| Description | Binds to EP11 m_GetMechanismList, which is an implementation of PKCS #11 C_GetMechanismList. | |
|---|---|---|
| Parameters |
message GetMechanismListRequest {
}
message GetMechanismListResponse {
repeated uint64 Mechs = 2;
}
| |
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 C_GetMechanismList.
|
|---|---|
| Parameters |
CK_RV m_GetMechanismList (
CK_SLOT_ID slot,
CK_MECHANISM_TYPE_PTR mechs, CK_ULONG_PTR mechslen,
target_t target
);
|
| Return values | A subset of C_GetMechanismList return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
Two ways are available for an application to call
Because |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_GetMechanismList)(
CK_SLOT_ID slotID,
CK_MECHANISM_TYPE_PTR pMechanismList,
CK_ULONG_PTR pulCount
);
|
| Return values | CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_SLOT_ID_INVALID, CKR_TOKEN_NOT_PRESENT, CKR_TOKEN_NOT_RECOGNIZED, CKR_ARGUMENTS_BAD. |
| Description | Binds to EP11 m_GetMechanismInfo, which is an implementation of PKCS #11 C_GetMechanismInfo. | |
|---|---|---|
| Parameters |
message GetMechanismInfoRequest {
uint64 Mech = 2;
}
message GetMechanismInfoResponse {
MechanismInfo MechInfo = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 C_GetMechanismInfo.
|
|---|---|
| Parameters |
CK_RV m_GetMechanismInfo (
CK_SLOT_ID slot,
CK_MECHANISM_TYPE mech,
CK_MECHANISM_INFO_PTR mechInfo,
target_t target
);
|
| Return values | A subset of C_GetMechanismInfo return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
|
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_GetMechanismInfo)(
CK_SLOT_ID slotID,
CK_MECHANISM_TYPE type,
CK_MECHANISM_INFO_PTR pInfo
);
|
| Return values | CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_MECHANISM_INVALID, CKR_OK, CKR_SLOT_ID_INVALID, CKR_TOKEN_NOT_PRESENT, CKR_TOKEN_NOT_RECOGNIZED, CKR_ARGUMENTS_BAD. |
| Description | Binds to EP11 m_GenerateKey, which is an implementation of PKCS #11 C_GenerateKey. | |
|---|---|---|
| Parameters |
message GenerateKeyRequest {
Mechanism Mech = 1;
map<uint64,AttributeValue> Template = 6;
}
message GenerateKeyResponse {
bytes KeyBytes = 4;
bytes CheckSum = 5;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 TDES keys are generated with proper parity, which is not observable by the host. But it is needed for proper interoperability: other PKCS #11 implementations needs to reject DES keys with parity problems. If an object is tied to a session,
DSA and DH parameter generation ignores DSA, DH parameters ( The PKCS #11 |
|---|---|
| Parameters |
CK_RV m_GenerateKey (
CK_MECHANISM_PTR mech,
CK_ATTRIBUTE_PTR template, CK_ULONG templatelen,
const unsigned char *pin, size_t pinlen,
unsigned char *key, size_t *keylen,
unsigned char *checkSum, size_t *checkSumlen,
target_t target
);
|
| Return values | A subset of C_GenerateKey return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
If the generation mechanism is for domain parameter generation, the Since the type of key or domain parameters to be generated is implicit in the generation mechanism, the template does not need to supply a key type. If it does supply a key type that is inconsistent with the generation mechanism, If a call to The object created by a successful call to |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_GenerateKey)(
CK_SESSION_HANDLE hSession
CK_MECHANISM_PTR pMechanism,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulCount,
CK_OBJECT_HANDLE_PTR phKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_READ_ONLY, CKR_ATTRIBUTE_TYPE_INVALID, CKR_ATTRIBUTE_VALUE_INVALID, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_CURVE_NOT_SUPPORTED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SESSION_READ_ONLY, CKR_TEMPLATE_INCOMPLETE, CKR_TEMPLATE_INCONSISTENT, CKR_TOKEN_WRITE_PROTECTED, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_GenerateKeyPair, which is an implementation of PKCS #11 C_GenerateKeyPair. | |
|---|---|---|
| Parameters |
message GenerateKeyPairRequest {
Mechanism Mech = 1;
map<uint64,AttributeValue> PrivKeyTemplate = 7;
map<uint64,AttributeValue> PubKeyTemplate = 8;
}
message GenerateKeyPairResponse {
bytes PrivKeyBytes = 5;
