summaryrefslogtreecommitdiff
path: root/usr/src
diff options
context:
space:
mode:
Diffstat (limited to 'usr/src')
-rw-r--r--usr/src/cmd/cmd-crypto/decrypt/Makefile9
-rw-r--r--usr/src/cmd/cmd-crypto/decrypt/decrypt.c276
-rw-r--r--usr/src/cmd/cmd-crypto/digest/Makefile9
-rw-r--r--usr/src/cmd/cmd-crypto/digest/digest.c273
-rw-r--r--usr/src/cmd/cmd-crypto/pktool/common.c4
-rw-r--r--usr/src/cmd/cmd-crypto/pktool/genkey.c8
-rw-r--r--usr/src/cmd/cmd-crypto/pktool/pktool.c12
-rw-r--r--usr/src/lib/libkmf/include/kmftypes.h4
-rw-r--r--usr/src/lib/libkmf/plugins/kmf_nss/common/nss_spi.c6
-rw-r--r--usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c4
-rw-r--r--usr/src/lib/libkmf/plugins/kmf_pkcs11/common/pkcs11_spi.c145
11 files changed, 618 insertions, 132 deletions
diff --git a/usr/src/cmd/cmd-crypto/decrypt/Makefile b/usr/src/cmd/cmd-crypto/decrypt/Makefile
index d2a93105a8..3b767d7c03 100644
--- a/usr/src/cmd/cmd-crypto/decrypt/Makefile
+++ b/usr/src/cmd/cmd-crypto/decrypt/Makefile
@@ -2,9 +2,8 @@
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
-# Common Development and Distribution License, Version 1.0 only
-# (the "License"). You may not use this file except in compliance
-# with the License.
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
# CDDL HEADER END
#
#
-# Copyright 2004 Sun Microsystems, Inc. All rights reserved.
+# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# ident "%Z%%M% %I% %E% SMI"
@@ -36,7 +35,7 @@ include ../../Makefile.cmd
CFLAGS += $(CCVERBOSE) -D_FILE_OFFSET_BITS=64
-LDLIBS += -lpkcs11 -lcryptoutil
+LDLIBS += -lkmf -lpkcs11 -lcryptoutil
.KEEP_STATE:
diff --git a/usr/src/cmd/cmd-crypto/decrypt/decrypt.c b/usr/src/cmd/cmd-crypto/decrypt/decrypt.c
index aec66ba299..6119704da3 100644
--- a/usr/src/cmd/cmd-crypto/decrypt/decrypt.c
+++ b/usr/src/cmd/cmd-crypto/decrypt/decrypt.c
@@ -2,9 +2,8 @@
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License"). You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
@@ -21,7 +20,7 @@
*/
/* Portions Copyright 2005 Richard Lowe */
/*
- * Copyright 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -74,6 +73,7 @@
#include <netinet/in.h>
#include <security/cryptoki.h>
#include <cryptoutil.h>
+#include <kmfapi.h>
#define BUFFERSIZE (2048) /* Buffer size for reading file */
#define BLOCKSIZE (128) /* Largest guess for block size */
@@ -97,9 +97,11 @@
#define RANDOM_DEVICE "/dev/urandom" /* random device name */
#define ENCRYPT_NAME "encrypt" /* name of encrypt command */
-#define ENCRYPT_OPTIONS "a:k:i:o:lv" /* options for encrypt */
+#define ENCRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for encrypt */
#define DECRYPT_NAME "decrypt" /* name of decrypt command */
-#define DECRYPT_OPTIONS "a:k:i:o:lv" /* options for decrypt */
+#define DECRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for decrypt */
+#define DEFAULT_TOKEN_PROMPT "Enter PIN for %s: "
+#define PK_DEFAULT_PK11TOKEN SOFT_TOKEN_LABEL
/*
* Structure containing info for encrypt/decrypt
@@ -170,10 +172,14 @@ static boolean_t iflag = B_FALSE; /* -i <infile> flag, use stdin if absent */
static boolean_t oflag = B_FALSE; /* -o <outfile> flag, use stdout if absent */
static boolean_t lflag = B_FALSE; /* -l flag (list) */
static boolean_t vflag = B_FALSE; /* -v flag (verbose) */
+static boolean_t Tflag = B_FALSE;
+static boolean_t Kflag = B_FALSE;
static char *keyfile = NULL; /* name of keyfile */
static char *inputfile = NULL; /* name of input file */
static char *outputfile = NULL; /* name of output file */
+static char *token_label = NULL;
+static char *key_label = NULL;
static int status_pos = 0; /* current position of progress bar element */
@@ -182,7 +188,7 @@ static int status_pos = 0; /* current position of progress bar element */
*/
static void usage(struct CommandInfo *cmd);
static int execute_cmd(struct CommandInfo *cmd, char *algo_str);
-static int cryptogetkey(CK_BYTE_PTR *pkeydata, CK_ULONG_PTR pkeysize);
+static int cryptogetdata(char *, CK_BYTE_PTR *pkeydata, CK_ULONG_PTR pkeysize);
static int cryptoreadfile(char *filename, CK_BYTE_PTR *pdata,
CK_ULONG_PTR pdatalen);
static int get_random_data(CK_BYTE_PTR pivbuf, int ivlen);
@@ -240,6 +246,14 @@ main(int argc, char **argv)
kflag = B_TRUE;
keyfile = optarg;
break;
+ case 'T':
+ Tflag = B_TRUE;
+ token_label = optarg;
+ break;
+ case 'K':
+ Kflag = B_TRUE;
+ key_label = optarg;
+ break;
case 'i':
iflag = B_TRUE;
inputfile = optarg;
@@ -260,6 +274,7 @@ main(int argc, char **argv)
}
if (errflag || (!aflag && !lflag) || (lflag && argc > 2) ||
+ (kflag && Kflag) || (Tflag && !Kflag) ||
(optind < argc)) {
usage(cmd);
exit(EXIT_USAGE);
@@ -274,14 +289,18 @@ main(int argc, char **argv)
static void
usage(struct CommandInfo *cmd)
{
+ (void) fprintf(stderr, gettext("Usage:\n"));
if (cmd->type == CKA_ENCRYPT) {
- cryptoerror(LOG_STDERR, gettext("usage: encrypt -l | -a "
- "<algorithm> [-v] [-k <keyfile>] [-i <infile>]"
- "\n\t\t\t[-o <outfile>]"));
+ (void) fprintf(stderr, gettext(" encrypt -l\n"));
+ (void) fprintf(stderr, gettext(" encrypt -a <algorithm> "
+ "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
+ "[-i <infile>] [-o <outfile>]\n"));
+
} else {
- cryptoerror(LOG_STDERR, gettext("usage: decrypt -l | -a "
- "<algorithm> [-v] [-k <keyfile>] [-i <infile>]"
- "\n\t\t\t[-o <outfile>]"));
+ (void) fprintf(stderr, gettext(" decrypt -l\n"));
+ (void) fprintf(stderr, gettext(" decrypt -a <algorithm> "
+ "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
+ "[-i <infile>] [-o <outfile>]\n"));
}
}
@@ -381,6 +400,84 @@ generate_pkcs5_key(CK_SESSION_HANDLE hSession,
return (rv);
}
+/*
+ * This function will login into the token with the provided password and
+ * find the token key object with the specified keytype and keylabel.
