signature

2883

      * @param signature_len_ptr gets signature length

2884

      * @param return_value default value (`ThrowException`): throw exception on error.

2885

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2886

      * At least the following PKCS#11 return values may be returned:

2887

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2888

      *     \li DataLenRange \li DeviceError \li DeviceMemory

2889

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

2890

      *     \li GeneralError \li HostMemory \li OK

2891

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

2892

      *     \li UserNotLoggedIn \li FunctionRejected

2893

      * @return true on success, false otherwise

2894

*/

2895

      bool C_SignFinal(SessionHandle session,

2896

                       Byte* signature_ptr,

2897

                       Ulong* signature_len_ptr,

2898

                       ReturnValue* return_value = ThrowException) const;

2899

2900

/**

2901

      * C_SignFinal finishes a multiple-part signature operation, returning the signature.

2902

      * @param session the session's handle

2903

      * @param signature gets the signature

2904

      * @param return_value default value (`ThrowException`): throw exception on error.

2905

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2906

      * At least the following PKCS#11 return values may be returned:

2907

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2908

      *     \li DataLenRange \li DeviceError \li DeviceMemory

2909

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

2910

      *     \li GeneralError \li HostMemory \li OK

2911

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

2912

      *     \li UserNotLoggedIn \li FunctionRejected

2913

      * @return true on success, false otherwise

2914

*/

2915

      template <typename TAlloc>

2917

                       std::vector<uint8_t, TAlloc>& signature,

2918

                       ReturnValue* return_value = ThrowException) const {

2921

            return false;

2922

2923

2926

            return false;

2927

2929

         return true;

2930

2931

2932

/**

2933

      * C_SignRecoverInit initializes a signature operation, where the data can be recovered from the signature.

2934

      * @param session the session's handle

2935

      * @param mechanism_ptr the signature mechanism

2936

      * @param key handle of the signature key

2937

      * @param return_value default value (`ThrowException`): throw exception on error.

2938

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2939

      * At least the following PKCS#11 return values may be returned:

2940

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

2941

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2942

      *     \li FunctionFailed \li GeneralError \li HostMemory

2943

      *     \li KeyFunctionNotPermitted \li KeyHandleInvalid \li KeySizeRange

2944

      *     \li KeyTypeInconsistent \li MechanismInvalid \li MechanismParamInvalid

2945

      *     \li OK \li OperationActive \li PinExpired

2946

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

2947

      * @return true on success, false otherwise

2948

*/

2949

      bool C_SignRecoverInit(SessionHandle session,

2950

                             const Mechanism* mechanism_ptr,

2951

                             ObjectHandle key,

2952

                             ReturnValue* return_value = ThrowException) const;

2953

2954

/**

2955

      * C_SignRecover signs data in a single operation, where the data can be recovered from the signature.

2956

      * @param session the session's handle

2957

      * @param data_ptr the data to sign

2958

      * @param data_len count of bytes to sign

2959

      * @param signature_ptr gets the signature

2960

      * @param signature_len_ptr gets signature length

2961

      * @param return_value default value (`ThrowException`): throw exception on error.

2962

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

2963

      * At least the following PKCS#11 return values may be returned:

2964

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

2965

      *     \li DataInvalid \li DataLenRange \li DeviceError

2966

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

2967

      *     \li FunctionFailed \li GeneralError \li HostMemory

2968

      *     \li OK \li OperationNotInitialized \li SessionClosed

2969

      *     \li SessionHandleInvalid \li UserNotLoggedIn

2970

      * @return true on success, false otherwise

2971

*/

2972

      bool C_SignRecover(SessionHandle session,

2973

                         const Byte* data_ptr,

2974

                         Ulong data_len,

2975

                         Byte* signature_ptr,

2976

                         Ulong* signature_len_ptr,

2977

                         ReturnValue* return_value = ThrowException) const;

2978

2979

      /******************* Message-based signing and MACing functions *******************/

2980

2981

/**

2982

       * C_MessageSignInit initializes a message-based signature process, preparing a

2983

       * session for one or more signature operations (where the signature is an

2984

       * appendix to the data) that use the same signature mechanism and

2985

       * signature key.

2986

2987

       * @param session the session's handle

2988

       * @param mechanism_ptr the signing mechanism

2989

       * @param key handle of signing key

2990

       * @param return_value default value (`ThrowException`): throw exception on error

2991

       * @return true on success, false otherwise

2992

*/

2993

      bool C_MessageSignInit(SessionHandle session,

2994

                             const Mechanism* mechanism_ptr,

2995

                             ObjectHandle key,

2996

                             ReturnValue* return_value = ThrowException);

2997

2998

/**

2999

       * C_SignMessage signs a message in a single part, where the signature is an

3000

       * appendix to the message. C_MessageSignInit must previously been called

3001

       * on the session.

3002

3003

       * @param session the session's handle

3004

       * @param parameter_ptr message specific parameter

3005

       * @param parameter_len length of message specific parameter

3006

       * @param data_ptr data to sign

3007

       * @param data_len data to sign length

3008

       * @param signature_ptr gets signature

3009

       * @param signature_len_ptr gets signature length

3010

       * @param return_value default value (`ThrowException`): throw exception on error

3011

       * @return true on success, false otherwise

3012

*/

3013

      bool C_SignMessage(SessionHandle session,

3014

                         const void* parameter_ptr,

3015

                         Ulong parameter_len,

3016

                         const Byte* data_ptr,

3017

                         Ulong data_len,

3018

                         Byte* signature_ptr,

3019

                         Ulong* signature_len_ptr,

3020

                         ReturnValue* return_value = ThrowException);

3021

3022

/**

3023

       * C_SignMessageBegin begins a multiple-part message signature operation, where

3024

       * the signature is an appendix to the message. C_MessageSignInit must

3025

       * previously been called on the session.