bytes PubKeyBytes = 6;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Keypair parameters are retrieved from In FIPS mode, only RSA moduluses of 1024+256 Public key is formatted as a standard SPKI (subject public key information), readable by most libraries. It is integrity-protected by a transport-key specific MAC, which is not part of the SPKI itself. DSA parameter generation returns a non-SPKI structure in the public key field. If you tie an object to a session, Returns wrapped private key to The following supported parameter combinations with special notes are beyond what are documented by PKCS #11: RSA keys reject public exponents below 17 (0x11). Control points can further restrict the accepted minimum. The Fermat4 exponent, 0x10001, is controlled by a specific control point, matching public-exponent restrictions of FIPS 186-3 (section B.3.1). EC keys ( DSA keys ( DH keys ( Use of session (Login) state replaces standard use of sessions. The mapping is outside library scope. The PKCS #11 PKCS #11 PKCS #11 |
|---|---|
| Parameters |
CK_RV m_GenerateKeyPair (
CK_MECHANISM_PTR mech,
CK_ATTRIBUTE_PTR pubKeyTemplate, CK_ULONG pubKeyTemplatelen,
CK_ATTRIBUTE_PTR privKeyTemplate, CK_ULONG privKeyTemplatelen,
const unsigned char *pin, size_t pinlen,
unsigned char *privKey, size_t *privKeylen,
unsigned char *pubKey, size_t *pubKeylen,
target_t target
);
|
| Return values | A subset of C_GenerateKeyPair return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
Since the types of keys to be generated are implicit in the key pair generation mechanism, the templates do not need to supply key types. If one of the templates does supply a key type that is inconsistent with the key generation mechanism, If a call to A call to The key objects created by a successful call to Note carefully the order of the arguments to |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_GenerateKeyPair)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_ATTRIBUTE_PTR pPublicKeyTemplate,
CK_ULONG ulPublicKeyAttributeCount,
CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
CK_ULONG ulPrivateKeyAttributeCount,
CK_OBJECT_HANDLE_PTR phPublicKey,
CK_OBJECT_HANDLE_PTR phPrivateKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_READ_ONLY, CKR_ATTRIBUTE_TYPE_INVALID, CKR_ATTRIBUTE_VALUE_INVALID, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_CURVE_NOT_SUPPORTED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_DOMAIN_PARAMS_INVALID, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SESSION_READ_ONLY, CKR_TEMPLATE_INCOMPLETE, CKR_TEMPLATE_INCONSISTENT, CKR_TOKEN_WRITE_PROTECTED, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_DeriveKey, which is an implementation of PKCS #11 C_DeriveKey. | |
|---|---|---|
| Parameters |
message DeriveKeyRequest {
Mechanism Mech = 1;
bytes BaseKey = 3;
bytes Data = 4;
map<uint64,AttributeValue> Template = 8;
}
message DeriveKeyResponse {
bytes NewKeyBytes = 6;
bytes CheckSum = 7;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 The PKCS #11 PKCS #11 |
|---|---|
| Parameters |
CK_RV m_DeriveKey (
CK_MECHANISM_PTR mech,
CK_ATTRIBUTE_PTR template, CK_ULONG templatelen,
const unsigned char *baseKey, size_t baseKeylen,
const unsigned char *data, size_t datalen,
const unsigned char *pin, size_t pinlen,
unsigned char *newKey, size_t *newKeylen,
unsigned char *checkSum, size_t *checkSumlen,
target_t target
);
|
| Return values | A subset of C_DeriveKey return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The values of the If a call to The key object created by a successful call to |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DeriveKey)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hBaseKey,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulAttributeCount,
CK_OBJECT_HANDLE_PTR phKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_READ_ONLY, CKR_ATTRIBUTE_TYPE_INVALID, CKR_ATTRIBUTE_VALUE_INVALID, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_CURVE_NOT_SUPPORTED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_DOMAIN_PARAMS_INVALID, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_HANDLE_INVALID, CKR_KEY_SIZE_RANGE, CKR_KEY_TYPE_INCONSISTENT, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SESSION_READ_ONLY, CKR_TEMPLATE_INCOMPLETE, CKR_TEMPLATE_INCONSISTENT, CKR_TOKEN_WRITE_PROTECTED, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_WrapKey, which is an implementation of PKCS #11 C_WrapKey. | |
|---|---|---|
| Parameters |
message WrapKeyRequest {
bytes Key = 1;
bytes KeK = 2;
bytes MacKey = 3;
Mechanism Mech = 4;
}
message WrapKeyResponse {
bytes Wrapped = 5;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 C_WrapKey.