+ */
+static int
+get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype,
+ char *keylabel, CK_BYTE *password, int password_len,
+ CK_OBJECT_HANDLE *keyobj)
+{
+ CK_RV rv;
+ CK_ATTRIBUTE pTmpl[10];
+ CK_OBJECT_CLASS class = CKO_SECRET_KEY;
+ CK_BBOOL true = 1;
+ CK_BBOOL is_token = 1;
+ CK_ULONG key_obj_count = 1;
+ int i;
+ CK_KEY_TYPE ckKeyType = keytype;
+
+
+ rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password,
+ (CK_ULONG)password_len);
+ if (rv != CKR_OK) {
+ (void) fprintf(stderr, "Cannot login to the token."
+ " error = %s\n", pkcs11_strerror(rv));
+ return (-1);
+ }
+
+ i = 0;
+ pTmpl[i].type = CKA_TOKEN;
+ pTmpl[i].pValue = &is_token;
+ pTmpl[i].ulValueLen = sizeof (CK_BBOOL);
+ i++;
+
+ pTmpl[i].type = CKA_CLASS;
+ pTmpl[i].pValue = &class;
+ pTmpl[i].ulValueLen = sizeof (class);
+ i++;
+
+ pTmpl[i].type = CKA_LABEL;
+ pTmpl[i].pValue = keylabel;
+ pTmpl[i].ulValueLen = strlen(keylabel);
+ i++;
+
+ pTmpl[i].type = CKA_KEY_TYPE;
+ pTmpl[i].pValue = &ckKeyType;
+ pTmpl[i].ulValueLen = sizeof (ckKeyType);
+ i++;
+
+ pTmpl[i].type = CKA_PRIVATE;
+ pTmpl[i].pValue = &true;
+ pTmpl[i].ulValueLen = sizeof (true);
+ i++;
+
+ rv = C_FindObjectsInit(hSession, pTmpl, i);
+ if (rv != CKR_OK) {
+ goto out;
+ }
+
+ rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count);
+
+ (void) C_FindObjectsFinal(hSession);
+
+out:
+ if (rv != CKR_OK) {
+ (void) fprintf(stderr,
+ "Cannot retrieve key object. error = %s\n",
+ pkcs11_strerror(rv));
+ return (-1);
+ }
+
+ if (key_obj_count == 0) {
+ (void) fprintf(stderr, "Cannot find the key object.\n");
+ return (-1);
+ }
+
+ return (0);
+}
+
/*
* Execute the command.
@@ -419,6 +516,8 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
CK_ULONG keylen;
int version = SUNW_ENCRYPT_FILE_VERSION;
CK_KEY_TYPE keytype;
+ KMF_RETURN kmfrv;
+ CK_SLOT_ID token_slot_id;
if (aflag) {
/* Determine if algorithm is valid */
@@ -438,27 +537,40 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
}
/*
- * Process keyfile
+ * Process keyfile or get the token pin if -K is specified.
*
* If a keyfile is provided, get the key data from
* the file. Otherwise, prompt for a passphrase. The
* passphrase is used as the key data.
*/
- if (kflag) {
+ if (Kflag) {
+ /* get the pin of the token */
+ if (token_label == NULL || !strlen(token_label)) {
+ token_label = PK_DEFAULT_PK11TOKEN;
+ }
+
+ status = cryptogetdata(token_label, &pkeydata,
+ &keysize);
+ } else if (kflag) {
+ /* get the key file */
status = cryptoreadfile(keyfile, &pkeydata, &keysize);
} else {
- status = cryptogetkey(&pkeydata, &keysize);
+ /* get the key from input */
+ status = cryptogetdata(NULL, &pkeydata, &keysize);
}
if (status == -1 || keysize == 0L) {
- cryptoerror(LOG_STDERR, gettext("invalid key."));
+ cryptoerror(LOG_STDERR,
+ Kflag ? gettext("invalid password.") :
+ gettext("invalid key."));
return (EXIT_FAILURE);
}
}
bzero(salt, sizeof (salt));
/* Initialize pkcs */
- if ((rv = C_Initialize(NULL)) != CKR_OK) {
+ rv = C_Initialize(NULL);
+ if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) {
cryptoerror(LOG_STDERR, gettext("failed to initialize "
"PKCS #11 framework: %s"), pkcs11_strerror(rv));
goto cleanup;
@@ -529,29 +641,52 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
goto cleanup;
}
- /* Find a slot with matching mechanism */
- for (i = 0; i < slotcount; i++) {
- slotID = pSlotList[i];
- rv = C_GetMechanismInfo(slotID, mech_type, &info);
- if (rv != CKR_OK) {
- continue; /* to the next slot */
- } else {
- /*
- * If the slot support the crypto, also
- * make sure it supports the correct
- * key generation mech if needed.