3026

3027

       * @param session the session's handle

3028

       * @param parameter_ptr message specific parameter

3029

       * @param parameter_len length of message specific parameter

3030

       * @param return_value default value (`ThrowException`): throw exception on error

3031

       * @return true on success, false otherwise

3032

*/

3033

      bool C_SignMessageBegin(SessionHandle session,

3034

                              const void* parameter_ptr,

3035

                              Ulong parameter_len,

3036

                              ReturnValue* return_value = ThrowException);

3037

3038

/**

3039

       * C_SignMessageNext continues a multiple-part message signature operation,

3040

       * processing another data part, or finishes a multiple-part message

3041

       * signature operation, returning the signature.

3042

3043

       * @param session the session's handle

3044

       * @param parameter_ptr message specific parameter

3045

       * @param parameter_len length of message specific parameter

3046

       * @param data_ptr data to sign

3047

       * @param data_len data to sign length

3048

       * @param signature_ptr gets signature

3049

       * @param signature_len_ptr gets signature length

3050

       * @param return_value default value (`ThrowException`): throw exception on error

3051

       * @return true on success, false otherwise

3052

*/

3053

      bool C_SignMessageNext(SessionHandle session,

3054

                             const void* parameter_ptr,

3055

                             Ulong parameter_len,

3056

                             const Byte* data_ptr,

3057

                             Ulong data_len,

3058

                             Byte* signature_ptr,

3059

                             Ulong* signature_len_ptr,

3060

                             ReturnValue* return_value = ThrowException);

3061

3062

/**

3063

       * C_MessageSignFinal finishes a message-based signing process.

3064

3065

       * @param session the session's handle

3066

       * @param return_value default value (`ThrowException`): throw exception on error

3067

       * @return true on success, false otherwise

3068

*/

3069

      bool C_MessageSignFinal(SessionHandle session, ReturnValue* return_value = ThrowException);

3070

3071

      /****************************** Functions for verifying signatures and MACs ******************************/

3072

3073

/**

3074

      * C_VerifyInit initializes a verification operation, where the signature is an appendix to the data, and plaintext cannot be recovered from the signature (e.g. DSA).

3075

      * @param session the session's handle

3076

      * @param mechanism_ptr the verification mechanism

3077

      * @param key verification key

3078

      * @param return_value default value (`ThrowException`): throw exception on error.

3079

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3080

      * At least the following PKCS#11 return values may be returned:

3081

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

3082

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

3083

      *     \li FunctionFailed \li GeneralError \li HostMemory

3084

      *     \li KeyFunctionNotPermitted \li KeyHandleInvalid \li KeySizeRange

3085

      *     \li KeyTypeInconsistent \li MechanismInvalid \li MechanismParamInvalid

3086

      *     \li OK \li OperationActive \li PinExpired

3087

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

3088

      * @return true on success, false otherwise

3089

*/

3090

      bool C_VerifyInit(SessionHandle session,

3091

                        const Mechanism* mechanism_ptr,

3092

                        ObjectHandle key,

3093

                        ReturnValue* return_value = ThrowException) const;

3094

3095

/**

3096

      * C_Verify verifies a signature in a single-part operation, where the signature is an appendix to the data, and plaintext cannot be recovered from the signature.

3097

      * @param session the session's handle

3098

      * @param data_ptr signed data

3099

      * @param data_len length of signed data

3100

      * @param signature_ptr signature

3101

      * @param signature_len signature length

3102

      * @param return_value default value (`ThrowException`): throw exception on error.

3103

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3104

      * At least the following PKCS#11 return values may be returned:

3105

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataInvalid

3106

      *     \li DataLenRange \li DeviceError \li DeviceMemory

3107

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

3108

      *     \li GeneralError \li HostMemory \li OK

3109

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

3110

      *     \li SignatureInvalid \li SignatureLenRange

3111

      * @return true on success, false otherwise

3112

*/

3113

      bool C_Verify(SessionHandle session,

3114

                    const Byte* data_ptr,

3115

                    Ulong data_len,

3116

                    const Byte* signature_ptr,

3117

                    Ulong signature_len,

3118

                    ReturnValue* return_value = ThrowException) const;

3119

3120

/**

3121

      * C_Verify verifies a signature in a single-part operation, where the signature is an appendix to the data, and plaintext cannot be recovered from the signature.

3122

      * @param session the session's handle

3123

      * @param data signed data

3124

      * @param signature signature

3125

      * @param return_value default value (`ThrowException`): throw exception on error.

3126

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3127

      * At least the following PKCS#11 return values may be returned:

3128

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataInvalid

3129

      *     \li DataLenRange \li DeviceError \li DeviceMemory

3130

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

3131

      *     \li GeneralError \li HostMemory \li OK

3132

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

3133

      *     \li SignatureInvalid \li SignatureLenRange

3134

      * @return true on success, false otherwise

3135

*/

3136

      template <typename TAllocA, typename TAllocB>

3137

      bool C_Verify(SessionHandle session,

3138

                    const std::vector<uint8_t, TAllocA>& data,

3139

                    std::vector<uint8_t, TAllocB>& signature,

3140

                    ReturnValue* return_value = ThrowException) const {

3141

         return C_Verify(session,

3142

                         data.data(),

3143

                         static_cast<Ulong>(data.size()),

3144

                         signature.data(),

3145

                         static_cast<Ulong>(signature.size()),

3146

                         return_value);

3147

3148

3149

/**

3150

      * C_VerifyUpdate continues a multiple-part verification operation, where the signature is an appendix to the data, and plaintext cannot be recovered from the signature.

3151

      * @param session the session's handle

3152

      * @param part_ptr signed data

3153

      * @param part_len length of signed data

3154

      * @param return_value default value (`ThrowException`): throw exception on error.