|
|---|---|
| Parameters |
CK_RV m_WrapKey (
const unsigned char *key, size_t keylen,
const unsigned char *keK, size_t keKlen,
const unsigned char *macKey, size_t macKeylen,
const CK_MECHANISM_PTR mech,
CK_BYTE_PTR wrapped, CK_ULONG_PTR wrappedlen,
target_t target
);
|
| Return values | A subset of C_WrapKey return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The If the key to be wrapped cannot be wrapped for some token-specific reason, despite its having its
Tokens vary in which types of keys can be wrapped with which mechanisms. To partition the wrapping keys so that they can wrap only a subset of extractable keys, the attribute |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_WrapKey)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hWrappingKey,
CK_OBJECT_HANDLE hKey,
CK_BYTE_PTR pWrappedKey,
CK_ULONG_PTR pulWrappedKeyLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_HANDLE_INVALID, CKR_KEY_NOT_WRAPPABLE, CKR_KEY_SIZE_RANGE, CKR_KEY_UNEXTRACTABLE, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN, CKR_WRAPPING_KEY_HANDLE_INVALID, CKR_WRAPPING_KEY_SIZE_RANGE, CKR_WRAPPING_KEY_TYPE_INCONSISTENT. |
| Description | Binds to EP11 m_UnwrapKey, which is an implementation of PKCS #11 C_UnwrapKey. | |
|---|---|---|
| Parameters |
message UnwrapKeyRequest {
bytes Wrapped = 1;
bytes KeK = 2;
bytes MacKey = 3;
Mechanism Mech = 5;
map<uint64,AttributeValue> Template = 9;
}
message UnwrapKeyResponse {
bytes UnwrappedBytes = 7;
bytes CheckSum = 8;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11
The generated object is returned under When an SPKI is being transformed to a MACed SPKI, one must use CKM_IBM_TRANSPORTKEY as the unwrapping mechanism. This mode supplies the raw SPKI as wrapped data, and ignores the KEK.
|
|---|---|
| Parameters |
CK_RV m_UnwrapKey (
const CK_BYTE_PTR wrapped, CK_ULONG wrappedlen,
const unsigned char *keK, size_t keKlen,
const unsigned char *macKey, size_t macKeylen,
const unsigned char *pin, size_t pinlen,
const CK_MECHANISM_PTR mech,
const CK_ATTRIBUTE_PTR template, CK_ULONG templatelen,
unsigned char *unwrapped, size_t *unwrappedlen,
CK_BYTE_PTR checkSum, CK_ULONG *checkSumlen,
target_t target
);
|
| Return values | A subset of C_UnwrapKey return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The The new key has the Some mechanisms can modify, or attempt to modify. The contents of the If a call to The key object created by a successful call to To partition the unwrapping keys so they can unwrap only a subset of keys the attribute |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_UnwrapKey)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hUnwrappingKey,
CK_BYTE_PTR pWrappedKey,
CK_ULONG ulWrappedKeyLen,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulAttributeCount,
CK_OBJECT_HANDLE_PTR phKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_READ_ONLY, CKR_ATTRIBUTE_TYPE_INVALID, CKR_ATTRIBUTE_VALUE_INVALID, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_CURVE_NOT_SUPPORTED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_DOMAIN_PARAMS_INVALID, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SESSION_READ_ONLY, CKR_TEMPLATE_INCOMPLETE, CKR_TEMPLATE_INCONSISTENT, CKR_TOKEN_WRITE_PROTECTED, CKR_UNWRAPPING_KEY_HANDLE_INVALID, CKR_UNWRAPPING_KEY_SIZE_RANGE, CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT, CKR_USER_NOT_LOGGED_IN, CKR_WRAPPED_KEY_INVALID, CKR_WRAPPED_KEY_LEN_RANGE. |
| Description | Transfers ownership of a BLOB that is controlled by the current master key to the new master key when the new master key is committed. | |
|---|---|---|
| Parameters |
message RewrapKeyBlobRequest {
bytes WrappedKey = 1;
}
message RewrapKeyBlobResponse {
bytes RewrappedKey = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Binds to EP11 m_GetAttributeValue, which is an implementation of PKCS #11 C_GetAttributeValue. | |
|---|---|---|
| Parameters |
message GetAttributeValueRequest {
bytes Object = 1;
map<uint64,AttributeValue> Attributes = 3;
}
message GetAttributeValueResponse {
map<uint64,AttributeValue> Attributes = 4;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 Does not represent or need sessions (part of blob), therefore does not use the EP11 uses more straightforward ways to decode, such as enumerating actual values instead of being more generic. |
|---|---|
| Parameters |
CK_RV m_GetAttributeValue (
const unsigned char *object, size_t objectlen,
CK_ATTRIBUTE_PTR attributes, CK_ULONG attributeslen,
target_t target
);
|
| Return values | A subset of C_GetAttributeValue return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
For each (
If case 1 applies to any of the requested attributes, then the call needs to return the value In the special case of an attribute whose value is an array of attributes, for example The error codes |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_GetAttributeValue)(
CK_SESSION_HANDLE hSession,
CK_OBJECT_HANDLE hObject,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulCount
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_SENSITIVE, CKR_ATTRIBUTE_TYPE_INVALID, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OBJECT_HANDLE_INVALID, CKR_OK, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_SetAttributeValue, which is an implementation of PKCS #11 C_SetAttributeValue. | |
|---|---|---|
| Parameters |
message SetAttributeValueRequest {