- *
- * We need PKCS5 when RC4 is used or
- * when the key is entered on cmd line.
- */
- if ((info.flags & cmd->flags) &&
- (mech_type == CKM_RC4) || (keyfile == NULL)) {
- rv = C_GetMechanismInfo(slotID,
- CKM_PKCS5_PBKD2, &kg_info);
- if (rv == CKR_OK)
+
+ /*
+ * Find a slot with matching mechanism
+ *
+ * If -K is specified, we find the slot id for the token first, then
+ * check if the slot supports the algorithm.
+ */
+ i = 0;
+ if (Kflag) {
+ kmfrv = KMF_PK11TokenLookup(NULL, token_label, &token_slot_id);
+ if (kmfrv != KMF_OK) {
+ cryptoerror(LOG_STDERR,
+ gettext("no matching PKCS#11 token"));
+ errflag = B_TRUE;
+ goto cleanup;
+ }
+ rv = C_GetMechanismInfo(token_slot_id, mech_type, &info);
+ if (rv == CKR_OK && (info.flags & cmd->flags))
+ slotID = token_slot_id;
+ else
+ i = slotcount;
+ } else {
+ for (i = 0; i < slotcount; i++) {
+ slotID = pSlotList[i];
+ rv = C_GetMechanismInfo(slotID, mech_type, &info);
+ if (rv != CKR_OK) {
+ continue; /* to the next slot */
+ } else {
+ /*
+ * If the slot support the crypto, also
+ * make sure it supports the correct
+ * key generation mech if needed.
+ *
+ * We need PKCS5 when RC4 is used or
+ * when the key is entered on cmd line.
+ */
+ if ((info.flags & cmd->flags) &&
+ (mech_type == CKM_RC4) ||
+ (keyfile == NULL)) {
+ rv = C_GetMechanismInfo(slotID,
+ CKM_PKCS5_PBKD2, &kg_info);
+ if (rv == CKR_OK)
+ break;
+ } else if (info.flags & cmd->flags) {
break;
- } else if (info.flags & cmd->flags) {
- break;
+ }
}
}
}
@@ -564,7 +699,6 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
goto cleanup;
}
-
/* Open a session */
rv = C_OpenSession(slotID, CKF_SERIAL_SESSION,
NULL_PTR, NULL, &hSession);
@@ -726,13 +860,26 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
break;
}
}
+
/*
- * If encrypting, we need some random
+ * If Kflag is set, let's find the token key now.
+ *
+ * If Kflag is not set and if encrypting, we need some random
* salt data to create the key. If decrypting,
* the salt should come from head of the file
* to be decrypted.
*/
- if (cmd->type == CKA_ENCRYPT) {
+ if (Kflag) {
+ rv = get_token_key(hSession, keytype, key_label, pkeydata,
+ keysize, &key);
+ if (rv != CKR_OK) {
+ cryptoerror(LOG_STDERR, gettext(
+ "Can not find the token key"));
+ goto cleanup;
+ } else {
+ goto do_crypto;
+ }
+ } else if (cmd->type == CKA_ENCRYPT) {
rv = get_random_data(salt, sizeof (salt));
if (rv != 0) {
cryptoerror(LOG_STDERR,
@@ -742,6 +889,7 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
}
}
+
/*
* If key input is read from a file, treat it as
* raw key data, unless it is to be used with RC4,
@@ -810,6 +958,8 @@ execute_cmd(struct CommandInfo *cmd, char *algo_str)
goto cleanup;
}
+
+do_crypto:
/* Setup up mechanism */
mech.mechanism = mech_type;
mech.pParameter = (CK_VOID_PTR)pivbuf;
@@ -878,7 +1028,7 @@ cleanup:
}
/* Destroy key object */
- if (key != (CK_OBJECT_HANDLE) 0) {
+ if (Kflag != B_FALSE && key != (CK_OBJECT_HANDLE) 0) {
(void) C_DestroyObject(hSession, key);
}
@@ -1200,38 +1350,44 @@ cryptoreadfile(char *filename, CK_BYTE_PTR *pdata, CK_ULONG_PTR pdatalen)
return (0);
}
+
/*
- * cryptogetkey - prompt user for a key
+ * cryptogetdata - prompt user for a key or the PIN for a token
*
- * pkeydata - buffer for returning key data
+ * pdata - buffer for returning key or pin data
* must be freed by caller using free()
- * pkeysize - size of buffer returned
+ * psize - size of buffer returned
*
* returns
* 0 for success, -1 for failure
*/
static int
-cryptogetkey(CK_BYTE_PTR *pkeydata, CK_ULONG_PTR pkeysize)
-
+cryptogetdata(char *token_spec, CK_BYTE_PTR *pdata, CK_ULONG_PTR psize)
{
- char *keybuf;
- char *tmpbuf;
-
-
-
- tmpbuf = getpassphrase(gettext("Enter key:"));
+ char *databuf = NULL;
+ char *tmpbuf = NULL;
+ char prompt[1024];
+
+ if (token_spec != NULL) {
+ (void) snprintf(prompt, sizeof (prompt),
+ DEFAULT_TOKEN_PROMPT, token_spec);
+ tmpbuf = getpassphrase(gettext(prompt));
+ } else {
+ tmpbuf = getpassphrase(gettext("Enter key:"));
+ }
if (tmpbuf == NULL) {
return (-1); /* error */
} else {
- keybuf = strdup(tmpbuf);
- (void) memset(tmpbuf, 0, strlen(tmpbuf));
+ databuf = strdup(tmpbuf);
+ (void) memset(tmpbuf, 0, strlen(tmpbuf)); /* clean up */
+ if (databuf == NULL)
+ return (-1);
}
- *pkeydata = (CK_BYTE_PTR)keybuf;
- *pkeysize = (CK_ULONG)strlen(keybuf);
-
+ *pdata = (CK_BYTE_PTR)databuf;
+ *psize = (CK_ULONG)strlen(databuf);
return (0);
}
diff --git a/usr/src/cmd/cmd-crypto/digest/Makefile b/usr/src/cmd/cmd-crypto/digest/Makefile
index 318116637e..4091ae3919 100644
--- a/usr/src/cmd/cmd-crypto/digest/Makefile
+++ b/usr/src/cmd/cmd-crypto/digest/Makefile
@@ -2,9 +2,8 @@
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
-# Common Development and Distribution License, Version 1.0 only
-# (the "License"). You may not use this file except in compliance
-# with the License.