3155

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3156

      * At least the following PKCS#11 return values may be returned:

3157

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataLenRange

3158

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3159

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

3160

      *     \li HostMemory \li OK \li OperationNotInitialized

3161

      *     \li SessionClosed \li SessionHandleInvalid

3162

      * @return true on success, false otherwise

3163

*/

3164

      bool C_VerifyUpdate(SessionHandle session,

3165

                          const Byte* part_ptr,

3166

                          Ulong part_len,

3167

                          ReturnValue* return_value = ThrowException) const;

3168

3169

/**

3170

      * C_VerifyUpdate continues a multiple-part verification operation, where the signature is an appendix to the data, and plaintext cannot be recovered from the signature.

3171

      * @param session the session's handle

3172

      * @param part signed data

3173

      * @param return_value default value (`ThrowException`): throw exception on error.

3174

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3175

      * At least the following PKCS#11 return values may be returned:

3176

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataLenRange

3177

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3178

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

3179

      *     \li HostMemory \li OK \li OperationNotInitialized

3180

      *     \li SessionClosed \li SessionHandleInvalid

3181

      * @return true on success, false otherwise

3182

*/

3183

      template <typename TAlloc>

3185

                          std::vector<uint8_t, TAlloc> part,

3186

                          ReturnValue* return_value = ThrowException) const {

3188

3189

3190

/**

3191

      * C_VerifyFinal finishes a multiple-part verification operation, checking the signature.

3192

      * @param session the session's handle

3193

      * @param signature_ptr signature to verify

3194

      * @param signature_len signature length

3195

      * @param return_value default value (`ThrowException`): throw exception on error.

3196

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3197

      * At least the following PKCS#11 return values may be returned:

3198

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DataLenRange

3199

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3200

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

3201

      *     \li HostMemory \li OK \li OperationNotInitialized

3202

      *     \li SessionClosed \li SessionHandleInvalid \li SignatureInvalid

3203

      *     \li SignatureLenRange

3204

      * @return true on success, false otherwise

3205

*/

3206

      bool C_VerifyFinal(SessionHandle session,

3207

                         const Byte* signature_ptr,

3208

                         Ulong signature_len,

3209

                         ReturnValue* return_value = ThrowException) const;

3210

3211

/**

3212

      * C_VerifyRecoverInit initializes a signature verification operation, where the data is recovered from the signature.

3213

      * @param session the session's handle

3214

      * @param mechanism_ptr the verification mechanism

3215

      * @param key verification key

3216

      * @param return_value default value (`ThrowException`): throw exception on error.

3217

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3218

      * At least the following PKCS#11 return values may be returned:

3219

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

3220

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

3221

      *     \li FunctionFailed \li GeneralError \li HostMemory

3222

      *     \li KeyFunctionNotPermitted \li KeyHandleInvalid \li KeySizeRange

3223

      *     \li KeyTypeInconsistent \li MechanismInvalid \li MechanismParamInvalid

3224

      *     \li OK \li OperationActive \li PinExpired

3225

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

3226

      * @return true on success, false otherwise

3227

*/

3228

      bool C_VerifyRecoverInit(SessionHandle session,

3229

                               const Mechanism* mechanism_ptr,

3230

                               ObjectHandle key,

3231

                               ReturnValue* return_value = ThrowException) const;

3232

3233

/**

3234

      * C_VerifyRecover verifies a signature in a single-part operation, where the data is recovered from the signature.

3235

      * @param session the session's handle

3236

      * @param signature_ptr signature to verify

3237

      * @param signature_len signature length

3238

      * @param data_ptr gets signed data

3239

      * @param data_len_ptr gets signed data len

3240

      * @param return_value default value (`ThrowException`): throw exception on error.

3241

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3242

      * At least the following PKCS#11 return values may be returned:

3243

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

3244

      *     \li DataInvalid \li DataLenRange \li DeviceError

3245

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

3246

      *     \li FunctionFailed \li GeneralError \li HostMemory

3247

      *     \li OK \li OperationNotInitialized \li SessionClosed

3248

      *     \li SessionHandleInvalid \li SignatureLenRange \li SignatureInvalid

3249

      * @return true on success, false otherwise

3250

*/

3251

      bool C_VerifyRecover(SessionHandle session,

3252

                           const Byte* signature_ptr,

3253

                           Ulong signature_len,

3254

                           Byte* data_ptr,

3255

                           Ulong* data_len_ptr,

3256

                           ReturnValue* return_value = ThrowException) const;

3257

3258

/**

3259

       * C_VerifySignatureInit initializes a verification operation, where the

3260

       * signature is included as part of the initialization.

3261

3262

       * @param session the session's handle

3263

       * @param mechanism_ptr the verification mechanism

3264

       * @param key verification key

3265

       * @param signature_ptr signature

3266

       * @param signature_len signature length

3267

       * @param return_value default value (`ThrowException`): throw exception on error

3268

       * @return true on success, false otherwise

3269

*/

3270

      bool C_VerifySignatureInit(SessionHandle session,

3271

                                 const Mechanism* mechanism_ptr,

3272

                                 ObjectHandle key,

3273

                                 const Byte* signature_ptr,

3274

                                 Ulong signature_len,

3275

                                 ReturnValue* return_value = ThrowException);

3276

3277

/**

3278

       * C_VerifySignature verifies a signature in a single-part operation, where the

3279

       * signature is an appendix to the data.

3280

3281

       * @param session the session's handle

3282

       * @param data_ptr signed data

3283

       * @param data_len length of signed data

3284

       * @param return_value default value (`ThrowException`): throw exception on error

3285

       * @return true on success, false otherwise

3286

*/

3287

      bool C_VerifySignature(SessionHandle session,

3288

                             const Byte* data_ptr,

3289

                             Ulong data_len,

3290

                             ReturnValue* return_value = ThrowException);

3291

3292

/**

3293

       * C_VerifySignatureUpdate continues a multiple-part verification operation,

3294

       * processing another data part.