bytes Object = 1;
map<uint64,AttributeValue> Attributes = 3;
}
message SetAttributeValueResponse {
bytes Object = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Attribute packing: see _GetAttrValue Currently, Ep11 only sends Boolean attributes, all other attributes are handled by host (and EP11 does not modify arrays, such as WRAP_TEMPLATE). Does not represent or need sessions (part of blob), therefore does not use the PKCS #11 |
|---|---|
| Parameters |
CK_RV m_SetAttributeValue (
unsigned char *object, size_t objectlen,
CK_ATTRIBUTE_PTR attributes, CK_ULONG attributeslen,
target_t target
);
|
| Return values | A subset of C_SetAttributeValue return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
Certain objects might not be modified. Calling Only session objects can be modified during a read-only session. The template can specify new values for any attributes of the object that can be modified. If the template specifies a value of an attribute that is incompatible with other existing attributes of the object, the call fails with the return code Not all attributes can be modified; see Section 4.1.2 of the PKCS #11 API specification for more information. |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_SetAttributeValue)(
CK_SESSION_HANDLE hSession,
CK_OBJECT_HANDLE hObject,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulCount
);
|
| Return values | CKR_ACTION_PROHIBITED, CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_READ_ONLY, CKR_ATTRIBUTE_TYPE_INVALID, CKR_ATTRIBUTE_VALUE_INVALID, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OBJECT_HANDLE_INVALID, CKR_OK, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SESSION_READ_ONLY, CKR_TEMPLATE_INCONSISTENT, CKR_TOKEN_WRITE_PROTECTED, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_GenerateRandom, which is an implementation of PKCS #11 C_GenerateRandom. | |
|---|---|---|
| Parameters |
message GenerateRandomRequest {
uint64 Len = 1;
}
message GenerateRandomResponse {
bytes Rnd = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11
The host library could generate random numbers without dispatching to the backend, if suitable functionality would be available on the host. This is not done in the current implementation. This function does not support a size query. |
|---|---|
| Parameters |
CK_RV m_GenerateRandom (
CK_BYTE_PTR rnd, CK_ULONG rndlen,
target_t target
);
|
| Return values | A subset of C_GenerateRandom return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description | C_GenerateRandom generates random or pseudo-random data. hSession is the sessions handle; pRandomData points to the location that receives the random data; and ulRandomLen is the length in bytes of the random or pseudo-random data to be generated. |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_GenerateRandom)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pRandomData,
CK_ULONG ulRandomLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_ACTIVE, CKR_RANDOM_NO_RNG, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_EncryptInit, which is an implementation of PKCS #11 C_EncryptInit. | |
|---|---|---|
| Parameters |
message EncryptInitRequest {
Mechanism Mech = 2;
bytes Key = 3;
}
message EncryptInitResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 The For public-key mechanisms, For secret-key mechanisms, the Encrypt state inherits object session restrictions from The
|
|---|---|
| Parameters |
CK_RV m_EncryptInit (
unsigned char *state, size_t *statelen,
CK_MECHANISM_PTR mech,
const unsigned char *key, size_t keylen,
target_t target
);
|
| Return values | A subset of C_EncryptInit return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The After the application calls |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_EncryptInit)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey
);
|
| Return values | CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_FUNCTION_NOT_PERMITTED, CKR_KEY_HANDLE_INVALID, CKR_KEY_SIZE_RANGE, CKR_KEY_TYPE_INCONSISTENT, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_Encrypt, which is an implementation of PKCS #11 C_Encrypt. | |
|---|---|---|
| Parameters |
message EncryptRequest {
bytes State = 1;
bytes Plain = 2;
}
message EncryptResponse {
bytes Ciphered = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Does not update The The |
|---|---|
| Parameters |
CK_RV m_Encrypt (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR plain, CK_ULONG plainlen,
CK_BYTE_PTR ciphered, CK_ULONG_PTR cipheredlen,
target_t target
);
|
| Return values | A subset of C_Encrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The encryption operation must be initialized with
For some encryption mechanisms, the input plain text data has certain length constraints (either because the mechanism can encrypt only relatively short pieces of plain text, or because the mechanism’s input data must consist of an integral number of blocks). If these constraints are not satisfied, then The plain text and ciphertext can be in the same place, that is, it is OK if For most mechanisms, |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_Encrypt)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pEncryptedData,
CK_ULONG_PTR pulEncryptedDataLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_INVALID, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_EncryptUpdate, which is an implementation of PKCS #11 C_EncryptUpdate. | |