+# Common Development and Distribution License (the "License").
+# You may not use this file except in compliance with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
# CDDL HEADER END
#
#
-# Copyright 2004 Sun Microsystems, Inc. All rights reserved.
+# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# ident "%Z%%M% %I% %E% SMI"
@@ -36,7 +35,7 @@ include ../../Makefile.cmd
CFLAGS += $(CCVERBOSE) -D_FILE_OFFSET_BITS=64
-LDLIBS += -lpkcs11 -lcryptoutil
+LDLIBS += -lkmf -lpkcs11 -lcryptoutil
.KEEP_STATE:
diff --git a/usr/src/cmd/cmd-crypto/digest/digest.c b/usr/src/cmd/cmd-crypto/digest/digest.c
index 73b805c812..4ef01b23fb 100644
--- a/usr/src/cmd/cmd-crypto/digest/digest.c
+++ b/usr/src/cmd/cmd-crypto/digest/digest.c
@@ -2,9 +2,8 @@
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
- * Common Development and Distribution License, Version 1.0 only
- * (the "License"). You may not use this file except in compliance
- * with the License.
+ * Common Development and Distribution License (the "License").
+ * You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
@@ -20,7 +19,7 @@
* CDDL HEADER END
*/
/*
- * Copyright 2005 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -52,6 +51,7 @@
#include <security/cryptoki.h>
#include <limits.h>
#include <cryptoutil.h>
+#include <kmfapi.h>
#define BUFFERSIZE (4096) /* Buffer size for reading file */
@@ -78,15 +78,23 @@
#define EXIT_USAGE 2 /* usage/syntax error */
#define MAC_NAME "mac" /* name of mac command */
-#define MAC_OPTIONS "lva:k:" /* for getopt */
+#define MAC_OPTIONS "lva:k:T:K:" /* for getopt */
#define DIGEST_NAME "digest" /* name of mac command */
#define DIGEST_OPTIONS "lva:" /* for getopt */
+#define DEFAULT_TOKEN_PROMPT "Enter PIN for %s: "
+#define PK_DEFAULT_PK11TOKEN SOFT_TOKEN_LABEL
static boolean_t vflag = B_FALSE; /* -v (verbose) flag, optional */
static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */
static boolean_t lflag = B_FALSE; /* -l flag, for mac and digest */
+static boolean_t kflag = B_FALSE;
+static boolean_t Tflag = B_FALSE;
+static boolean_t Kflag = B_FALSE;
static char *keyfile = NULL; /* name of keyfile */
+static char *token_label = NULL;
+static char *key_label = NULL;
+
static CK_BYTE buf[BUFFERSIZE];
struct mech_alias {
@@ -125,6 +133,7 @@ static CK_RV do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech,
static CK_RV do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech,
int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen);
static int getkey(char *filename, CK_BYTE_PTR *pkeydata);
+static int getpasswd(char *token_spec, CK_BYTE_PTR *pdata, CK_ULONG_PTR psize);
int
main(int argc, char **argv)
@@ -184,11 +193,20 @@ main(int argc, char **argv)
algo_str = optarg;
break;
case 'k':
+ kflag = B_TRUE;
keyfile = optarg;
break;
case 'l':
lflag = B_TRUE;
break;
+ case 'T':
+ Tflag = B_TRUE;
+ token_label = optarg;
+ break;
+ case 'K':
+ Kflag = B_TRUE;
+ key_label = optarg;
+ break;
default:
errflag++;
}
@@ -196,7 +214,7 @@ main(int argc, char **argv)
filecount = argc - optind;
if (errflag || (!aflag && !lflag) || (lflag && argc > 2) ||
- filecount < 0) {
+ (kflag && Kflag) || (Tflag && !Kflag) || filecount < 0) {
usage(mac_cmd);
exit(EXIT_USAGE);
}
@@ -216,14 +234,15 @@ main(int argc, char **argv)
static void
usage(boolean_t mac_cmd)
{
+ (void) fprintf(stderr, gettext("Usage:\n"));
if (mac_cmd) {
- cryptoerror(LOG_STDERR, gettext(
- "usage: mac -l | [-v] -a <algorithm> [-k <keyfile>] "
- "[file...]"));
+ (void) fprintf(stderr, gettext(" mac -l\n"));
+ (void) fprintf(stderr, gettext(" mac [-v] -a <algorithm> "
+ "[-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
+ "[file...]\n"));
} else {
- cryptoerror(LOG_STDERR,
- gettext("usage: digest -l | [-v] -a <algorithm> "
- "[file...]"));
+ (void) fprintf(stderr, gettext(" digest -l | [-v] "
+ "-a <algorithm> [file...]\n"));
}
}
@@ -325,6 +344,80 @@ generate_pkcs5_key(CK_SESSION_HANDLE hSession,
}
+static int
+get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype,
+ char *keylabel, CK_BYTE *password, int password_len,
+ CK_OBJECT_HANDLE *keyobj)
+{
+ CK_RV rv;
+ CK_ATTRIBUTE pTmpl[10];
+ CK_OBJECT_CLASS class = CKO_SECRET_KEY;
+ CK_BBOOL true = 1;
+ CK_BBOOL is_token = 1;
+ CK_ULONG key_obj_count = 1;
+ int i;
+ CK_KEY_TYPE ckKeyType = keytype;
+
+
+ rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password,
+ password_len);
+ if (rv != CKR_OK) {
+ (void) fprintf(stderr, "Cannot login to the token."