3295

3296

       * @param session the session's handle

3297

       * @param part_ptr signed data

3298

       * @param part_len length of signed data

3299

       * @param return_value default value (`ThrowException`): throw exception on error

3300

       * @return true on success, false otherwise

3301

*/

3302

      bool C_VerifySignatureUpdate(SessionHandle session,

3303

                                   const Byte* part_ptr,

3304

                                   Ulong part_len,

3305

                                   ReturnValue* return_value = ThrowException);

3306

3307

/**

3308

       * C_VerifySignatureFinal finishes a multiple-part verification operation,

3309

       * checking the signature.

3310

3311

       * @param session the session's handle

3312

       * @param return_value default value (`ThrowException`): throw exception on error

3313

       * @return true on success, false otherwise

3314

*/

3315

      bool C_VerifySignatureFinal(SessionHandle session, ReturnValue* return_value = ThrowException);

3316

3317

      /*********** Message-based functions for verifying signatures and MACs ************/

3318

3319

/**

3320

       * C_MessageVerifyInit initializes a message-based verification process,

3321

       * preparing a session for one or more verification operations (where the

3322

       * signature is an appendix to the data) that use the same verification

3323

       * mechanism and verification key.

3324

3325

       * @param session the session's handle

3326

       * @param mechanism_ptr the signing mechanism

3327

       * @param key handle of signing key

3328

       * @param return_value default value (`ThrowException`): throw exception on error

3329

       * @return true on success, false otherwise

3330

*/

3331

      bool C_MessageVerifyInit(SessionHandle session,

3332

                               const Mechanism* mechanism_ptr,

3333

                               ObjectHandle key,

3334

                               ReturnValue* return_value = ThrowException);

3335

3336

/**

3337

       * C_VerifyMessage verifies a signature on a message in a single part operation,

3338

       * where the signature is an appendix to the data. C_MessageVerifyInit must

3339

       * previously been called on the session.

3340

3341

       * @param session the session's handle

3342

       * @param parameter_ptr message specific parameter

3343

       * @param parameter_len length of message specific parameter

3344

       * @param data_ptr data to sign

3345

       * @param data_len data to sign length

3346

       * @param signature_ptr signature

3347

       * @param signature_len signature length

3348

       * @param return_value default value (`ThrowException`): throw exception on error

3349

       * @return true on success, false otherwise

3350

*/

3351

      bool C_VerifyMessage(SessionHandle session,

3352

                           const void* parameter_ptr,

3353

                           Ulong parameter_len,

3354

                           const Byte* data_ptr,

3355

                           Ulong data_len,

3356

                           const Byte* signature_ptr,

3357

                           Ulong signature_len,

3358

                           ReturnValue* return_value = ThrowException);

3359

3360

/**

3361

       * C_VerifyMessageBegin begins a multiple-part message verification operation,

3362

       * where the signature is an appendix to the message. C_MessageVerifyInit

3363

       * must previously been called on the session.

3364

3365

       * @param session the session's handle

3366

       * @param parameter_ptr message specific parameter

3367

       * @param parameter_len length of message specific parameter

3368

       * @param return_value default value (`ThrowException`): throw exception on error

3369

       * @return true on success, false otherwise

3370

*/

3371

      bool C_VerifyMessageBegin(SessionHandle session,

3372

                                const void* parameter_ptr,

3373

                                Ulong parameter_len,

3374

                                ReturnValue* return_value = ThrowException);

3375

3376

/**

3377

       * C_VerifyMessageNext continues a multiple-part message verification operation,

3378

       * processing another data part, or finishes a multiple-part message

3379

       * verification operation, checking the signature.

3380

3381

       * @param session the session's handle

3382

       * @param parameter_ptr message specific parameter

3383

       * @param parameter_len length of message specific parameter

3384

       * @param data_ptr data to sign

3385

       * @param data_len data to sign length

3386

       * @param signature_ptr signature

3387

       * @param signature_len signature length

3388

       * @param return_value default value (`ThrowException`): throw exception on error

3389

       * @return true on success, false otherwise

3390

*/

3391

      bool C_VerifyMessageNext(SessionHandle session,

3392

                               const void* parameter_ptr,

3393

                               Ulong parameter_len,

3394

                               const Byte* data_ptr,

3395

                               Ulong data_len,

3396

                               const Byte* signature_ptr,

3397

                               Ulong signature_len,

3398

                               ReturnValue* return_value = ThrowException);

3399

3400

/**

3401

       * C_MessageVerifyFinal finishes a message-based verification process.

3402

3403

       * @param session the session's handle

3404

       * @param return_value default value (`ThrowException`): throw exception on error

3405

       * @return true on success, false otherwise

3406

*/

3407

      bool C_MessageVerifyFinal(SessionHandle session, ReturnValue* return_value = ThrowException);

3408

3409

      /****************************** Dual-purpose cryptographic functions ******************************/

3410

3411

/**

3412

      * C_DigestEncryptUpdate continues a multiple-part digesting and encryption operation.

3413

      * @param session session's handle

3414

      * @param part_ptr the plaintext data

3415

      * @param part_len plaintext length

3416

      * @param encrypted_part_ptr gets ciphertext

3417

      * @param encrypted_part_len_ptr gets c-text length

3418

      * @param return_value default value (`ThrowException`): throw exception on error.

3419

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3420

      * At least the following PKCS#11 return values may be returned:

3421

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

3422

      *     \li DataLenRange \li DeviceError \li DeviceMemory

3423

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

3424

      *     \li GeneralError \li HostMemory \li OK

3425

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

3426

      * @return true on success, false otherwise

3427

*/

3428

      bool C_DigestEncryptUpdate(SessionHandle session,

3429

                                 const Byte* part_ptr,

3430

                                 Ulong part_len,

3431

                                 Byte* encrypted_part_ptr,

3432

                                 Ulong* encrypted_part_len_ptr,

3433

                                 ReturnValue* return_value = ThrowException) const;

3434

3435

/**

3436

      * C_DecryptDigestUpdate continues a multiple-part decryption and digesting operation.