|---|---|---|
| Parameters |
message EncryptUpdateRequest {
bytes State = 1;
bytes Plain = 2;
}
message EncryptUpdateResponse {
bytes State = 1;
bytes Ciphered = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 The The |
|---|---|
| Parameters |
CK_RV m_EncryptUpdate (
unsigned char *state, size_t statelen,
CK_BYTE_PTR plain, CK_ULONG plainlen,
CK_BYTE_PTR ciphered, CK_ULONG_PTR cipheredlen,
target_t target
);
|
| Return values | A subset of C_EncryptUpdate return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The encryption operation must be initialized with The |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_EncryptUpdate)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pPart,
CK_ULONG ulPartLen,
CK_BYTE_PTR pEncryptedPart,
CK_ULONG_PTR pulEncryptedPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_EncryptFinal, which is an implementation of PKCS #11 C_EncryptFinal. | |
|---|---|---|
| Parameters |
message EncryptFinalRequest {
bytes State = 1;
}
message EncryptFinalResponse {
bytes Ciphered = 2;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Does not update The The |
|---|---|
| Parameters |
CK_RV m_EncryptFinal (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR ciphered, CK_ULONG_PTR cipheredlen,
target_t target
);
|
| Return values | A subset of C_EncryptFinal return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The encryption operation must be initialized with For some multi-part encryption mechanisms, the input plain text data has certain length constraints because the mechanism’s input data must consist of an integral number of blocks. If these constraints are not satisfied, then |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_EncryptFinal)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pLastEncryptedPart,
CK_ULONG_PTR pulLastEncryptedPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_EncryptSingle | |
|---|---|---|
| Parameters |
message EncryptSingleRequest {
bytes Key = 1;
Mechanism Mech = 2;
bytes Plain = 3;
}
message EncryptSingleResponse {
bytes Ciphered = 4;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Non-standard variant of This is the preferred method of encrypting data in one pass for XCP-aware applications. Functionally it is equivalent to If the backend supports resident keys, the key can be also a resident-key handle. See also: The |
|---|---|
| Parameters |
CK_RV m_EncryptSingle (
const unsigned char *key, size_t keylen,
CK_MECHANISM_PTR mech,
CK_BYTE_PTR plain, CK_ULONG plainlen,
CK_BYTE_PTR ciphered, CK_ULONG_PTR cipheredlen,
target_t target
);
|
| Return values | A subset of C_Encrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description | Binds to EP11 m_ReencryptSingle. | |
|---|---|---|
| Parameters |
message ReencryptSingleRequest {
bytes DecKey = 1;
bytes EncKey = 2;
Mechanism DecMech = 3;
Mechanism EncMech = 4;
bytes Ciphered = 5;
}
message ReencryptSingleResponse {
bytes Reciphered = 6;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Non-standard variant of Decrypts data with the original key and then encrypts the raw data with a different key within the cloud HSM. |
|---|---|
| Parameters |
CK_RV m_ReencryptSingle (
const unsigned char *dkey, size_t dkeylen,
const unsigned char *ekey, size_t ekeylen,
CK_MECHANISM_PTR decmech,
CK_MECHANISM_PTR encmech,
CK_BYTE_PTR in, CK_ULONG inlen,
CK_BYTE_PTR ciphered, CK_ULONG_PTR cipheredlen,
target_t target
);
|
| Return values | A subset of C_Encrypt and C_Decrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description | Binds to EP11 m_DecryptInit, which is an implementation of PKCS #11 C_DecryptInit. | |
|---|---|---|
| Parameters |
message DecryptInitRequest {
Mechanism Mech = 2;
bytes Key = 3;
}
message DecryptInitResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 C_DecryptInit.
|
|---|---|
| Parameters |
CK_RV m_DecryptInit (
unsigned char *state, size_t *statelen,
CK_MECHANISM_PTR mech,
const unsigned char *key, size_t keylen,
target_t target
);
|
| Return values | A subset of C_DecryptInit return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The After the application calls |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DecryptInit)(
K_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_FUNCTION_NOT_PERMITTED, CKR_KEY_HANDLE_INVALID, CKR_KEY_SIZE_RANGE, CKR_KEY_TYPE_INCONSISTENT, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_Decrypt, which is an implementation of PKCS #11 C_Decrypt. | |
|---|---|---|
| Parameters |
message DecryptRequest {
bytes State = 1;
bytes Ciphered = 2;
}
message DecryptResponse {
bytes Plain = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 The state, slen binary large object (BLOB) must be mapped from the PKCS #11 |
|---|---|
| Parameters |
CK_RV m_Decrypt (const unsigned char *state, size_t slen,
CK_BYTE_PTR cipher, CK_ULONG clen,
CK_BYTE_PTR plain, CK_ULONG_PTR plen,
target_t target
);
|
| Return values | A subset of C_Decrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The decryption operation needs to be initialized with
The ciphertext and plain text can be in the same place, which means it is acceptable if pEncryptedData and pData point to the same location. If the input ciphertext data cannot be decrypted because it has an inappropriate length, either |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_Decrypt)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pEncryptedData,