+ " error = %s\n", pkcs11_strerror(rv));
+ return (-1);
+ }
+
+ i = 0;
+ pTmpl[i].type = CKA_TOKEN;
+ pTmpl[i].pValue = &is_token;
+ pTmpl[i].ulValueLen = sizeof (CK_BBOOL);
+ i++;
+
+ pTmpl[i].type = CKA_CLASS;
+ pTmpl[i].pValue = &class;
+ pTmpl[i].ulValueLen = sizeof (class);
+ i++;
+
+ pTmpl[i].type = CKA_LABEL;
+ pTmpl[i].pValue = keylabel;
+ pTmpl[i].ulValueLen = strlen(keylabel);
+ i++;
+
+ pTmpl[i].type = CKA_KEY_TYPE;
+ pTmpl[i].pValue = &ckKeyType;
+ pTmpl[i].ulValueLen = sizeof (ckKeyType);
+ i++;
+
+ pTmpl[i].type = CKA_PRIVATE;
+ pTmpl[i].pValue = &true;
+ pTmpl[i].ulValueLen = sizeof (true);
+ i++;
+
+ rv = C_FindObjectsInit(hSession, pTmpl, i);
+ if (rv != CKR_OK) {
+ goto out;
+ }
+
+ rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count);
+ (void) C_FindObjectsFinal(hSession);
+
+out:
+ if (rv != CKR_OK) {
+ (void) fprintf(stderr,
+ "Cannot retrieve key object. error = %s\n",
+ pkcs11_strerror(rv));
+ return (-1);
+ }
+
+ if (key_obj_count == 0) {
+ (void) fprintf(stderr, "Cannot find the key object.\n");
+ return (-1);
+ }
+
+ return (0);
+}
+
+
/*
* Execute the command.
* algo_str - name of algorithm
@@ -359,6 +452,9 @@ execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd)
CK_BYTE salt[PBKD2_SALT_SIZE];
CK_ULONG keysize;
CK_ULONG iterations = PBKD2_ITERATIONS;
+ CK_KEY_TYPE keytype;
+ KMF_RETURN kmfrv;
+ CK_SLOT_ID token_slot_id;
if (aflag) {
/*
@@ -382,17 +478,36 @@ execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd)
/* Get key to do a MAC operation */
if (mac_cmd) {
- keylen = getkey(keyfile, &pkeydata);
- if (keylen <= 0 || pkeydata == NULL) {
- cryptoerror(LOG_STDERR,
- gettext("invalid key."));
- return (EXIT_FAILURE);
+ if (Kflag) {
+ int status;
+
+ if (token_label == NULL ||
+ !strlen(token_label)) {
+ token_label = PK_DEFAULT_PK11TOKEN;
+ }
+
+ status = getpasswd(token_label, &pkeydata,
+ (CK_ULONG *)&keylen);
+ if (status == -1) {
+ cryptoerror(LOG_STDERR,
+ gettext("invalid passphrase."));
+ return (EXIT_FAILURE);
+ }
+
+ } else {
+ keylen = getkey(keyfile, &pkeydata);
+ if (keylen <= 0 || pkeydata == NULL) {
+ cryptoerror(LOG_STDERR,
+ gettext("invalid key."));
+ return (EXIT_FAILURE);
+ }
}
}
}
/* Initialize, and get list of slots */
- if ((rv = C_Initialize(NULL)) != CKR_OK) {
+ rv = C_Initialize(NULL);
+ if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) {
cryptoerror(LOG_STDERR,
gettext("failed to initialize PKCS #11 framework: %s"),
pkcs11_strerror(rv));
@@ -472,34 +587,56 @@ execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd)
goto cleanup;
}
- /* Find a slot with matching mechanism */
- for (i = 0; i < slotcount; i++) {
- slotID = pSlotList[i];
- rv = C_GetMechanismInfo(slotID, mech_type, &info);
- if (rv != CKR_OK) {
- continue; /* to the next slot */
- } else {
- if (mac_cmd) {
- /*
- * Make sure the slot supports
- * PKCS5 key generation if we
- * will be using it later.
- * We use it whenever the key
- * is entered at command line.
- */
- if ((info.flags & CKF_SIGN) &&
- (keyfile == NULL)) {
- CK_MECHANISM_INFO kg_info;
- rv = C_GetMechanismInfo(slotID,
- CKM_PKCS5_PBKD2, &kg_info);
- if (rv == CKR_OK)
- break;
- } else if (info.flags & CKF_SIGN) {
- break;
- }
+ /*
+ * Find a slot with matching mechanism
+ *
+ * If -K is specified, we find the slot id for the token first, then
+ * check if the slot supports the algorithm.
+ */
+ i = 0;
+ if (Kflag) {
+ kmfrv = KMF_PK11TokenLookup(NULL, token_label, &token_slot_id);
+ if (kmfrv != KMF_OK) {
+ cryptoerror(LOG_STDERR,
+ gettext("no matching PKCS#11 token"));
+ exitcode = EXIT_FAILURE;
+ goto cleanup;
+ }
+ rv = C_GetMechanismInfo(token_slot_id, mech_type, &info);
+ if (rv == CKR_OK && (info.flags & CKF_SIGN))
+ slotID = token_slot_id;
+ else
+ i = slotcount;
+
+ } else {
+ for (i = 0; i < slotcount; i++) {
+ slotID = pSlotList[i];
+ rv = C_GetMechanismInfo(slotID, mech_type, &info);
+ if (rv != CKR_OK) {
+ continue; /* to the next slot */
} else {
- if (info.flags & CKF_DIGEST)
- break;
+ if (mac_cmd) {
+ /*
+ * Make sure the slot supports
+ * PKCS5 key generation if we
+ * will be using it later.
+ * We use it whenever the key
+ * is entered at command line.