3437

      * @param session session's handle

3438

      * @param encrypted_part_ptr ciphertext

3439

      * @param encrypted_part_len ciphertext length

3440

      * @param part_ptr gets plaintext

3441

      * @param part_len_ptr gets plaintext len

3442

      * @param return_value default value (`ThrowException`): throw exception on error.

3443

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3444

      * At least the following PKCS#11 return values may be returned:

3445

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

3446

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3447

      *     \li EncryptedDataInvalid \li EncryptedDataLenRange \li FunctionCanceled

3448

      *     \li FunctionFailed \li GeneralError \li HostMemory

3449

      *     \li OK \li OperationNotInitialized \li SessionClosed

3450

      *     \li SessionHandleInvalid

3451

      * @return true on success, false otherwise

3452

*/

3453

      bool C_DecryptDigestUpdate(SessionHandle session,

3454

                                 const Byte* encrypted_part_ptr,

3455

                                 Ulong encrypted_part_len,

3456

                                 Byte* part_ptr,

3457

                                 Ulong* part_len_ptr,

3458

                                 ReturnValue* return_value = ThrowException) const;

3459

3460

/**

3461

      * C_SignEncryptUpdate continues a multiple-part signing and encryption operation.

3462

      * @param session session's handle

3463

      * @param part_ptr the plaintext data

3464

      * @param part_len plaintext length

3465

      * @param encrypted_part_ptr gets ciphertext

3466

      * @param encrypted_part_len_ptr gets c-text length

3467

      * @param return_value default value (`ThrowException`): throw exception on error.

3468

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3469

      * At least the following PKCS#11 return values may be returned:

3470

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

3471

      *     \li DataLenRange \li DeviceError \li DeviceMemory

3472

      *     \li DeviceRemoved \li FunctionCanceled \li FunctionFailed

3473

      *     \li GeneralError \li HostMemory \li OK

3474

      *     \li OperationNotInitialized \li SessionClosed \li SessionHandleInvalid

3475

      *     \li UserNotLoggedIn

3476

      * @return true on success, false otherwise

3477

*/

3478

      bool C_SignEncryptUpdate(SessionHandle session,

3479

                               const Byte* part_ptr,

3480

                               Ulong part_len,

3481

                               Byte* encrypted_part_ptr,

3482

                               Ulong* encrypted_part_len_ptr,

3483

                               ReturnValue* return_value = ThrowException) const;

3484

3485

/**

3486

      * C_DecryptVerifyUpdate continues a multiple-part decryption and verify operation.

3487

      * @param session session's handle

3488

      * @param encrypted_part_ptr ciphertext

3489

      * @param encrypted_part_len ciphertext length

3490

      * @param part_ptr gets plaintext

3491

      * @param part_len_ptr gets p-text length

3492

      * @param return_value default value (`ThrowException`): throw exception on error.

3493

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3494

      * At least the following PKCS#11 return values may be returned:

3495

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

3496

      *     \li DataLenRange \li DeviceError \li DeviceMemory

3497

      *     \li DeviceRemoved \li EncryptedDataInvalid \li EncryptedDataLenRange

3498

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

3499

      *     \li HostMemory \li OK \li OperationNotInitialized

3500

      *     \li SessionClosed \li SessionHandleInvalid

3501

      * @return true on success, false otherwise

3502

*/

3503

      bool C_DecryptVerifyUpdate(SessionHandle session,

3504

                                 const Byte* encrypted_part_ptr,

3505

                                 Ulong encrypted_part_len,

3506

                                 Byte* part_ptr,

3507

                                 Ulong* part_len_ptr,

3508

                                 ReturnValue* return_value = ThrowException) const;

3509

3510

      /****************************** Key management functions ******************************/

3511

3512

/**

3513

      * C_GenerateKey generates a secret key, creating a new key object.

3514

      * @param session the session's handle

3515

      * @param mechanism_ptr key generation mech.

3516

      * @param attribute_template_ptr template for new key

3517

      * @param count # of attrs in template

3518

      * @param key_ptr gets handle of new key

3519

      * @param return_value default value (`ThrowException`): throw exception on error.

3520

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3521

      * At least the following PKCS#11 return values may be returned:

3522

      *     \li ArgumentsBad \li AttributeReadOnly \li AttributeTypeInvalid

3523

      *     \li AttributeValueInvalid \li CryptokiNotInitialized \li CurveNotSupported

3524

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3525

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

3526

      *     \li HostMemory \li MechanismInvalid \li MechanismParamInvalid

3527

      *     \li OK \li OperationActive \li PinExpired

3528

      *     \li SessionClosed \li SessionHandleInvalid \li SessionReadOnly

3529

      *     \li TemplateIncomplete \li TemplateInconsistent \li TokenWriteProtected

3530

      *     \li UserNotLoggedIn

3531

      * @return true on success, false otherwise

3532

*/

3533

      bool C_GenerateKey(SessionHandle session,

3534

                         const Mechanism* mechanism_ptr,

3535

                         Attribute* attribute_template_ptr,

3536

                         Ulong count,

3537

                         ObjectHandle* key_ptr,

3538

                         ReturnValue* return_value = ThrowException) const;

3539

3540

/**

3541

      * C_GenerateKeyPair generates a public-key/private-key pair, creating new key objects.

3542

      * @param session session handle

3543

      * @param mechanism_ptr key-gen mech.

3544

      * @param public_key_template_ptr template for pub. key

3545

      * @param public_key_attribute_count # pub. attrs.

3546

      * @param private_key_template_ptr template for priv. key

3547

      * @param private_key_attribute_count # priv.  attrs.