CK_ULONG ulEncryptedDataLen,
CK_BYTE_PTR pData,
CK_ULONG_PTR pulDataLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_ENCRYPTED_DATA_INVALID, CKR_ENCRYPTED_DATA_LEN_RANGE, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_DecryptUpdate, which is an implementation of PKCS #11 C_DecryptUpdate. | |
|---|---|---|
| Parameters |
message DecryptUpdateRequest {
bytes State = 1;
bytes Ciphered = 2;
}
message DecryptUpdateResponse {
bytes State = 1;
bytes Plain = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 The The |
|---|---|
| Parameters |
CK_RV m_DecryptUpdate (
unsigned char *state, size_t statelen,
CK_BYTE_PTR ciphered, CK_ULONG cipheredlen,
CK_BYTE_PTR plain, CK_ULONG_PTR plainlen,
target_t target
);
|
| Return values | A subset of C_DecryptUpdate return values. For more information, see the Return valueschapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The decryption operation must be initialized with The ciphertext and plain text can be in the same place, that is, it is OK if |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DecryptUpdate)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pEncryptedPart,
CK_ULONG ulEncryptedPartLen,
CK_BYTE_PTR pPart,
CK_ULONG_PTR pulPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_FUNCTION_NOT_PERMITTED, CKR_KEY_HANDLE_INVALID, CKR_KEY_SIZE_RANGE, CKR_KEY_TYPE_INCONSISTENT, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_DecryptFinal, which is an implementation of PKCS #11 C_DecryptFinal. | |
|---|---|---|
| Parameters |
message DecryptFinalRequest {
bytes State = 1;
}
message DecryptFinalResponse {
bytes Plain = 2;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 Does not update The The |
|---|---|
| Parameters |
CK_RV m_DecryptFinal (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR plain, CK_ULONG_PTR plainlen,
target_t target
);
|
| Return values | A subset of C_DecryptFinal return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The decryption operation must be initialized with If the input ciphertext data cannot be decrypted because it has an inappropriate length, then either |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DecryptFinal)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pLastPart,
CK_ULONG_PTR pulLastPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_ENCRYPTED_DATA_INVALID, CKR_ENCRYPTED_DATA_LEN_RANGE, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_DecryptSingle. | |
|---|---|---|
| Parameters |
message DecryptSingleRequest {
bytes Key = 1;
Mechanism Mech = 2;
bytes Ciphered = 3;
}
message DecryptSingleResponse {
bytes Plain = 4;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Non-standard variant of This is the preferred method of encrypting data in one pass for XCP-aware applications. Functionally it is equivalent to If the backend supports resident keys, the key can be also a resident-key handle. See also: The |
|---|---|
| Parameters |
CK_RV m_DecryptSingle (
const unsigned char *key, size_t keylen,
CK_MECHANISM_PTR mech,
CK_BYTE_PTR ciphered, CK_ULONG cipheredlen,
CK_BYTE_PTR plain, CK_ULONG_PTR plainlen,
target_t target
);
|
| Return values | A subset of C_Decrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description | Binds to EP11 m_SignInit , which is an implementation of PKCS #11 C_SignInit. | |
|---|---|---|
| Parameters |
message SignInitRequest {
Mechanism Mech = 2;
bytes PrivKey = 3;
}
message SignInitResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 C_SignInit.
|
|---|---|
| Parameters |
CK_RV m_SignInit (
unsigned char *state, size_t *statelen,
CK_MECHANISM_PTR mech,
const unsigned char *privKey, size_t privKeylen,
target_t target
);
|
| Return values | A subset of C_Decrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The After the application calls |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_SignInit)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_FUNCTION_NOT_PERMITTED, CKR_KEY_HANDLE_INVALID, CKR_KEY_SIZE_RANGE, CKR_KEY_TYPE_INCONSISTENT, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_Sign, which is an implementation of PKCS #11 C_Sign. | |
|---|---|---|
| Parameters |
message SignRequest {
bytes State = 1;
bytes Data = 2;
}
message SignResponse {
bytes Signature = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Does not update The The |
|---|---|
| Parameters |
CK_RV m_Sign (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR data, CK_ULONG datalen,
CK_BYTE_PTR signature, CK_ULONG_PTR signaturelen,
target_t target
);
|
| Return values | A subset of C_Sign return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The signing operation must be initialized with
For most mechanisms, |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_Sign)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pSignature,
CK_ULONG_PTR pulSignatureLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_INVALID, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN, CKR_FUNCTION_REJECTED. |
| Description | Binds to EP11 m_SignUpdate, which is an implementation of PKCS #11 C_SignUpdate. | |
|---|---|---|
| Parameters |
message SignUpdateRequest {
bytes State = 1;
bytes Data = 2;
}
message SignUpdateResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 C_SignUpdate.