+ */
+ if ((info.flags & CKF_SIGN) &&
+ (keyfile == NULL)) {
+ CK_MECHANISM_INFO kg_info;
+ rv = C_GetMechanismInfo(slotID,
+ CKM_PKCS5_PBKD2, &kg_info);
+ if (rv == CKR_OK)
+ break;
+ } else if (info.flags & CKF_SIGN) {
+ break;
+ }
+ } else {
+ if (info.flags & CKF_DIGEST)
+ break;
+ }
}
}
}
@@ -570,6 +707,21 @@ execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd)
rv = C_CreateObject(hSession, template,
nattr, &key);
+
+ } else if (Kflag) {
+
+ if (mech_type == CKM_DES_MAC) {
+ keytype = CKK_DES;
+ } else {
+ keytype = CKK_GENERIC_SECRET;
+ }
+
+ rv = get_token_key(hSession, keytype, key_label,
+ pkeydata, keylen, &key);
+ if (rv != CKR_OK) {
+ exitcode = EXIT_FAILURE;
+ goto cleanup;
+ }
} else {
CK_KEY_TYPE keytype;
if (mech_type == CKM_DES_MAC) {
@@ -716,7 +868,7 @@ cleanup:
free(pSlotList);
}
- if (key != (CK_OBJECT_HANDLE) 0) {
+ if (!Kflag && key != (CK_OBJECT_HANDLE) 0) {
(void) C_DestroyObject(hSession, key);
}
@@ -939,3 +1091,32 @@ getkey(char *filename, CK_BYTE_PTR *pkeydata)
return (keylen);
}
+
+static int
+getpasswd(char *token_spec, CK_BYTE_PTR *pdata, CK_ULONG *psize)
+{
+ char *databuf;
+ char *tmpbuf;
+ char prompt[1024];
+
+ if (token_spec == NULL)
+ return (-1);
+
+ (void) snprintf(prompt, sizeof (prompt), DEFAULT_TOKEN_PROMPT,
+ token_spec);
+ tmpbuf = getpassphrase(gettext(prompt));
+
+ if (tmpbuf == NULL) {
+ return (-1); /* error */
+ }
+
+ databuf = strdup(tmpbuf);
+ (void) memset(tmpbuf, 0, strlen(tmpbuf));
+ if (databuf == NULL)
+ return (-1);
+
+ *pdata = (CK_BYTE_PTR)databuf;
+ *psize = (CK_ULONG)strlen(databuf);
+
+ return (0);
+}
diff --git a/usr/src/cmd/cmd-crypto/pktool/common.c b/usr/src/cmd/cmd-crypto/pktool/common.c
index 660afe2d57..e4f6feb404 100644
--- a/usr/src/cmd/cmd-crypto/pktool/common.c
+++ b/usr/src/cmd/cmd-crypto/pktool/common.c
@@ -19,7 +19,7 @@
* CDDL HEADER END
*/
/*
- * Copyright 2006 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -493,6 +493,8 @@ Str2SymKeyType(char *algm, KMF_KEY_ALG *ktype)
*ktype = KMF_DES;
else if (strcasecmp(algm, "3des") == 0)
*ktype = KMF_DES3;
+ else if (strcasecmp(algm, "generic") == 0)
+ *ktype = KMF_GENERIC_SECRET;
else
return (-1);
diff --git a/usr/src/cmd/cmd-crypto/pktool/genkey.c b/usr/src/cmd/cmd-crypto/pktool/genkey.c
index f94093029e..55890649bb 100644
--- a/usr/src/cmd/cmd-crypto/pktool/genkey.c
+++ b/usr/src/cmd/cmd-crypto/pktool/genkey.c
@@ -19,7 +19,7 @@
* CDDL HEADER END
*/
/*
- * Copyright 2006 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -359,11 +359,11 @@ pk_genkey(int argc, char *argv[])
keylen = 64; /* fixed size; ignore input */
else if (keyAlg == KMF_DES3)
keylen = 192; /* fixed size; ignore input */
- else /* AES or ARCFOUR */ {
+ else /* AES, ARCFOUR, or GENERIC SECRET */ {
if (keylenstr == NULL) {
cryptoerror(LOG_STDERR,
- gettext("Key length must be specified "
- "for AES and ARCFOUR symmetric keys.\n"));
+ gettext("Key length must be specified for "
+ "AES, ARCFOUR or GENERIC symmetric keys.\n"));
return (PK_ERR_USAGE);
}
if (sscanf(keylenstr, "%d", &keylen) != 1) {
diff --git a/usr/src/cmd/cmd-crypto/pktool/pktool.c b/usr/src/cmd/cmd-crypto/pktool/pktool.c
index 5f936613b7..7e0212639b 100644
--- a/usr/src/cmd/cmd-crypto/pktool/pktool.c
+++ b/usr/src/cmd/cmd-crypto/pktool/pktool.c
@@ -378,8 +378,8 @@ static verbcmd cmds[] = {
"genkey [ keystore=pkcs11 ]\n\t\t"
"label=key-label\n\t\t"
- "[ keytype=aes|arcfour|des|3des ]\n\t\t"
- "[ keylen=key-size (AES or ARCFOUR only)]\n\t\t"
+ "[ keytype=aes|arcfour|des|3des|generic ]\n\t\t"
+ "[ keylen=key-size (AES, ARCFOUR or GENERIC only)]\n\t\t"
"[ token=token[:manuf[:serial]]]\n\t\t"
"[ sensitive=y|n ]\n\t\t"
"[ extractable=y|n ]\n\t\t"
@@ -387,16 +387,16 @@ static verbcmd cmds[] = {
"genkey keystore=nss\n\t\t"
"label=key-label\n\t\t"
- "[ keytype=aes|arcfour|des|3des ]\n\t\t"
- "[ keylen=key-size (AES or ARCFOUR only)]\n\t\t"
+ "[ keytype=aes|arcfour|des|3des|generic ]\n\t\t"
+ "[ keylen=key-size (AES, ARCFOUR or GENERIC only)]\n\t\t"
"[ token=token[:manuf[:serial]]]\n\t\t"
"[ dir=directory-path ]\n\t\t"
"[ prefix=DBprefix ]\n\t"
"genkey keystore=file\n\t\t"
"outkey=key-fn\n\t\t"
- "[ keytype=aes|arcfour|des|3des ]\n\t\t"
- "[ keylen=key-size (AES or ARCFOUR only)]\n\t\t"
+ "[ keytype=aes|arcfour|des|3des|generic ]\n\t\t"
+ "[ keylen=key-size (AES, ARCFOUR or GENERIC only)]\n\t\t"
"[ dir=directory-path ]\n\t\t"