3548

      * @param public_key_ptr gets pub. key handle

3549

      * @param private_key_ptr gets priv. key handle

3550

      * @param return_value default value (`ThrowException`): throw exception on error.

3551

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3552

      * At least the following PKCS#11 return values may be returned:

3553

      *     \li ArgumentsBad \li AttributeReadOnly \li AttributeTypeInvalid

3554

      *     \li AttributeValueInvalid \li CryptokiNotInitialized \li CurveNotSupported

3555

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3556

      *     \li DomainParamsInvalid \li FunctionCanceled \li FunctionFailed

3557

      *     \li GeneralError \li HostMemory \li MechanismInvalid

3558

      *     \li MechanismParamInvalid \li OK \li OperationActive

3559

      *     \li PinExpired \li SessionClosed \li SessionHandleInvalid

3560

      *     \li SessionReadOnly \li TemplateIncomplete \li TemplateInconsistent

3561

      *     \li TokenWriteProtected \li UserNotLoggedIn

3562

      * @return true on success, false otherwise

3563

*/

3564

      bool C_GenerateKeyPair(SessionHandle session,

3565

                             const Mechanism* mechanism_ptr,

3566

                             Attribute* public_key_template_ptr,

3567

                             Ulong public_key_attribute_count,

3568

                             Attribute* private_key_template_ptr,

3569

                             Ulong private_key_attribute_count,

3570

                             ObjectHandle* public_key_ptr,

3571

                             ObjectHandle* private_key_ptr,

3572

                             ReturnValue* return_value = ThrowException) const;

3573

3574

/**

3575

      * C_WrapKey wraps (i.e., encrypts) a key.

3576

      * @param session the session's handle

3577

      * @param mechanism_ptr the wrapping mechanism

3578

      * @param wrapping_key wrapping key

3579

      * @param key key to be wrapped

3580

      * @param wrapped_key_ptr gets wrapped key

3581

      * @param wrapped_key_len_ptr gets wrapped key size

3582

      * @param return_value default value (`ThrowException`): throw exception on error.

3583

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3584

      * At least the following PKCS#11 return values may be returned:

3585

      *     \li ArgumentsBad \li BufferTooSmall \li CryptokiNotInitialized

3586

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3587

      *     \li FunctionCanceled \li FunctionFailed \li GeneralError

3588

      *     \li HostMemory \li KeyHandleInvalid \li KeyNotWrappable

3589

      *     \li KeySizeRange \li KeyUnextractable \li MechanismInvalid

3590

      *     \li MechanismParamInvalid \li OK \li OperationActive

3591

      *     \li PinExpired \li SessionClosed \li SessionHandleInvalid

3592

      *     \li UserNotLoggedIn \li WrappingKeyHandleInvalid \li WrappingKeySizeRange

3593

      *     \li WrappingKeyTypeInconsistent

3594

      * @return true on success, false otherwise

3595

*/

3596

      bool C_WrapKey(SessionHandle session,

3597

                     const Mechanism* mechanism_ptr,

3598

                     ObjectHandle wrapping_key,

3599

                     ObjectHandle key,

3600

                     Byte* wrapped_key_ptr,

3601

                     Ulong* wrapped_key_len_ptr,

3602

                     ReturnValue* return_value = ThrowException) const;

3603

3604

/**

3605

      * C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new key object.

3606

      * @param session session's handle

3607

      * @param mechanism_ptr unwrapping mech.

3608

      * @param unwrapping_key unwrapping key

3609

      * @param wrapped_key_ptr the wrapped key

3610

      * @param wrapped_key_len wrapped key len

3611

      * @param attribute_template_ptr new key template

3612

      * @param attribute_count template length

3613

      * @param key_ptr gets new handle

3614

      * @param return_value default value (`ThrowException`): throw exception on error.

3615

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3616

      * At least the following PKCS#11 return values may be returned:

3617

      *     \li ArgumentsBad \li AttributeReadOnly \li AttributeTypeInvalid

3618

      *     \li AttributeValueInvalid \li BufferTooSmall \li CryptokiNotInitialized

3619

      *     \li CurveNotSupported \li DeviceError \li DeviceMemory

3620

      *     \li DeviceRemoved \li DomainParamsInvalid \li FunctionCanceled

3621

      *     \li FunctionFailed \li GeneralError \li HostMemory

3622

      *     \li MechanismInvalid \li MechanismParamInvalid \li OK

3623

      *     \li OperationActive \li PinExpired \li SessionClosed

3624

      *     \li SessionHandleInvalid \li SessionReadOnly \li TemplateIncomplete

3625

      *     \li TemplateInconsistent \li TokenWriteProtected \li UnwrappingKeyHandleInvalid

3626

      *     \li UnwrappingKeySizeRange \li UnwrappingKeyTypeInconsistent \li UserNotLoggedIn

3627

      *     \li WrappedKeyInvalid \li WrappedKeyLenRange

3628

      * @return true on success, false otherwise

3629

*/

3630

      bool C_UnwrapKey(SessionHandle session,

3631

                       const Mechanism* mechanism_ptr,

3632

                       ObjectHandle unwrapping_key,

3633

                       const Byte* wrapped_key_ptr,

3634

                       Ulong wrapped_key_len,

3635

                       Attribute* attribute_template_ptr,

3636

                       Ulong attribute_count,

3637

                       ObjectHandle* key_ptr,

3638

                       ReturnValue* return_value = ThrowException) const;

3639

3640

/**

3641

      * C_DeriveKey derives a key from a base key, creating a new key object.

3642

      * @param session session's handle

3643

      * @param mechanism_ptr key deriv. mech.

3644

      * @param base_key base key

3645

      * @param attribute_template_ptr new key template

3646

      * @param attribute_count template length

3647

      * @param key_ptr gets new handle

3648

      * @param return_value default value (`ThrowException`): throw exception on error.