The The |
|---|---|
| Parameters |
CK_RV m_SignUpdate (
unsigned char *state, size_t statelen,
CK_BYTE_PTR data, CK_ULONG datalen,
target_t target
);
|
| Return values | A subset of C_SignUpdate return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The signature operation must be initialized with |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_SignUpdate)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pPart,
CK_ULONG ulPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_SignFinal, which is an implementation of PKCS #11 C_SignFinal. | |
|---|---|---|
| Parameters |
message SignFinalRequest {
bytes State = 1;
}
message SignFinalResponse {
bytes Signature = 2;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Does not update The The |
|---|---|
| Parameters |
CK_RV m_SignFinal (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR signature, CK_ULONG_PTR signaturelen,
target_t target
);
|
| Return values | A subset of C_SignFinal return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The signing operation must be initialized with |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_SignFinal)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pSignature,
CK_ULONG_PTR pulSignatureLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN, CKR_FUNCTION_REJECTED. |
| Description | Binds to EP11 m_SignSingle. | |
|---|---|---|
| Parameters |
message SignSingleRequest {
bytes PrivKey = 1;
Mechanism Mech = 2;
bytes Data = 3;
}
message SignSingleResponse {
bytes Signature = 4;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Nonstandard extension, combination of This is the preferred way of signing, without an extra roundtrip, encryption, and decryption. Functionally, The Multi-data requests for HMAC and CMAC signatures are supported (subvariants 2 and 3). See also: |
|---|---|
| Parameters |
CK_RV m_SignSingle (
const unsigned char *privKey, size_t privKeylen,
CK_MECHANISM_PTR mech,
CK_BYTE_PTR data, CK_ULONG datalen,
CK_BYTE_PTR signature, CK_ULONG_PTR signaturelen,
target_t target
);
|
| Return values | A subset of C_Decrypt return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description | Binds to EP11 m_VerifyInit, which is an implementation of PKCS #11 C_VerifyInit. | |
|---|---|---|
| Parameters |
message VerifyInitRequest {
Mechanism Mech = 2;
bytes PubKey = 3;
}
message VerifyInitResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 For public-key mechanisms, If an HMAC operation is initialized, session restrictions of the The Note: |
|---|---|
| Parameters |
CK_RV m_VerifyInit (
unsigned char *state, size_t *statelen,
CK_MECHANISM_PTR mech,
const unsigned char *pubKey, size_t pubKeylen,
target_t target
);
|
| Return values | A subset of C_VerifyInit return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The After the application calls |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_VerifyInit)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_KEY_FUNCTION_NOT_PERMITTED, CKR_KEY_HANDLE_INVALID, CKR_KEY_SIZE_RANGE, CKR_KEY_TYPE_INCONSISTENT, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_Verify, which is an implementation of PKCS #11 C_Verify. | |
|---|---|---|
| Parameters |
message VerifyRequest {
bytes State = 1;
bytes Data = 2;
bytes Signature = 3;
}
message VerifyResponse {
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Does not update The relative order of data and signature are reversed relative
to The The |
|---|---|
| Parameters |
CK_RV m_Verify (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR data, CK_ULONG datalen,
CK_BYTE_PTR signature, CK_ULONG signaturelen,
target_t target
);
|
| Return values | A subset of C_Verify return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The verification operation must be initialized with A successful call to
For most mechanisms, |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_Verify)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pSignature,
CK_ULONG ulSignatureLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_INVALID, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SIGNATURE_INVALID, CKR_SIGNATURE_LEN_RANGE. |
| Description | Binds to EP11 m_VerifyUpdate, which is an implementation of PKCS #11 C_VerifyUpdate. | |
|---|---|---|
| Parameters |
message VerifyUpdateRequest {
bytes State = 1;
bytes Data = 2;
}
message VerifyUpdateResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 The The |
|---|---|
| Parameters |
CK_RV m_VerifyUpdate (
unsigned char *state, size_t statelen,
CK_BYTE_PTR data, CK_ULONG datalen,
target_t target
);
|
| Return values | A subset of C_VerifyUpdate return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The verification operation must be initialized with |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_VerifyUpdate)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pPart,
CK_ULONG ulPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_VerifyFinal, which is an implementation of PKCS #11 C_VerifyFinal. | |
|---|---|---|
| Parameters |
message VerifyFinalRequest {
bytes State = 1;
bytes Signature = 2;
}
message VerifyFinalResponse {
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 Does not update The The |
|---|---|
| Parameters |
CK_RV m_VerifyFinal (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR signature, CK_ULONG signaturelen,
target_t target
);
|
| Return values | A subset of C_VerifyFinal return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The verification operation must be initialized with A successful call to |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_VerifyFinal)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pSignature,
CK_ULONG ulSignatureLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DATA_LEN_RANGE, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SIGNATURE_INVALID, CKR_SIGNATURE_LEN_RANGE. |
| Description | Binds to EP11 m_VerifySingle. | |
|---|---|---|
| Parameters |