"[ print=y|n ]\n\t"
},
diff --git a/usr/src/lib/libkmf/include/kmftypes.h b/usr/src/lib/libkmf/include/kmftypes.h
index dc4a1f2b33..c6bfa51f7b 100644
--- a/usr/src/lib/libkmf/include/kmftypes.h
+++ b/usr/src/lib/libkmf/include/kmftypes.h
@@ -220,7 +220,6 @@ typedef struct {
typedef struct {
KMF_KEYSTORE_TYPE kstype;
KMF_DATA *certificate;
- KMF_BIGINT *serial;
KMF_DATA *ocsp_response;
union {
@@ -237,7 +236,8 @@ typedef enum {
KMF_AES = 3,
KMF_RC4 = 4,
KMF_DES = 5,
- KMF_DES3 = 6
+ KMF_DES3 = 6,
+ KMF_GENERIC_SECRET = 7
}KMF_KEY_ALG;
typedef enum {
diff --git a/usr/src/lib/libkmf/plugins/kmf_nss/common/nss_spi.c b/usr/src/lib/libkmf/plugins/kmf_nss/common/nss_spi.c
index fc6621e536..a7f4788498 100644
--- a/usr/src/lib/libkmf/plugins/kmf_nss/common/nss_spi.c
+++ b/usr/src/lib/libkmf/plugins/kmf_nss/common/nss_spi.c
@@ -2360,6 +2360,12 @@ NSS_CreateSymKey(KMF_HANDLE_T handle,
keyType = CKM_DES3_KEY_GEN;
keySize = 0; /* required by PK11_TokenKeyGen() */
break;
+ case KMF_GENERIC_SECRET:
+ keyType = CKM_GENERIC_SECRET_KEY_GEN;
+ keySize = params->keylength;
+ if (keySize == 0 || (keySize % 8) != 0)
+ return (KMF_ERR_BAD_KEY_SIZE);
+ break;
default:
rv = KMF_ERR_BAD_KEY_TYPE;
goto out;
diff --git a/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c b/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c
index 8a9fd64815..7edbcc58dd 100644
--- a/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c
+++ b/usr/src/lib/libkmf/plugins/kmf_openssl/common/openssl_spi.c
@@ -4379,8 +4379,8 @@ OpenSSL_CreateSymKey(KMF_HANDLE_T handle, KMF_CREATESYMKEY_PARAMS *params,
rkey->keydata.val = (uchar_t *)des3key;
rkey->keydata.len = DES3_KEY_SIZE;
symkey->keyalg = KMF_DES3;
-
- } else if (params->keytype == KMF_AES || params->keytype == KMF_RC4) {
+ } else if (params->keytype == KMF_AES || params->keytype == KMF_RC4 ||
+ params->keytype == KMF_GENERIC_SECRET) {
int bytes;
if (params->keylength % 8 != 0) {
diff --git a/usr/src/lib/libkmf/plugins/kmf_pkcs11/common/pkcs11_spi.c b/usr/src/lib/libkmf/plugins/kmf_pkcs11/common/pkcs11_spi.c
index 7689574e0c..902a45cd4e 100644
--- a/usr/src/lib/libkmf/plugins/kmf_pkcs11/common/pkcs11_spi.c
+++ b/usr/src/lib/libkmf/plugins/kmf_pkcs11/common/pkcs11_spi.c
@@ -30,6 +30,7 @@
#include <stdio.h> /* debugging only */
#include <errno.h>
#include <values.h>
+#include <fcntl.h>
#include <kmfapiP.h>
#include <ber_der.h>
@@ -39,6 +40,8 @@
#include <security/cryptoki.h>
#include <security/pkcs11.h>
+#define DEV_RANDOM "/dev/random"
+
#define SETATTR(t, n, atype, value, size) \
t[n].type = atype; \
t[n].pValue = (CK_BYTE *)value; \
@@ -62,6 +65,10 @@ getObjectLabel(KMF_HANDLE_T, CK_OBJECT_HANDLE, char **);
static KMF_RETURN
keyObj2RawKey(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_RAW_KEY_DATA **);
+static KMF_RETURN
+create_generic_secret_key(KMF_HANDLE_T, KMF_CREATESYMKEY_PARAMS *,
+ CK_OBJECT_HANDLE *);
+
KMF_RETURN
KMFPK11_ConfigureKeystore(KMF_HANDLE_T, KMF_CONFIG_PARAMS *);
@@ -2225,7 +2232,8 @@ keyObj2RawKey(KMF_HANDLE_T handle, KMF_KEY_HANDLE *inkey,
} else if (inkey->keyalg == KMF_AES ||
inkey->keyalg == KMF_RC4 ||
inkey->keyalg == KMF_DES ||
- inkey->keyalg == KMF_DES3) {
+ inkey->keyalg == KMF_DES3 ||
+ inkey->keyalg == KMF_GENERIC_SECRET) {
rv = get_raw_sym(kmfh, (CK_OBJECT_HANDLE)inkey->keyp,
&rkey->rawdata.sym);
} else {
@@ -2265,6 +2273,9 @@ kmf2pk11keytype(KMF_KEY_ALG keyalg, CK_KEY_TYPE *type)
case KMF_DES3:
*type = CKK_DES3;
break;
+ case KMF_GENERIC_SECRET:
+ *type = CKK_GENERIC_SECRET;
+ break;
default:
return (KMF_ERR_BAD_KEY_TYPE);
}
@@ -2462,6 +2473,9 @@ KMFPK11_FindKey(KMF_HANDLE_T handle, KMF_FINDKEY_PARAMS *parms,
keys[n].keyalg = KMF_DES;
else if (keytype == CKK_DES3)
keys[n].keyalg = KMF_DES3;
+ else if (keytype == CKK_GENERIC_SECRET)
+ keys[n].keyalg =
+ KMF_GENERIC_SECRET;
}
n++;
@@ -2474,6 +2488,7 @@ KMFPK11_FindKey(KMF_HANDLE_T handle, KMF_FINDKEY_PARAMS *parms,
/* "numkeys" indicates the number that were actually found */
*numkeys = n;
}
+
if (ckrv == KMF_OK && keys != NULL && (*numkeys) > 0) {
if (parms->format == KMF_FORMAT_RAWKEY) {
/* Convert keys to "rawkey" format */
@@ -2784,6 +2799,22 @@ KMFPK11_CreateSymKey(KMF_HANDLE_T handle, KMF_CREATESYMKEY_PARAMS *params,
if (params == NULL)
return (KMF_ERR_BAD_PARAMETER);
+ /*
+ * For AES, RC4, DES and 3DES, call C_GenerateKey() to create a key.
+ *
+ * For a generic secret key, because it may not be supported in
+ * C_GenerateKey() for some PKCS11 providers, we will handle it
+ * differently.
+ */
+ if (params->keytype == KMF_GENERIC_SECRET) {
+ rv = create_generic_secret_key(handle, params, &keyhandle);
+ if (rv != KMF_OK)
+ goto out;
+ else
+ goto setup;
+ }
+
+ /* Other keytypes */
keyGenMech.pParameter = NULL_PTR;
keyGenMech.ulParameterLen = 0;
switch (params->keytype) {
@@ -2868,6 +2899,7 @@ KMFPK11_CreateSymKey(KMF_HANDLE_T handle, KMF_CREATESYMKEY_PARAMS *params,
goto out;
}
+setup:
symkey->kstype = KMF_KEYSTORE_PK11TOKEN;
symkey->keyalg = params->keytype;
symkey->keyclass = KMF_SYMMETRIC;
@@ -3130,3 +3162,114 @@ cleanup:
return (ret);
}
+
+static KMF_RETURN
+create_generic_secret_key(KMF_HANDLE_T handle,
+ KMF_CREATESYMKEY_PARAMS *params, CK_OBJECT_HANDLE *key)
+{
+ KMF_RETURN rv = KMF_OK;
+ KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;
+ CK_RV ckrv;
+ CK_SESSION_HANDLE hSession = kmfh->pk11handle;
+ CK_OBJECT_CLASS class = CKO_SECRET_KEY;
+ CK_ULONG secKeyType = CKK_GENERIC_SECRET;
+ CK_ULONG secKeyLen;
+ CK_BBOOL true = TRUE;
+ CK_BBOOL false = FALSE;
+ CK_ATTRIBUTE templ[15];
+ int i;
+ int random_fd = -1;
+ int nread;
+ char *buf = NULL;
+
+ /*
+ * Check the key size.
+ */
+ if ((params->keylength % 8) != 0) {
+ return (KMF_ERR_BAD_KEY_SIZE);
+ } else {
+ secKeyLen = params->keylength/8; /* in bytes */
+ }
+
+ /*
+ * Generate a random number with the key size first.
+ */
+ buf = malloc(secKeyLen);
+ if (buf == NULL)
+ return (KMF_ERR_MEMORY);
+
+ while ((random_fd = open(DEV_RANDOM, O_RDONLY)) < 0) {
+ if (errno != EINTR)
+ break;
+ }
+
+ if (random_fd < 0) {
+ rv = KMF_ERR_KEYGEN_FAILED;
+ goto out;
+ }
+
+ nread = read(random_fd, buf, secKeyLen);
+ if (nread <= 0 || nread != secKeyLen) {
+ rv = KMF_ERR_KEYGEN_FAILED;
+ goto out;
+ }
+
+ /*
+ * Authenticate into the token and call C_CreateObject to generate
+ * a generic secret token key.
+ */
+ rv = pk11_authenticate(handle, &params->cred);
+ if (rv != KMF_OK) {
+ goto out;
+ }
+
+ i = 0;
+ SETATTR(templ, i, CKA_CLASS, &class, sizeof (class));
+ i++;
+ SETATTR(templ, i, CKA_KEY_TYPE, &secKeyType, sizeof (secKeyType));
+ i++;
+ SETATTR(templ, i, CKA_VALUE, buf, secKeyLen);
+ i++;
+
+ if (params->keylabel != NULL) {
+ SETATTR(templ, i, CKA_LABEL, params->keylabel,
+ strlen(params->keylabel));
+ i++;
+ }
+
+ if (params->pkcs11parms.sensitive == B_TRUE) {
+ SETATTR(templ, i, CKA_SENSITIVE, &true, sizeof (true));
+ } else {
+ SETATTR(templ, i, CKA_SENSITIVE, &false, sizeof (false));
+ }
+ i++;
+
+ if (params->pkcs11parms.not_extractable == B_TRUE) {
+ SETATTR(templ, i, CKA_EXTRACTABLE, &false, sizeof (false));
+ } else {
+ SETATTR(templ, i, CKA_EXTRACTABLE, &true, sizeof (true));
+ }
+ i++;
+
+ SETATTR(templ, i, CKA_TOKEN, &true, sizeof (true));
+ i++;
+ SETATTR(templ, i, CKA_PRIVATE, &true, sizeof (true));
+ i++;
+ SETATTR(templ, i, CKA_SIGN, &true, sizeof (true));
+ i++;
+
+ ckrv = C_CreateObject(hSession, templ, i, key);
+ if (ckrv != CKR_OK) {
+ SET_ERROR(kmfh, ckrv);
+ rv = KMF_ERR_KEYGEN_FAILED;
+ }
+
+out:
+ if (buf != NULL)
+ free(buf);
+
+ if (random_fd != -1)
+ (void) close(random_fd);
+
+ return (rv);
+}
generated by cgit v1.2.3 (git 2.46.0) at 2025-10-24 06:25:07 +0000