3649

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3650

      * At least the following PKCS#11 return values may be returned:

3651

      *     \li ArgumentsBad \li AttributeReadOnly \li AttributeTypeInvalid

3652

      *     \li AttributeValueInvalid \li CryptokiNotInitialized \li CurveNotSupported

3653

      *     \li DeviceError \li DeviceMemory \li DeviceRemoved

3654

      *     \li DomainParamsInvalid \li FunctionCanceled \li FunctionFailed

3655

      *     \li GeneralError \li HostMemory \li KeyHandleInvalid

3656

      *     \li KeySizeRange \li KeyTypeInconsistent \li MechanismInvalid

3657

      *     \li MechanismParamInvalid \li OK \li OperationActive

3658

      *     \li PinExpired \li SessionClosed \li SessionHandleInvalid

3659

      *     \li SessionReadOnly \li TemplateIncomplete \li TemplateInconsistent

3660

      *     \li TokenWriteProtected \li UserNotLoggedIn

3661

      * @return true on success, false otherwise

3662

*/

3663

      bool C_DeriveKey(SessionHandle session,

3664

                       const Mechanism* mechanism_ptr,

3665

                       ObjectHandle base_key,

3666

                       Attribute* attribute_template_ptr,

3667

                       Ulong attribute_count,

3668

                       ObjectHandle* key_ptr,

3669

                       ReturnValue* return_value = ThrowException) const;

3670

3671

/**

3672

       * C_EncapulateKey creates a new secret key object from a public key using a

3673

       * KEM.

3674

3675

       * @param session the session's handle

3676

       * @param mechanism_ptr the encapsulation mechanism

3677

       * @param public_key the encapsulating key

3678

       * @param template_ptr new key template

3679

       * @param attribute_count template length

3680

       * @param key_ptr the encapsulated key

3681

       * @param ciphertext_ptr the wrapped key

3682

       * @param ciphertext_len_ptr the wrapped key size

3683

       * @param return_value default value (`ThrowException`): throw exception on error

3684

       * @return true on success, false otherwise

3685

*/

3686

      bool C_EncapsulateKey(SessionHandle session,

3687

                            const Mechanism* mechanism_ptr,

3688

                            ObjectHandle public_key,

3689

                            Attribute* template_ptr,

3690

                            Ulong attribute_count,

3691

                            ObjectHandle* key_ptr,

3692

                            Byte* ciphertext_ptr,

3693

                            Ulong* ciphertext_len_ptr,

3694

                            ReturnValue* return_value = ThrowException);

3695

3696

/**

3697

       * C_DecapsulateKey creates a new secret key object based on the private key and

3698

       * ciphertext generated by a prior encapsulate operation. This new key

3699

       * (called a ‘shared key’ in most KEM documentation) is identical to the

3700

       * key returned by C_EncapsulateKey when it was called with the matching public

3701

       * key and returned the same cipher text. This function is a KEM style

3702

       * function.

3703

3704

       * @param session the session's handle

3705

       * @param mechanism_ptr the decapsulation mechanism

3706

       * @param private_key the decapsulating key

3707

       * @param ciphertext_ptr the wrapped key

3708

       * @param ciphertext_len the wrapped key size

3709

       * @param template_ptr new key template

3710

       * @param attribute_count template length

3711

       * @param key_ptr the decapsulated key

3712

       * @param return_value default value (`ThrowException`): throw exception on error

3713

       * @return true on success, false otherwise

3714

*/

3715

      bool C_DecapsulateKey(SessionHandle session,

3716

                            const Mechanism* mechanism_ptr,

3717

                            ObjectHandle private_key,

3718

                            const Byte* ciphertext_ptr,

3719

                            Ulong ciphertext_len,

3720

                            Attribute* template_ptr,

3721

                            Ulong attribute_count,

3722

                            ObjectHandle* key_ptr,

3723

                            ReturnValue* return_value = ThrowException);

3724

3725

      /****************************** Random number generation functions ******************************/

3726

3727

/**

3728

      * C_SeedRandom mixes additional seed material into the token's random number generator.

3729

      * @param session the session's handle

3730

      * @param seed_ptr the seed material

3731

      * @param seed_len length of seed material

3732

      * @param return_value default value (`ThrowException`): throw exception on error.

3733

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3734

      * At least the following PKCS#11 return values may be returned:

3735

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

3736

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

3737

      *     \li FunctionFailed \li GeneralError \li HostMemory

3738

      *     \li OK \li OperationActive \li RandomSeedNotSupported

3739

      *     \li RandomNoRng \li SessionClosed \li SessionHandleInvalid

3740

      *     \li UserNotLoggedIn

3741

      * @return true on success, false otherwise

3742

*/

3743

      bool C_SeedRandom(SessionHandle session,

3744

                        const Byte* seed_ptr,

3745

                        Ulong seed_len,

3746

                        ReturnValue* return_value = ThrowException) const;

3747

3748

/**

3749

      * C_GenerateRandom generates random data.

3750

      * @param session the session's handle

3751

      * @param random_data_ptr receives the random data

3752

      * @param random_len # of bytes to generate

3753

      * @param return_value default value (`ThrowException`): throw exception on error.

3754

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3755

      * At least the following PKCS#11 return values may be returned:

3756

      *     \li ArgumentsBad \li CryptokiNotInitialized \li DeviceError

3757

      *     \li DeviceMemory \li DeviceRemoved \li FunctionCanceled

3758

      *     \li FunctionFailed \li GeneralError \li HostMemory

3759

      *     \li OK \li OperationActive \li RandomNoRng

3760

      *     \li SessionClosed \li SessionHandleInvalid \li UserNotLoggedIn

3761

      * @return true on success, false otherwise

3762

*/

3763

      bool C_GenerateRandom(SessionHandle session,

3764

                            Byte* random_data_ptr,

3765

                            Ulong random_len,

3766

                            ReturnValue* return_value = ThrowException) const;

3767

3768

      /****************************** Parallel function management functions ******************************/

3769

3770

/**

3771

      * C_GetFunctionStatus is a legacy function; it obtains an updated status of a function running in parallel with an application.