message VerifySingleRequest {
bytes PubKey = 1;
Mechanism Mech = 2;
bytes Data = 3;
bytes Signature = 4;
}
message VerifySingleResponse {
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Nonstandard extension, combination of This is the preferred way of verifying a signature, without an extra roundtrip, encryption, decryption. Functionally, The For public-key mechanisms, See also: |
|---|---|
| Parameters |
CK_RV m_VerifySingle (
const unsigned char *pubKey, size_t pubKeylen,
CK_MECHANISM_PTR mech,
CK_BYTE_PTR data, CK_ULONG datalen,
CK_BYTE_PTR signature, CK_ULONG signaturelen,
target_t target
);
|
| Return values | A subset of C_VerifySingle return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description | Binds to EP11 m_DigestInit, which is an implementation of PKCS #11 C_DigestInit. | |
|---|---|---|
| Parameters |
message DigestInitRequest {
Mechanism Mech = 2;
}
message DigestInitResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11 Create wrapped digest state. Note: size queries are supported, but the wrapped state is always returned by the backend, unlike most size queries (which return an output size, instead of actual output). During size queries, the host just discards the returned state, and reports blob size (in The |
|---|---|
| Parameters |
CK_RV m_DigestInit (
unsigned char *state, size_t *len,
const CK_MECHANISM_PTR mech,
target_t target
);
|
| Return values | A subset of C_DigestInit return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
After the application calls |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DigestInit)(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_MECHANISM_INVALID, CKR_MECHANISM_PARAM_INVALID, CKR_OK, CKR_OPERATION_ACTIVE, CKR_PIN_EXPIRED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_USER_NOT_LOGGED_IN. |
| Description | Binds to EP11 m_Digest, which is an implementation of PKCS #11 C_Digest. | |
|---|---|---|
| Parameters |
message DigestRequest {
bytes State = 1;
bytes Data = 2;
}
message DigestResponse {
bytes Digest = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11 If a digest object has exactly 0 (zero) bytes that are appended to it after creation, in any combination of zero-byte transfers, it can still perform a one-pass Digest, even if it needs to be rejected by a strict implementation. Does not update Implementations might perform
The |
|---|---|
| Parameters |
CK_RV m_Digest (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR data, CK_ULONG datalen,
CK_BYTE_PTR digest, CK_ULONG_PTR digestlen,
target_t target
);
|
| Return values | A subset of C_Digest return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The digest operation must be initialized with
The input data and digest output can be in the same place, that is, it is OK if pData and pDigest point to the same location.
|
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_Digest)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pDigest,
CK_ULONG_PTR pulDigestLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_DigestUpdate, which is an implementation of PKCS #11 C_DigestUpdate. | |
|---|---|---|
| Parameters |
message DigestUpdateRequest {
bytes State = 1;
bytes Data = 2;
}
message DigestUpdateResponse {
bytes State = 1;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Implementation of PKCS #11
The The See also: |
|---|---|
| Parameters |
CK_RV m_DigestUpdate (
unsigned char *state, size_t statelen,
CK_BYTE_PTR data, CK_ULONG datalen,
target_t target
);
|
| Return values | A subset of C_DigestUpdate return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The message-digesting operation must be initialized with |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DigestUpdate)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pPart,
CK_ULONG ulPartLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_DigestFinal, which is an implementation of PKCS #11 C_DigestFinal. | |
|---|---|---|
| Parameters |
message DigestFinalRequest {
bytes State = 1;
}
message DigestFinalResponse {
bytes Digest = 2;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description | Implementation of PKCS #11
Does not update The The |
|---|---|
| Parameters |
CK_RV m_DigestFinal (
const unsigned char *state, size_t statelen,
CK_BYTE_PTR digest, CK_ULONG_PTR digestlen,
target_t target
);
|
| Return values | A subset of C_DigestFinal return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |
| Description |
The digest operation must be initialized with |
|---|---|
| Parameters |
CK_DEFINE_FUNCTION(CK_RV, C_DigestFinal)(
CK_SESSION_HANDLE hSession,
CK_BYTE_PTR pDigest,
CK_ULONG_PTR pulDigestLen
);
|
| Return values | CKR_ARGUMENTS_BAD, CKR_BUFFER_TOO_SMALL, CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY, CKR_DEVICE_REMOVED, CKR_FUNCTION_CANCELED, CKR_FUNCTION_FAILED, CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_OPERATION_NOT_INITIALIZED, CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID. |
| Description | Binds to EP11 m_DigestSingle. | |
|---|---|---|
| Parameters |
message DigestSingleRequest {
Mechanism Mech = 1;
bytes Data = 2;
}
message DigestSingleResponse {
bytes Digest = 3;
}
|
|
| Return values | Wraps EP11 error into message Grep11Error. |
| Description |
Nonstandard extension, combination of This is the preferred method of digesting cleartext for XCP-aware applications. Functionally, If a key needs to be digested, one must use Does not return any state to host, only digest result. There are no non-PKCS #11 parameters, since everything is used directly from the PKCS #11 call. |
|---|---|
| Parameters |
CK_RV m_DigestSingle (
CK_MECHANISM_PTR mech,
CK_BYTE_PTR data, CK_ULONG datalen,
CK_BYTE_PTR digest, CK_ULONG_PTR digestlen,
target_t target
);
|
| Return values | A subset of C_DigestSingle return values. For more information, see the Return values chapter of the Enterprise PKCS #11 (EP11) Library structure document. |