3772

      * @param session the session's handle

3773

      * @param return_value default value (`ThrowException`): throw exception on error.

3774

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3775

      * At least the following PKCS#11 return values may be returned:

3776

      *     \li CryptokiNotInitialized \li FunctionFailed \li FunctionNotParallel

3777

      *     \li GeneralError \li HostMemory \li SessionHandleInvalid

3778

      *     \li SessionClosed

3779

      * @return true on success, false otherwise

3780

*/

3781

      bool C_GetFunctionStatus(SessionHandle session, ReturnValue* return_value = ThrowException) const;

3782

3783

/**

3784

      * C_CancelFunction is a legacy function; it cancels a function running in parallel.

3785

      * @param session the session's handle

3786

      * @param return_value default value (`ThrowException`): throw exception on error.

3787

      * if a non-NULL pointer is passed: return_value receives the return value of the PKCS#11 function and no exception is thrown.

3788

      * At least the following PKCS#11 return values may be returned:

3789

      *     \li CryptokiNotInitialized \li FunctionFailed \li FunctionNotParallel

3790

      *     \li GeneralError \li HostMemory \li SessionHandleInvalid

3791

      *     \li SessionClosed

3792

      * @return true on success, false otherwise

3793

*/

3794

      bool C_CancelFunction(SessionHandle session, ReturnValue* return_value = ThrowException) const;

3795

3796

      /******************* Asynchronous function management functions *******************/

3797

3798

/**

3799

       * C_AsyncComplete checks if the function identified by function_name_ptr has

3800

       * completed an asynchronous operation and, if so, returns the associated

3801

       * result(s).

3802

3803

       * @param session the session's handle

3804

       * @param function_name_ptr pkcs11 function name

3805

       * @param result_ptr operation result

3806

       * @param return_value default value (`ThrowException`): throw exception on error

3807

       * @return true on success, false otherwise

3808

*/

3809

      bool C_AsyncComplete(SessionHandle session,

3810

                           const Utf8Char* function_name_ptr,

3811

                           AsyncData* result_ptr,

3812

                           ReturnValue* return_value = ThrowException);

3813

3814

/**

3815

       * C_AsyncGetID is used to persist an operation past a C_Finalize call and allow

3816

       * another instance of the client to reconnect after a call to

3817

       * C_Initialize. C_AsyncGetID places a module dependent identifier for

3818

       * the asynchronous operation being performed by the function identified by

3819

       * function_name_ptr.

3820

3821

       * @param session the session's handle

3822

       * @param function_name_ptr pkcs11 function name

3823

       * @param id_ptr persistent operation id

3824

       * @param return_value default value (`ThrowException`): throw exception on error

3825

       * @return true on success, false otherwise

3826

*/

3827

      bool C_AsyncGetID(SessionHandle session,

3828

                        const Utf8Char* function_name_ptr,

3829

                        Ulong* id_ptr,

3830

                        ReturnValue* return_value = ThrowException);

3831

3832

/**

3833

       * C_AsyncJoin checks if the function identified by function_name_ptr and id is a

3834

       * valid asynchronous operation and, if so, reconnects the client application to

3835

       * the module using the buffer specified by data_ptr and data_len in place of those

3836

       * passed into the original call to function_name_ptr.

3837

3838

       * @param session the session's handle

3839

       * @param function_name_ptr pkcs11 function name

3840

       * @param id persistent operation id

3841

       * @param data_ptr location for the data

3842

       * @param data_len data length

3843

       * @param return_value default value (`ThrowException`): throw exception on error

3844

       * @return true on success, false otherwise

3845

*/

3846

      bool C_AsyncJoin(SessionHandle session,

3847

                       const Utf8Char* function_name_ptr,

3848

                       Ulong id,

3849

                       Byte* data_ptr,

3850

                       Ulong data_len,

3851

                       ReturnValue* return_value = ThrowException);

3852

3853

/**

3854

      * Return the PKCS11 function list that this LowLevel class contains.

3855

3856

      * This is primarily useful when invoking vendor specific extension

3857

      * functions which are not supported directly by LowLevel or the higher

3858

      * level PKCS11 API.

3859

*/

3860

      BOTAN_DEPRECATED("Use get_interface().func_2_40()") FunctionList* get_functions() const;

3861

3862

      const InterfaceWrapper& get_interface() { return *m_interface_wrapper; }

3863

3864

   protected:

3865

/**

3866

      * it is possible for an application to inherit from LowLevel in order to

3867

      * implement wrappers for vendor specific extensions using the same error

3868

      * handling mechanisms as the rest of the library.

3869

*/

3870

      static bool handle_return_value(CK_RV function_result, ReturnValue* return_value);

3871

3872

   private:

3873

      std::unique_ptr<InterfaceWrapper> m_interface_wrapper;

3874

};

3875

3876

class BOTAN_PUBLIC_API(2, 0) PKCS11_Error : public Exception {

3877

   public:

3879

3881

};

3882

3883

class BOTAN_PUBLIC_API(2, 0) PKCS11_ReturnError final : public PKCS11_Error {

3884

   public:

3885

      explicit PKCS11_ReturnError(ReturnValue return_val);

3886

3888

3890

3891

   private:

3892

      const ReturnValue m_return_val;

3893

};

3894

3895

}  // namespace PKCS11

3896

3897

}  // namespace Botan

3898

3899

#endif

randombit / botan / 12805544433

Source File
Press 'n' to go to next uncovered line, 'b' for previous

randombit / botan / 12805544433

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous