From 6655c155cfb81ce2e22efdd98a79b858ad655d66 Mon Sep 17 00:00:00 2001 From: Joao Henrique Date: Tue, 1 Jul 2025 21:31:10 -0300 Subject: [PATCH 01/21] feat: add initial dockerfile do easier the build feat: temporary commit with cache feat: remove cache --- Dockerfile | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..3e0a1bff0 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,42 @@ +FROM ubuntu:24.04 AS softhsm_builder + +RUN apt update && \ + apt install -y \ + automake \ + autoconf \ + libtool \ + pkg-config \ + openssl \ + libbotan-2-dev \ + make \ + g++ \ + libssl-dev \ + libsqlite3-dev \ + libp11-kit-dev \ + libcppunit-dev \ + sudo \ + git + +WORKDIR /app +COPY . /app + +RUN sh autogen.sh + +RUN ./configure --with-objectstore-backend-db --disable-gost --enable-eddsa --enable-ecc --with-crypto-backend=openssl + +RUN make +# Tests +# RUN make check + +RUN make install + +# If needed, the conf file definitions goes here. +# about conf file: man softhsm2.conf + +RUN mkdir -p /var/lib/softhsm/tokens/ + +RUN softhsm2-util --init-token --slot 0 --label "My SoftHSM Token" --so-pin 0000 --pin 0000 + +RUN apt install -y opensc opensc-pkcs11 + +CMD ["bash"] From af467c34530416c2c60c560bc20444d0a35e2033 Mon Sep 17 00:00:00 2001 From: Joao Henrique Date: Thu, 14 Aug 2025 22:13:17 -0300 Subject: [PATCH 02/21] feat: using openssl 3.5.1 to build softhsmv2 --- Dockerfile | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index 3e0a1bff0..48a9d5eef 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,16 +1,47 @@ +FROM ubuntu:24.04 AS openssl_builder + +RUN apt update && \ + apt install -y \ + build-essential \ + make \ + libtext-template-perl \ + wget \ + git && \ + rm -rf /var/lib/apt/lists/* + +WORKDIR /crypt + +RUN wget https://github.com/openssl/openssl/archive/refs/tags/openssl-3.5.1.tar.gz && \ + mkdir openssl && \ + tar -xvf openssl-3.5.1.tar.gz -C openssl --strip-components=1 && \ + rm openssl-3.5.1.tar.gz + +WORKDIR /crypt/openssl + +RUN ./config --prefix=/usr/local --openssldir=/usr/local/ssl -Wl,-rpath=/usr/local/lib && \ + make -j$(nproc) && \ + make install + FROM ubuntu:24.04 AS softhsm_builder +COPY --from=openssl_builder /usr/local/bin/openssl /usr/local/bin/ +COPY --from=openssl_builder /usr/local/lib64/ /usr/local/lib64/ +COPY --from=openssl_builder /usr/local/ssl/ /usr/local/ssl/ +COPY --from=openssl_builder /usr/local/include/ /usr/local/include/ + +RUN echo '/usr/local/lib64' > /etc/ld.so.conf.d/openssl.conf && \ + ldconfig + +ENV LD_LIBRARY_PATH=/usr/local/lib64 + RUN apt update && \ apt install -y \ automake \ autoconf \ libtool \ pkg-config \ - openssl \ - libbotan-2-dev \ make \ g++ \ - libssl-dev \ libsqlite3-dev \ libp11-kit-dev \ libcppunit-dev \ @@ -25,8 +56,6 @@ RUN sh autogen.sh RUN ./configure --with-objectstore-backend-db --disable-gost --enable-eddsa --enable-ecc --with-crypto-backend=openssl RUN make -# Tests -# RUN make check RUN make install From 4fa5d9c606768ada11b5d2e40318d07ba6beceb7 Mon Sep 17 00:00:00 2001 From: Joao Henrique Date: Thu, 21 Aug 2025 22:43:30 -0300 Subject: [PATCH 03/21] chore: dockerfile remove ecc keys, enable only eddsa --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 48a9d5eef..64c279367 100644 --- a/Dockerfile +++ b/Dockerfile @@ -53,7 +53,7 @@ COPY . /app RUN sh autogen.sh -RUN ./configure --with-objectstore-backend-db --disable-gost --enable-eddsa --enable-ecc --with-crypto-backend=openssl +RUN ./configure --with-objectstore-backend-db --disable-gost --enable-eddsa --with-crypto-backend=openssl RUN make From 48e8cc6c9633197e993b3fb09522e88f6cef11a4 Mon Sep 17 00:00:00 2001 From: Joao Henrique Date: Thu, 28 Aug 2025 21:37:42 -0300 Subject: [PATCH 04/21] fix: install opensc and pkcs11 at begining --- Dockerfile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 64c279367..67435f02a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -46,7 +46,8 @@ RUN apt update && \ libp11-kit-dev \ libcppunit-dev \ sudo \ - git + opensc \ + opensc-pkcs11 WORKDIR /app COPY . /app @@ -66,6 +67,4 @@ RUN mkdir -p /var/lib/softhsm/tokens/ RUN softhsm2-util --init-token --slot 0 --label "My SoftHSM Token" --so-pin 0000 --pin 0000 -RUN apt install -y opensc opensc-pkcs11 - CMD ["bash"] From ae0a50ec4ab9b2e74b376170a0cf5f796b6e0b4e Mon Sep 17 00:00:00 2001 From: Joao Henrique Date: Tue, 4 Nov 2025 22:56:53 -0300 Subject: [PATCH 05/21] docs: remove logs used on exploratory process removed logs used to learn about how softhsm handle crypto algorithms --- src/lib/P11Objects.cpp | 8 ---- src/lib/SoftHSM.cpp | 67 ---------------------------- src/lib/crypto/OSSLSLHDSA.cpp | 8 ---- src/lib/crypto/OSSLSLHPrivateKey.cpp | 1 - src/lib/crypto/OSSLSLHPublicKey.cpp | 1 - 5 files changed, 85 deletions(-) diff --git a/src/lib/P11Objects.cpp b/src/lib/P11Objects.cpp index f3a83e5d7..4b15556a7 100644 --- a/src/lib/P11Objects.cpp +++ b/src/lib/P11Objects.cpp @@ -189,12 +189,10 @@ CK_RV P11Object::loadTemplate(Token *token, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG // Save template CK_RV P11Object::saveTemplate(Token *token, bool isPrivate, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulAttributeCount, int op) { - INFO_MSG("INIT saveTemplate, OBJECT_OP_GENERATE %d, isPrivate %d", OBJECT_OP_GENERATE == op,isPrivate) if (osobject == NULL) return CKR_GENERAL_ERROR; if (osobject->startTransaction() == false) return CKR_GENERAL_ERROR; - INFO_MSG("osobject is not NULL and started transaction OK") if (op == OBJECT_OP_SET) { @@ -300,8 +298,6 @@ CK_RV P11Object::saveTemplate(Token *token, bool isPrivate, CK_ATTRIBUTE_PTR pTe { return CKR_GENERAL_ERROR; } - - INFO_MSG("END saveTemplate") return CKR_OK; } @@ -944,7 +940,6 @@ P11SLHPublicKeyObj::P11SLHPublicKeyObj() // Add attributes bool P11SLHPublicKeyObj::init(OSObject *inobject) { - INFO_MSG("INIT P11SLHPublicKeyObj"); if (initialized) return true; if (inobject == NULL) return false; @@ -978,7 +973,6 @@ bool P11SLHPublicKeyObj::init(OSObject *inobject) attributes[attrValue->getType()] = attrValue; initialized = true; - INFO_MSG("END P11SLHPublicKeyObj"); return true; } @@ -1396,7 +1390,6 @@ P11SLHPrivateKeyObj::P11SLHPrivateKeyObj() // Add attributes bool P11SLHPrivateKeyObj::init(OSObject *inobject) { - INFO_MSG("INIT P11SLHPrivateKeyObj"); if (initialized) return true; if (inobject == NULL) return false; @@ -1430,7 +1423,6 @@ bool P11SLHPrivateKeyObj::init(OSObject *inobject) attributes[attrValue->getType()] = attrValue; initialized = true; - INFO_MSG("END P11SLHPrivateKeyObj"); return true; } diff --git a/src/lib/SoftHSM.cpp b/src/lib/SoftHSM.cpp index b13bc01fa..2ada1e55f 100644 --- a/src/lib/SoftHSM.cpp +++ b/src/lib/SoftHSM.cpp @@ -233,7 +233,6 @@ static CK_RV extractObjectInformation(CK_ATTRIBUTE_PTR pTemplate, case CKA_CLASS: if (pTemplate[i].ulValueLen == sizeof(CK_OBJECT_CLASS)) { - INFO_MSG("Extracted CKA_CLASS"); objClass = *(CK_OBJECT_CLASS_PTR)pTemplate[i].pValue; bHasClass = true; } @@ -241,7 +240,6 @@ static CK_RV extractObjectInformation(CK_ATTRIBUTE_PTR pTemplate, case CKA_KEY_TYPE: if (pTemplate[i].ulValueLen == sizeof(CK_KEY_TYPE)) { - INFO_MSG("Extracted CKA_KEY_TYPE"); keyType = *(CK_KEY_TYPE*)pTemplate[i].pValue; bHasKeyType = true; } @@ -249,7 +247,6 @@ static CK_RV extractObjectInformation(CK_ATTRIBUTE_PTR pTemplate, case CKA_CERTIFICATE_TYPE: if (pTemplate[i].ulValueLen == sizeof(CK_CERTIFICATE_TYPE)) { - INFO_MSG("Extracted CKA_CERTIFICATE_TYPE"); certType = *(CK_CERTIFICATE_TYPE*)pTemplate[i].pValue; bHasCertType = true; } @@ -257,14 +254,12 @@ static CK_RV extractObjectInformation(CK_ATTRIBUTE_PTR pTemplate, case CKA_TOKEN: if (pTemplate[i].ulValueLen == sizeof(CK_BBOOL)) { - INFO_MSG("Extracted CKA_TOKEN"); isOnToken = *(CK_BBOOL*)pTemplate[i].pValue; } break; case CKA_PRIVATE: if (pTemplate[i].ulValueLen == sizeof(CK_BBOOL)) { - INFO_MSG("Extracted CKA_PRIVATE"); isPrivate = *(CK_BBOOL*)pTemplate[i].pValue; bHasPrivate = true; } @@ -274,9 +269,6 @@ static CK_RV extractObjectInformation(CK_ATTRIBUTE_PTR pTemplate, } } - INFO_MSG("(class = %d, key_type = %d, cert_type = %d, private = %d, isOnToken=%d, isPrivate=%d)", - bHasClass, bHasKeyType, bHasCertType, bHasPrivate, isOnToken, isPrivate); - if (bImplicit) { return CKR_OK; @@ -4148,7 +4140,6 @@ CK_RV SoftHSM::MacSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechani // AsymmetricAlgorithm version of C_SignInit CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey) { - INFO_MSG("here init signature") if (!isInitialised) return CKR_CRYPTOKI_NOT_INITIALIZED; if (pMechanism == NULL_PTR) return CKR_ARGUMENTS_BAD; @@ -4704,7 +4695,6 @@ static CK_RV MacSign(Session* session, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK // AsymmetricAlgorithm version of C_Sign static CK_RV AsymSign(Session* session, CK_BYTE_PTR pData, CK_ULONG ulDataLen, CK_BYTE_PTR pSignature, CK_ULONG_PTR pulSignatureLen) { - INFO_MSG("here signs the message") AsymmetricAlgorithm* asymCrypto = session->getAsymmetricCryptoOp(); AsymMech::Type mechanism = session->getMechanism(); PrivateKey* privateKey = session->getPrivateKey(); @@ -4777,7 +4767,6 @@ static CK_RV AsymSign(Session* session, CK_BYTE_PTR pData, CK_ULONG ulDataLen, C *pulSignatureLen = size; session->resetOp(); - INFO_MSG("Signature finished."); return CKR_OK; } @@ -5603,7 +5592,6 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech #ifdef WITH_SLHDSA else if (isSLHDSA) { - INFO_MSG("INIT take SLH-DSA public key."); asymCrypto = CryptoFactory::i()->getAsymmetricAlgorithm(AsymAlgo::SLHDSA); if (asymCrypto == NULL) return CKR_MECHANISM_INVALID; @@ -5620,7 +5608,6 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech CryptoFactory::i()->recycleAsymmetricAlgorithm(asymCrypto); return CKR_GENERAL_ERROR; } - INFO_MSG("END take SLH-DSA public key."); } #endif else @@ -5663,7 +5650,6 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech session->setAllowSinglePartOp(true); session->setPublicKey(publicKey); - INFO_MSG("END AsymVerifyInit."); return CKR_OK; } @@ -6249,7 +6235,6 @@ CK_RV SoftHSM::C_GenerateKeyPair CK_BBOOL ispublicKeyToken = CK_FALSE; CK_BBOOL ispublicKeyPrivate = CK_FALSE; bool isPublicKeyImplicit = true; - INFO_MSG("INIT public key extractObjectInformation (CKM_SLH_KEY_PAIR_GEN, CKK_SLHDSA)"); extractObjectInformation(pPublicKeyTemplate, ulPublicKeyAttributeCount, publicKeyClass, keyType, dummy, ispublicKeyToken, ispublicKeyPrivate, isPublicKeyImplicit); // Report errors caused by accidental template mix-ups in the application using this cryptoki lib. @@ -6270,14 +6255,12 @@ CK_RV SoftHSM::C_GenerateKeyPair if (pMechanism->mechanism == CKM_SLH_KEY_PAIR_GEN && keyType != CKK_SLHDSA) return CKR_TEMPLATE_INCONSISTENT; - INFO_MSG("END public key extractObjectInformation (CKM_SLH_KEY_PAIR_GEN, CKK_SLHDSA)"); // Extract information from the private key template that is needed to create the object. CK_OBJECT_CLASS privateKeyClass = CKO_PRIVATE_KEY; CK_BBOOL isprivateKeyToken = CK_FALSE; CK_BBOOL isprivateKeyPrivate = CK_TRUE; bool isPrivateKeyImplicit = true; - INFO_MSG("INIT private key extractObjectInformation (CKM_SLH_KEY_PAIR_GEN, CKK_SLHDSA)"); extractObjectInformation(pPrivateKeyTemplate, ulPrivateKeyAttributeCount, privateKeyClass, keyType, dummy, isprivateKeyToken, isprivateKeyPrivate, isPrivateKeyImplicit); // Report errors caused by accidental template mix-ups in the application using this cryptoki lib. @@ -6297,7 +6280,6 @@ CK_RV SoftHSM::C_GenerateKeyPair return CKR_TEMPLATE_INCONSISTENT; if (pMechanism->mechanism == CKM_SLH_KEY_PAIR_GEN && keyType != CKK_SLHDSA) return CKR_TEMPLATE_INCONSISTENT; - INFO_MSG("END private key extractObjectInformation (CKM_SLH_KEY_PAIR_GEN, CKK_SLHDSA)"); // Check user credentials CK_RV rv = haveWrite(session->getState(), ispublicKeyToken || isprivateKeyToken, ispublicKeyPrivate || isprivateKeyPrivate); @@ -10115,8 +10097,6 @@ CK_RV SoftHSM::generateSLH break; } } - INFO_MSG("Extracted public key params <%s>", params.const_byte_str()); - // The parameters must be specified to be able to generate a key pair. if (params.size() == 0) { @@ -10127,7 +10107,6 @@ CK_RV SoftHSM::generateSLH // Set the parameters SLHParameters p; p.setName(params); - INFO_MSG("seted params for SLH-DSA"); // Generate key pair AsymmetricKeyPair* kp = NULL; @@ -10140,10 +10119,8 @@ CK_RV SoftHSM::generateSLH return CKR_GENERAL_ERROR; } - INFO_MSG("INIT Get Public/Private Key"); SLHPublicKey* pub = (SLHPublicKey*) kp->getPublicKey(); SLHPrivateKey* priv = (SLHPrivateKey*) kp->getPrivateKey(); - INFO_MSG("END Get Public/Private Key"); CK_RV rv = CKR_OK; @@ -10180,15 +10157,12 @@ CK_RV SoftHSM::generateSLH if (rv == CKR_OK) { - INFO_MSG("INIT PublicKey CreateObject"); rv = this->CreateObject(hSession,publicKeyAttribs,publicKeyAttribsCount,phPublicKey,OBJECT_OP_GENERATE); - INFO_MSG("END PublicKey CreateObject"); } // Store the attributes that are being supplied by the key generation to the object if (rv == CKR_OK) { - INFO_MSG("INIT PublicKey STORING"); OSObject* osobject = (OSObject*)handleManager->getObject(*phPublicKey); if (osobject == NULL_PTR || !osobject->isValid()) { rv = CKR_FUNCTION_FAILED; @@ -10221,7 +10195,6 @@ CK_RV SoftHSM::generateSLH rv = CKR_FUNCTION_FAILED; } else rv = CKR_FUNCTION_FAILED; - INFO_MSG("END PublicKey STORING"); } } @@ -10256,15 +10229,12 @@ CK_RV SoftHSM::generateSLH if (rv == CKR_OK) { - INFO_MSG("INIT PrivateKey CreateObject"); rv = this->CreateObject(hSession,privateKeyAttribs,privateKeyAttribsCount,phPrivateKey,OBJECT_OP_GENERATE); - INFO_MSG("END PrivateKey CreateObject"); } // Store the attributes that are being supplied by the key generation to the object if (rv == CKR_OK) { - INFO_MSG("INIT PrivateKey STORING"); OSObject* osobject = (OSObject*)handleManager->getObject(*phPrivateKey); if (osobject == NULL_PTR || !osobject->isValid()) { rv = CKR_FUNCTION_FAILED; @@ -10303,7 +10273,6 @@ CK_RV SoftHSM::generateSLH rv = CKR_FUNCTION_FAILED; } else rv = CKR_FUNCTION_FAILED; - INFO_MSG("END PrivateKey STORING"); } } @@ -12640,33 +12609,24 @@ CK_RV SoftHSM::deriveSymmetric CK_RV SoftHSM::CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, CK_OBJECT_HANDLE_PTR phObject, int op) { - INFO_MSG("INIT CreateObject"); - if (!isInitialised) return CKR_CRYPTOKI_NOT_INITIALIZED; - INFO_MSG("isInitialised OK"); if (pTemplate == NULL_PTR) return CKR_ARGUMENTS_BAD; - INFO_MSG("template OK"); if (phObject == NULL_PTR) return CKR_ARGUMENTS_BAD; - INFO_MSG("phObject OK"); // Get the session Session* session = (Session*)handleManager->getSession(hSession); if (session == NULL) return CKR_SESSION_HANDLE_INVALID; - INFO_MSG("session OK"); // Get the slot Slot* slot = session->getSlot(); if (slot == NULL_PTR) return CKR_GENERAL_ERROR; - INFO_MSG("slot OK"); // Get the token Token* token = session->getToken(); if (token == NULL_PTR) return CKR_GENERAL_ERROR; - INFO_MSG("token OK"); // Extract information from the template that is needed to create the object. - INFO_MSG("INIT wheird extraction with RSA"); CK_OBJECT_CLASS objClass = CKO_DATA; CK_KEY_TYPE keyType = CKK_RSA; CK_CERTIFICATE_TYPE certType = CKC_X_509; @@ -12679,7 +12639,6 @@ CK_RV SoftHSM::CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTempla ERROR_MSG("Mandatory attribute not present in template"); return rv; } - INFO_MSG("END wheird extraction with RSA"); // Check user credentials rv = haveWrite(session->getState(), isOnToken, isPrivate); @@ -12692,9 +12651,6 @@ CK_RV SoftHSM::CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTempla return rv; } - INFO_MSG("checked user credentials OK"); - - INFO_MSG("INIT change order of attributes"); // Change order of attributes const CK_ULONG maxAttribs = 32; CK_ATTRIBUTE attribs[maxAttribs]; @@ -12710,55 +12666,38 @@ CK_RV SoftHSM::CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTempla switch (pTemplate[i].type) { case CKA_CHECK_VALUE: - INFO_MSG("CKA_CHECK_VALUE found"); saveAttribs[saveAttribsCount++] = pTemplate[i]; break; default: - INFO_MSG("DEFAULT found"); attribs[attribsCount++] = pTemplate[i]; } } for (CK_ULONG i=0; i < saveAttribsCount; i++) - { - INFO_MSG("saveAttrib appended to attribs"); attribs[attribsCount++] = saveAttribs[i]; - } - INFO_MSG("END change order of attributes"); - - INFO_MSG("objClass = %d, eq CKO_PRIVATE_KEY = %d, eq CKO_PUBLIC_KEY = %d", objClass, objClass == CKO_PRIVATE_KEY, objClass == CKO_PUBLIC_KEY) P11Object* p11object = NULL; rv = newP11Object(objClass,keyType,certType,&p11object); if (rv != CKR_OK) return rv; - INFO_MSG("created newP11Object OK") // Create the object in session or on the token OSObject *object = NULL_PTR; if (isOnToken) - { - INFO_MSG("try create object on TOKEN") object = (OSObject*) token->createObject(); - } else - { - INFO_MSG("try create object on SESSION") object = sessionObjectStore->createObject(slot->getSlotID(), hSession, isPrivate != CK_FALSE); - } if (object == NULL || !p11object->init(object)) { delete p11object; return CKR_GENERAL_ERROR; } - INFO_MSG("created object OK") rv = p11object->saveTemplate(token, isPrivate != CK_FALSE, attribs,attribsCount,op); delete p11object; if (rv != CKR_OK) return rv; - INFO_MSG("saveTemplate OK") if (op == OBJECT_OP_CREATE) { if (objClass == CKO_PUBLIC_KEY && @@ -12782,14 +12721,11 @@ CK_RV SoftHSM::CreateObject(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTempla if (isOnToken) { - INFO_MSG("add object on token") *phObject = handleManager->addTokenObject(slot->getSlotID(), isPrivate != CK_FALSE, object); } else { - INFO_MSG("add object on session") *phObject = handleManager->addSessionObject(slot->getSlotID(), hSession, isPrivate != CK_FALSE, object); } - INFO_MSG("END CreateObject"); return CKR_OK; } @@ -13141,10 +13077,7 @@ CK_RV SoftHSM::getSLHPublicKey(SLHPublicKey* publicKey, Token* token, OSObject* value = key->getByteStringValue(CKA_SLHDSA_PARAMS); } - INFO_MSG("INIT setDerPublicKey"); publicKey->setDerPublicKey(value); - INFO_MSG("END setDerPublicKey"); - return CKR_OK; } diff --git a/src/lib/crypto/OSSLSLHDSA.cpp b/src/lib/crypto/OSSLSLHDSA.cpp index 53d6bd1c5..049f9d641 100644 --- a/src/lib/crypto/OSSLSLHDSA.cpp +++ b/src/lib/crypto/OSSLSLHDSA.cpp @@ -134,7 +134,6 @@ bool OSSLSLHDSA::verify(PublicKey* publicKey, const ByteString& originalData, const ByteString& signature, const AsymMech::Type mechanism, const void* /* param = NULL */, const size_t /* paramLen = 0 */) { - INFO_MSG("Init verify"); if (mechanism != AsymMech::SLHDSA) { ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); @@ -250,7 +249,6 @@ bool OSSLSLHDSA::generateKeyPair(AsymmetricKeyPair** ppKeyPair, AsymmetricParame SLHParameters* params = (SLHParameters*) parameters; const unsigned char* name = params->getName().const_byte_str(); - INFO_MSG("SLH-DSA name: <%s>", name); // Generate the key-pair EVP_PKEY* pkey = NULL; @@ -258,7 +256,6 @@ bool OSSLSLHDSA::generateKeyPair(AsymmetricKeyPair** ppKeyPair, AsymmetricParame if (ctx == NULL) { ERROR_MSG("Failed to instantiate OpenSSL SLHDSA context"); - return false; } int ret = EVP_PKEY_keygen_init(ctx); @@ -280,13 +277,8 @@ bool OSSLSLHDSA::generateKeyPair(AsymmetricKeyPair** ppKeyPair, AsymmetricParame // Create an asymmetric key-pair object to return OSSLSLHKeyPair* kp = new OSSLSLHKeyPair(); - INFO_MSG("INIT PublicKey.setFromOSSL"); ((OSSLSLHPublicKey*) kp->getPublicKey())->setFromOSSL(pkey); - INFO_MSG("END PublicKey.setFromOSSL"); - - INFO_MSG("INIT Private.setFromOSSL"); ((OSSLSLHPrivateKey*) kp->getPrivateKey())->setFromOSSL(pkey); - INFO_MSG("END Private.setFromOSSL"); *ppKeyPair = kp; diff --git a/src/lib/crypto/OSSLSLHPrivateKey.cpp b/src/lib/crypto/OSSLSLHPrivateKey.cpp index 2946ca8d0..043296bc5 100644 --- a/src/lib/crypto/OSSLSLHPrivateKey.cpp +++ b/src/lib/crypto/OSSLSLHPrivateKey.cpp @@ -77,7 +77,6 @@ unsigned long OSSLSLHPrivateKey::getOrderLength() const size_t name_len = strnlen(name, 100); size_t signature_size = 0; - INFO_MSG("name %s", name); if (strncmp(&name[name_len - 4], "128s", 4) == 0) { signature_size = 7856; } else if (strncmp(&name[name_len - 4], "128f", 4) == 0) { diff --git a/src/lib/crypto/OSSLSLHPublicKey.cpp b/src/lib/crypto/OSSLSLHPublicKey.cpp index fc782eb26..cb1790090 100644 --- a/src/lib/crypto/OSSLSLHPublicKey.cpp +++ b/src/lib/crypto/OSSLSLHPublicKey.cpp @@ -76,7 +76,6 @@ unsigned long OSSLSLHPublicKey::getOrderLength() const size_t name_len = strnlen(name, 100); size_t signature_size = 0; - INFO_MSG("name %s", name); if (strncmp(&name[name_len - 4], "128s", 4) == 0) { signature_size = 7856; } else if (strncmp(&name[name_len - 4], "128f", 4) == 0) { From ddfc8757fc69f2889cc54ab107701ee9f4de6c1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Henrique?= <42558165+JoaoHenrique12@users.noreply.github.com> Date: Thu, 11 Sep 2025 22:05:45 -0300 Subject: [PATCH 06/21] feat: duplicate eddsa (#2) * feat: duplicate m4 files, still using NID from EDDSA Update dockerfile to use --with-slhdsa * feat: duplicate SLH(Public|Private)Key.(cpp|h) * feat: duplicate OSSLSLH(Public|Private)Key.(cpp|h) * feat: duplicate OSSLSLHKeypair.(cpp|h) * feat: add SLHDSA mech and algo to AsymmetricAlgorithm.h * feat: duplicate OSSLSLHDSA.(cpp|h) * feat: duplicate on OSSLCryptoFactory.cpp * feat: OSSLUtil.(cpp|h), duplication by definition * feat: add duplicated files to crypto/CMakeLists.txt * feat: duplicate P11ED(Public|Private)KeyObj for slhdsa PTAL on EC params, update it later, CKK_EC_EDWARDS * feat: duplicate softhsm2-util-ossl.(cpp|h) * feat: duplicate SoftHSM.(cpp|h) * fix: force disable eddsa to avoid conflict with cases and tables * fix: compilation error by add crypto/Makefile.am cpp new files grep -r OSSLEDDSA * feat: add syslog to container * fix: key gen on SLH-DSA * fix: add default log level info * refactor: use separated pkcs constants (with same value) for slh-dsa * feat(pkcs11): add ibm implementation to access cryptographic tokens --- Dockerfile | 18 +- hpcs-pkcs11/README.md | 130 ++ hpcs-pkcs11/samples/ep11.h | 1858 ++++++++++++++++++++++ hpcs-pkcs11/samples/grep11.h | 25 + hpcs-pkcs11/samples/pkcs11-attrs.c | 872 +++++++++++ hpcs-pkcs11/samples/pkcs11-btc.c | 391 +++++ hpcs-pkcs11/samples/pkcs11-checksum.c | 497 ++++++ hpcs-pkcs11/samples/pkcs11-crypto.c | 394 +++++ hpcs-pkcs11/samples/pkcs11-dilithium.c | 213 +++ hpcs-pkcs11/samples/pkcs11-object.c | 225 +++ hpcs-pkcs11/samples/pkcs11-slhdsa.c | 331 ++++ hpcs-pkcs11/samples/pkcs11.h | 265 ++++ hpcs-pkcs11/samples/pkcs11f.h | 939 +++++++++++ hpcs-pkcs11/samples/pkcs11t.h | 2003 ++++++++++++++++++++++++ hpcs-pkcs11/samples/sample.h | 23 + m4/acx_crypto_backend.m4 | 30 + m4/acx_openssl_slhdsa.m4 | 44 + src/bin/dump/tables.h | 4 + src/bin/util/softhsm2-util-ossl.cpp | 202 +++ src/bin/util/softhsm2-util-ossl.h | 28 +- src/lib/P11Objects.cpp | 90 ++ src/lib/P11Objects.h | 26 + src/lib/SoftHSM.cpp | 434 ++++- src/lib/SoftHSM.h | 18 + src/lib/crypto/AsymmetricAlgorithm.h | 6 +- src/lib/crypto/CMakeLists.txt | 6 + src/lib/crypto/Makefile.am | 6 + src/lib/crypto/OSSLCryptoFactory.cpp | 7 + src/lib/crypto/OSSLSLHDSA.cpp | 495 ++++++ src/lib/crypto/OSSLSLHDSA.h | 81 + src/lib/crypto/OSSLSLHKeyPair.cpp | 71 + src/lib/crypto/OSSLSLHKeyPair.h | 67 + src/lib/crypto/OSSLSLHPrivateKey.cpp | 290 ++++ src/lib/crypto/OSSLSLHPrivateKey.h | 89 ++ src/lib/crypto/OSSLSLHPublicKey.cpp | 258 +++ src/lib/crypto/OSSLSLHPublicKey.h | 80 + src/lib/crypto/OSSLUtil.cpp | 2 +- src/lib/crypto/OSSLUtil.h | 4 +- src/lib/crypto/SLHPrivateKey.cpp | 106 ++ src/lib/crypto/SLHPrivateKey.h | 82 + src/lib/crypto/SLHPublicKey.cpp | 104 ++ src/lib/crypto/SLHPublicKey.h | 75 + src/lib/pkcs11/pkcs11.h | 4 + 43 files changed, 10882 insertions(+), 11 deletions(-) create mode 100644 hpcs-pkcs11/README.md create mode 100644 hpcs-pkcs11/samples/ep11.h create mode 100644 hpcs-pkcs11/samples/grep11.h create mode 100644 hpcs-pkcs11/samples/pkcs11-attrs.c create mode 100644 hpcs-pkcs11/samples/pkcs11-btc.c create mode 100644 hpcs-pkcs11/samples/pkcs11-checksum.c create mode 100644 hpcs-pkcs11/samples/pkcs11-crypto.c create mode 100644 hpcs-pkcs11/samples/pkcs11-dilithium.c create mode 100644 hpcs-pkcs11/samples/pkcs11-object.c create mode 100644 hpcs-pkcs11/samples/pkcs11-slhdsa.c create mode 100644 hpcs-pkcs11/samples/pkcs11.h create mode 100644 hpcs-pkcs11/samples/pkcs11f.h create mode 100644 hpcs-pkcs11/samples/pkcs11t.h create mode 100644 hpcs-pkcs11/samples/sample.h create mode 100644 m4/acx_openssl_slhdsa.m4 create mode 100644 src/lib/crypto/OSSLSLHDSA.cpp create mode 100644 src/lib/crypto/OSSLSLHDSA.h create mode 100644 src/lib/crypto/OSSLSLHKeyPair.cpp create mode 100644 src/lib/crypto/OSSLSLHKeyPair.h create mode 100644 src/lib/crypto/OSSLSLHPrivateKey.cpp create mode 100644 src/lib/crypto/OSSLSLHPrivateKey.h create mode 100644 src/lib/crypto/OSSLSLHPublicKey.cpp create mode 100644 src/lib/crypto/OSSLSLHPublicKey.h create mode 100644 src/lib/crypto/SLHPrivateKey.cpp create mode 100644 src/lib/crypto/SLHPrivateKey.h create mode 100644 src/lib/crypto/SLHPublicKey.cpp create mode 100644 src/lib/crypto/SLHPublicKey.h diff --git a/Dockerfile b/Dockerfile index 67435f02a..a2a4e85ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -47,14 +47,15 @@ RUN apt update && \ libcppunit-dev \ sudo \ opensc \ - opensc-pkcs11 + opensc-pkcs11 \ + busybox-syslogd WORKDIR /app COPY . /app RUN sh autogen.sh -RUN ./configure --with-objectstore-backend-db --disable-gost --enable-eddsa --with-crypto-backend=openssl +RUN ./configure --with-objectstore-backend-db --disable-gost --disable-eddsa --enable-slhdsa --with-crypto-backend=openssl RUN make @@ -63,7 +64,18 @@ RUN make install # If needed, the conf file definitions goes here. # about conf file: man softhsm2.conf -RUN mkdir -p /var/lib/softhsm/tokens/ +# Create config dir and log file +RUN mkdir -p /etc/softhsm /var/lib/softhsm/tokens + +# Write softhsm2.conf +RUN cat > /etc/softhsm2.conf <<'EOF' +directories.tokendir = /var/lib/softhsm/tokens/ + +log.level = INFO +EOF + +# INIT SYSLOG +# syslogd -n -O /var/log/syslog & RUN softhsm2-util --init-token --slot 0 --label "My SoftHSM Token" --so-pin 0000 --pin 0000 diff --git a/hpcs-pkcs11/README.md b/hpcs-pkcs11/README.md new file mode 100644 index 000000000..028db84be --- /dev/null +++ b/hpcs-pkcs11/README.md @@ -0,0 +1,130 @@ +# Overview + +IBM Cloud® Hyper Protect Crypto Services is a dedicated key management service and hardware security module (HSM). This service allows you to take ownership of a cloud HSM to fully manage your encryption keys and to perform cryptographic operations. Hyper Protect Crypto Services is also the only service in the cloud industry that is built on FIPS 140-2 Level 4-certified hardware. + +# Installing the PKCS #11 files + +The files contained in this repository allow clients to access a cloud HSM via the HPCS service using a PKCS #11 library and its associated configuration file. The files are categorized by *releases*, which can be accessed from the hpcs-pkcs11 repository's [releases URL](https://github.com/IBM-Cloud/hpcs-pkcs11/releases). + +**NOTE:** The PKCS #11 library, for both the amd64 and s390x platforms, is currently supported only on Linux (GLIBC distros only, so not compatible with Alpine for now). + +There are two files used along with your PKCS #11 application: +1. The PKCS #11 library: pkcs11-grep11-**platform**.so.**major.minor.build** + + - **platform** is amd64 or s390x + + - **major.minor.build** refers to the version of the library + + - **NOTE:** Refer to step 1 of the IBM Cloud HPCS documentation topic, [Set up the PKCS #11 library](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api), for instructions on where to place the PKCS #11 library file. + +2. The PKCS #11 client configuration file: *grep11client.yaml* + - Before you update the configuration file, PKCS #11 users must first be set up. Follow the steps outlined in the IBM Cloud Hyper Protect Crypto Services documentation topic, [Best practices for setting up PKCS #11 user types](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-best-practice-pkcs11-access#step2-create-service-id-api-key), to complete the PKCS #11 user setup tasks. + + - Changes to the configuration file are needed after you download it. Update the *grep11client.yaml* configuration file by following step 3 of the IBM Cloud Hyper Protect Crypto Services documentation topic: [Set up the PKCS #11 configuration file](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api) + + - **NOTE:** The *grep11client.yaml* configuration file must be moved into the same directory as the application (e.g., pkcs11-tool) using the PKCS #11 library or in the directory `/etc/ep11client`. + +## Verify the integrity and authenticity of the PKCS #11 library + +For maximum security, you can optionally verify the integrity and authenticity of the PKCS #11 library. Hyper Protect Crypto Services enable [signed code verification](https://en.wikipedia.org/wiki/Code_signing) to ensure that the signature matches the original code. If the downloaded PKCS #11 library file is altered or corrupted, a different signature is produced and the verification fails. To make sure the files are not tampered with or corrupted during the download process, complete the following steps by using the [OpenSSL command-line tool](https://wiki.openssl.org/index.php/Binaries). + +1. Download the latest version of the following files from the hpcs-pkcs11 repository's [releases URL](https://github.com/IBM-Cloud/hpcs-pkcs11/releases) to the same directory where you store the PKCS #11 library: + + - `pkcs11-grep11-.so..sig`: The signed cryptographic hash of the PKCS #11 library, where **platform** is either *amd64* or *s390x* and **version** is the major.minor.build (e.g., 2.3.4) of the signature file. Both **platform** and **version** must match the respective **platform** and **version** of the PKCS #11 library that is used. + + - `signing_cert.pem`: The signing certificate for the HPCS PKCS #11 files. + + - `digicert_cert.pem`: An intermediate code signing certificate to prove the Hyper Protect Crypto Services PKCS #11 files signing certificate. + +2. Extract the public key from the signing certificate `signing_cert.pem` to the `sigkey.pub` file with the following command by using the OpenSSL command-line tool: + + `openssl x509 -pubkey -noout -in signing_cert.pem -out sigkey.pub` + +3. Verify the integrity of the PKCS #11 library file with the following command: + + `openssl dgst -sha256 -verify sigkey.pub -signature pkcs11-grep11-.so..sig pkcs11-grep11-.so.` + + **NOTE:** Replace **platform** with either *amd64* or *s390x* and replace **version** with the major.minor.build (e.g., 2.3.4) of the library. + + When the verification is successful, `Verified OK` is displayed. + +4. Verify the authenticity and validity of the signing certificate with the following command: + + `openssl ocsp -no_nonce -issuer digicert_cert.pem -cert signing_cert.pem -VAfile digicert_cert.pem -text -url http://ocsp.digicert.com -respout ocsptest` + + When the verification is successful, `Response verify OK` and `signing_cert.pem: good` are displayed in the output. + +5. If the verification fails, cancel the installation and contact [IBM for support](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-getting-help). + +## Initializing the Keystores + +Prior to using the PKCS #11 library, the keystores must be initialized. To initialize the keystores, the security officer (SO) user needs to perform a `C_InitToken` operation. Once the keystores have been initialized, normal and anonymous users can proceed with key operations such as `C_GenerateKey` or `C_GenerateKeyPair`. + +A keystore becomes an **authenticated keystore** if it is configured with a password. For more details please check [Performing cryptographic operations with the PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api#step3-setup-configuration-file). + +## Getting started + +The `samples` directory in this repository contains source code that could be used to test your HPCS instance, the PKCS11 library, and the PKCS11 library's configuration file. Follow the instructions inside pkcs11-crypto.c to get started. + +The sample code performs the following operations: + +* Intialize a token +* Open a session +* Login as a normal user +* Create an AES key +* Create an EC key pair +* Encrypt data and decrypt data using the AES key +* Sign and verify data using the EC key pair +* Logout, close session and finalize + +pkcs11-dilithium.c demonstrates how to generate a Dilithium key pair, followed by signing and verifying data using the Dilithium key pair. + +# Attributes +We support a subset of attributes of the PKCS#11 specification. The following table shows: +1. Which attributes are allowed to be used for PKCS11 requests (key generation, unwrapping, and key derivation). +2. Data type of each attribute and the key types that are applicable. +3. What attributes are generated after key or key pairs are generated. + +| Attribute | Category | Applies to key types | Allowed in template | Value type | Library default | Filled by HPCS | Read only
After generation | +| ------------------------------------------------------------------------------------ | -------- | --------------------------------- | ------------------- | ----------- | --------------- | -------------- | ----------------------------- | +| CKA\_CLASS | 1 | All | y | Integer | Depends [1](#cka-class) | | y | +| CKA\_TOKEN | 3 | All | y | Bool | FALSE | | y | +| CKA\_PRIVATE | 3 | All | y | Bool | Depends [2](#cka-private) | | y | +| CKA\_MODIFIABLE | 3 | All | y | Bool | TRUE | y | Read only if FALSE | +| CKA\_LABEL | 4 | All | y | Bytes | empty | | | +| CKA\_KEY\_TYPE | 1 | All | y | Integer | | | y | +| CKA\_ID | 4 | All | y | Bytes | empty | | | +| CKA\_DERIVE | 1 | All | y | Bool | FALSE | | | +| CKA\_LOCAL | 1 | All but public key | | Bool | | y | y | +| CKA\_KEY\_GEN\_MECHANISM | 2 | All | | Integer | | y | y | +| CKA\_GREP11\_WKID | 2 | private key
secret key | | Big integer | | y | y | +| CKA\_SUBJECT | 4 | public key
private key | y | Bytes | empty | | | +| CKA\_ENCRYPT
CKA\_DECRYPT
CKA\_SIGN
CKA\_VERIFY
CKA\_WRAP
CKA\_UNWRAP | 1 | All when allowed 
by algorithm | y | Bool | | y | | +| CKA\_SENSITIVE | 2 | private key
secret key | y | Bool | | | y | +| CKA\_ALWAYS\_SENSITIVE | 2 | private key
secret key | | Bool | | y | y | +| CKA\_WRAP\_WITH\_TRUSTED | 1 | private key
secret key | y | Bool | FALSE | y | | +| CKA\_EXTRACTABLE | 1 | private key
secret key | y | Bool | FALSE | y | Read only if FALSE | +| CKA\_NEVER\_EXTRACTABLE | 1 | private key
secret key | | Bool | | y | y | +| CKA\_CHECK\_VALUE | 2 | secret key | | Bytes | | y | y | +| CKA\_TRUSTED | 1 | public key
secret key | y | Bool | | y | | +| CKA\_PUBLIC\_KEY\_INFO | 2 | public key | y | Bool | | y | y | +| CKA\_MODULUS\_BITS | 1 | RSA public key | y | Integer | | | y | +| CKA\_MODULUS | 2 | RSA public key
RSA private key | | Big integer | | y | y | +| CKA\_PUBLIC\_EXPONENT | 1 | RSA public key
RSA private key | y | Big integer | | | y | +| CKA\_EC\_PARAMS | 1 | EC public key
EC private key | y | Bytes | | | y | +| CKA\_EC\_POINT | 2 | EC public key | | Bytes | | y | y | +| CKA\_VALUE\_LEN | 1 | Generate secret key
AES key | y | integer | | | y | +| CKA\_IBM\_PQC\_PARAMS | 1 | Dilithium public key | y | Bytes | | | y | + +1. Default value of `CKA_CLASS` is based on mechanisms and key types: + +| Function | Mechanism | Default value | +| ---------------- | ---------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | +| GenerateKey | CKM\_AES\_KEY\_GEN
CKM\_DES2\_KEY\_GEN
CKM\_DES3\_KEY\_GEN
CKM\_GENERIC\_SECRET\_KEY\_GEN | CKO\_SECRET\_KEY | +| GenerateKeyPairs | CKM\_EC\_KEY\_PAIR\_GEN
CKM\_RSA\_PKCS\_KEY\_PAIR\_GEN
CKM\_RSA\_X9\_31\_KEY\_PAIR\_GEN
CKM\_IBM\_DILITHIUM | CKO\_PUBLIC\_KEY & CKO\_PRIVATE\_KEY | +| UnwrapKey | CKM\_AES\_CBC
CKM\_AES\_CBC\_PAD
CKM\_DES3\_CBC
CKM\_DES3\_CBC\_PAD
CKM\_RSA\_PKCS
CKM\_RSA\_PKCS\_OAEP | CKO\_SECRET\_KEY if key type is AES, DES2 or DES3. Otherwise, the default is CKO\_PRIVATE\_KEY | +| DeriveKey | | CKO\_SECRET\_KEY | + + +2. Default value of `CKA_PRIVATE` is TRUE if the `Normal user` is logged in, otherwise, it is FALSE + diff --git a/hpcs-pkcs11/samples/ep11.h b/hpcs-pkcs11/samples/ep11.h new file mode 100644 index 000000000..d8939f9f8 --- /dev/null +++ b/hpcs-pkcs11/samples/ep11.h @@ -0,0 +1,1858 @@ +/*---------------------------------------------------------------------- + * This EP11 header file is distributed under the following license + * + * Copyright 2022 IBM Corp. All Rights Reserved + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * 3. Neither the name of the copyright holder nor the names of its contributors + * may be used to endorse or promote products derived from this software + * without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR + * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; + * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + *---------------------------------------------------------------------- + * EP11 service mail address: EP11SUPP@de.ibm.com + * + * Use this mail address for Bugs and Comments with the EP11 product. + *----------------------------------------------------------------------*/ + + +#if !defined(XCP_H__) +#define XCP_H__ +#if !defined(CKR_OK) +#include "pkcs11.h" +#endif +#if !defined(INT64_MIN) +#error "We need 64-bit types, please include before this file." +#endif +#define MAX_FNAME_CHARS 256 +#define XCP_OK 0 +#define XCP_EINTERNAL -1 +#define XCP_EARG -2 +#define XCP_ETARGET -3 +#define XCP_EMEMORY -4 +#define XCP_EMUTEX -5 +#define XCP_EINIT -6 +#define XCP_EDEVICE -7 +#define XCP_EGROUP -8 +#define XCP_ESIZE -9 +#define XCP_EINVALID -10 +#define XCP_ERESPONSE -11 +#define XCP_EAPI -12 +#define XCP_MOD_EOBSOLETE -101 +#define XCP_MOD_EVERSION -102 +#define XCP_MOD_EFLAGS -103 +#define XCP_MOD_EMODULE -104 +#define XCP_MOD_EDOMAIN -105 +#define XCP_MOD_EINIT -106 +#define XCP_MOD_EPROBE -107 +#define XCP_COMMON_PUBLIC_H__ +#define XCP_API_VERSION 0x0810 +#define XCP_API_ORDINAL 0x0004 +#define XCP_HOST_API_VER 0x040000 +#define XCP_HSM_AGENT_ID 0x5843 +#define XCP_HSM_USERDEF32 0x01234567 +#define XCP_API_ALLOW_PROTKEY 0x0004 +typedef enum { + XCP_FNVAR_SIZEQUERY = 1, + XCP_FNVAR_MULTIDATA = 2, + XCP_FNVAR_MULTISIZEQ = 3 +} XCP_FNVariant_t; +#define CKR_IBM_WKID_MISMATCH (CKR_VENDOR_DEFINED +0x10001) +#define CKR_IBM_INTERNAL_ERROR (CKR_VENDOR_DEFINED +0x10002) +#define CKR_IBM_TRANSPORT_ERROR (CKR_VENDOR_DEFINED +0x10003) +#define CKR_IBM_BLOB_ERROR (CKR_VENDOR_DEFINED +0x10004) +#define CKR_IBM_BLOBKEY_CONFLICT (CKR_VENDOR_DEFINED +0x10005) +#define CKR_IBM_MODE_CONFLICT (CKR_VENDOR_DEFINED +0x10006) +#define CKR_IBM_NONCRT_KEY_SIZE (CKR_VENDOR_DEFINED +0x10008) +#define CKR_IBM_WK_NOT_INITIALIZED (CKR_VENDOR_DEFINED +0x10009) +#define CKR_IBM_OA_API_ERROR (CKR_VENDOR_DEFINED +0x1000a) +#define CKR_IBM_REQ_TIMEOUT (CKR_VENDOR_DEFINED +0x1000b) +#define CKR_IBM_READONLY (CKR_VENDOR_DEFINED +0x1000c) +#define CKR_IBM_STATIC_POLICY (CKR_VENDOR_DEFINED +0x1000d) +#define CKR_IBM_TRANSPORT_LIMIT (CKR_VENDOR_DEFINED +0x10010) +#define CKR_IBM_FCV_NOT_SET (CKR_VENDOR_DEFINED +0x10011) +#define CKR_IBM_PERF_CATEGORY_INVALID (CKR_VENDOR_DEFINED +0x10012) +#define CKR_IBM_API_MISMATCH (CKR_VENDOR_DEFINED +0x10013) +#define CKR_IBM_TARGET_INVALID (CKR_VENDOR_DEFINED +0x10030) +#define CKR_IBM_PQC_PARAMS_NOT_SUPPORTED (CKR_VENDOR_DEFINED +0x10031) +#define CKR_IBM_ERROR_STATE (CKR_VENDOR_DEFINED +0x10101) +#define CKM_IBM_SHA3_224 (CKM_VENDOR_DEFINED +0x10001) +#define CKM_IBM_SHA3_256 (CKM_VENDOR_DEFINED +0x10002) +#define CKM_IBM_SHA3_384 (CKM_VENDOR_DEFINED +0x10003) +#define CKM_IBM_SHA3_512 (CKM_VENDOR_DEFINED +0x10004) +#define CKM_IBM_CMAC (CKM_VENDOR_DEFINED +0x10007) +#define CKM_IBM_ECDSA_SHA224 (CKM_VENDOR_DEFINED +0x10008) +#define CKM_IBM_ECDSA_SHA256 (CKM_VENDOR_DEFINED +0x10009) +#define CKM_IBM_ECDSA_SHA384 (CKM_VENDOR_DEFINED +0x1000a) +#define CKM_IBM_ECDSA_SHA512 (CKM_VENDOR_DEFINED +0x1000b) +#define CKM_IBM_EC_MULTIPLY (CKM_VENDOR_DEFINED +0x1000c) +#define CKM_IBM_EAC (CKM_VENDOR_DEFINED +0x1000d) +#define XCP_EAC_NONCE_MAX_BYTES 64 +#define XCP_EAC_INFO_MAX_BYTES 64 +typedef enum { + EACV_IBM_KEK_V101 = 1, + EACV_IBM_MACK_V101 = 2, + EACV_IBM_PWD_V200 = 3, + EACV_IBM_HKDF = 4, + EACV_IBM_BCHAIN_TCERT0 + = 5 +} EAC_Var_t; +#define CKM_IBM_TESTCODE (CKM_VENDOR_DEFINED +0x1000e) +#define CKM_IBM_SHA512_256 (CKM_VENDOR_DEFINED +0x10012) +#define CKM_IBM_SHA512_224 (CKM_VENDOR_DEFINED +0x10013) +#define CKM_IBM_SHA512_256_HMAC (CKM_VENDOR_DEFINED +0x10014) +#define CKM_IBM_SHA512_224_HMAC (CKM_VENDOR_DEFINED +0x10015) +#define CKM_IBM_EC_X25519 (CKM_VENDOR_DEFINED +0x1001b) +#define CKM_IBM_ED25519_SHA512 (CKM_VENDOR_DEFINED +0x1001c) +#define CKM_IBM_EC_X448 (CKM_VENDOR_DEFINED +0x1001e) +#define CKM_IBM_ED448_SHA3 (CKM_VENDOR_DEFINED +0x1001f) +#define CKM_IBM_SIPHASH (CKM_VENDOR_DEFINED +0x10021) +#define CKM_IBM_DILITHIUM (CKM_VENDOR_DEFINED +0x10023) +#define CKM_IBM_KYBER (CKM_VENDOR_DEFINED +0x10024) +#define CKM_IBM_SHA3_224_HMAC (CKM_VENDOR_DEFINED +0x10025) +#define CKM_IBM_SHA3_256_HMAC (CKM_VENDOR_DEFINED +0x10026) +#define CKM_IBM_SHA3_384_HMAC (CKM_VENDOR_DEFINED +0x10027) +#define CKM_IBM_SHA3_512_HMAC (CKM_VENDOR_DEFINED +0x10028) +#define CKM_IBM_EC_X25519_RAW (CKM_VENDOR_DEFINED +0x10029) +#define CKM_IBM_EC_X448_RAW (CKM_VENDOR_DEFINED +0x10030) +#define CKM_IBM_ECDSA_OTHER (CKM_VENDOR_DEFINED +0x10031) +typedef enum { + ECSG_IBM_ECSDSA_S256 = 3, + ECSG_IBM_ECSDSA_COMPR_MULTI = 5, + ECSG_IBM_MAX = ECSG_IBM_ECSDSA_COMPR_MULTI, +} ECSG_Var_t; +#define CK_IBM_ECSG_IBM_ECSDSA_S256 ECSG_IBM_ECSDSA_S256 +#define CK_IBM_ECSG_IBM_ECDSA_COMPR_MULTI_S256 ECSG_IBM_ECDSA_COMPR_MULTI_S256 +#define CK_IBM_ECSG_IBM_MAX ECSG_IBM_MAX +#define CKM_IBM_CLEARKEY_TRANSPORT (CKM_VENDOR_DEFINED +0x20001) +#define CKM_IBM_ATTRIBUTEBOUND_WRAP (CKM_VENDOR_DEFINED +0x20004) +#define CKM_IBM_TRANSPORTKEY (CKM_VENDOR_DEFINED +0x20005) +#define CKM_IBM_DH_PKCS_DERIVE_RAW (CKM_VENDOR_DEFINED +0x20006) +#define CKM_IBM_ECDH1_DERIVE_RAW (CKM_VENDOR_DEFINED +0x20007) +#define CKM_IBM_WIRETEST (CKM_VENDOR_DEFINED +0x30004) +#define CKM_IBM_RETAINKEY (CKM_VENDOR_DEFINED +0x40001) +#define CKM_IBM_CPACF_WRAP (CKM_VENDOR_DEFINED +0x60001) +#define CKM_IBM_BTC_DERIVE (CKM_VENDOR_DEFINED +0x70001) +#define CKA_IBM_RESTRICTABLE (CKA_VENDOR_DEFINED +0x10001) +#define CKA_IBM_NEVER_MODIFIABLE (CKA_VENDOR_DEFINED +0x10002) +#define CKA_IBM_RETAINKEY (CKA_VENDOR_DEFINED +0x10003) +#define CKA_IBM_ATTRBOUND (CKA_VENDOR_DEFINED +0x10004) +#define CKA_IBM_KEYTYPE (CKA_VENDOR_DEFINED +0x10005) +#define CKA_IBM_CV (CKA_VENDOR_DEFINED +0x10006) +#define CKA_IBM_MACKEY (CKA_VENDOR_DEFINED +0x10007) +#define CKA_IBM_USE_AS_DATA (CKA_VENDOR_DEFINED +0x10008) +#define CKA_IBM_STRUCT_PARAMS (CKA_VENDOR_DEFINED +0x10009) +#define CKA_IBM_STD_COMPLIANCE1 (CKA_VENDOR_DEFINED +0x1000a) +#define CKA_IBM_PROTKEY_EXTRACTABLE (CKA_VENDOR_DEFINED +0x1000c) +#define CKA_IBM_PROTKEY_NEVER_EXTRACTABLE (CKA_VENDOR_DEFINED +0x1000d) +#define CKA_IBM_PQC_PARAMS (CKA_VENDOR_DEFINED +0x1000e) +#define CKA_IBM_LOGIN_SESSION (CKA_VENDOR_DEFINED +0x1000f) +#define CKA_IBM_MACED_PUBLIC_KEY_INFO (CKA_VENDOR_DEFINED +0x20002) +#define CKA_IBM_WIRETEST (CKA_VENDOR_DEFINED +0x20001) +#define CKK_IBM_PQC_DILITHIUM (CKK_VENDOR_DEFINED +0x10023) +#define CKK_IBM_PQC_KYBER (CKK_VENDOR_DEFINED +0x10024) +#define XCP_MOD_ERROR_STATE_OFF 0x00000000 +#define XCP_MOD_ERROR_STATE_MODULE_SELFTEST 0x00000001 +#define XCP_MOD_ERROR_STATE_KEYPAIR_GEN_PCT 0x00000002 +#define XCP_MOD_ERROR_STATE_SYSTEST_CMD 0x00000003 +#define XCP_MOD_ERROR_STATE_TRNG_HEALTH 0x00000004 +#define XCP_HMAC_BYTES ((size_t) (256 /8)) +#define XCP_FWID_BYTES ((size_t) (256 /8)) +#define XCP_WK_BYTES ((size_t) (256 /8)) +#define XCP_WKID_BYTES ((size_t) (128 /8)) +#define XCP_BLOBCLRATTR_BYTES 8 +#define XCP_BLOBCLRMODE_BYTES 8 +#define XCP_WRAP_BLOCKSIZE ((size_t) (128 /8)) +#define XCP_MACKEY_BYTES (256 /8) +#define XCP_PIN_SALT_BYTES XCP_WRAP_BLOCKSIZE +#define XCP_PINBLOB_BYTES \ + (XCP_WK_BYTES +XCP_PIN_SALT_BYTES +XCP_HMAC_BYTES) +#define XCP_PBE_TYPE_CLEAR 0 +#define XCP_PBE_TYPE_BLOB 1 +#define XCP_PBE_TYPE_MAX (XCP_PBE_TYPE_BLOB) +#define XCP_PBE_HDR_BYTES 16 +#define XCP_PBE_PWD_MAX_BYTES 1024 +#define XCP_PBE_SALT_MAX_BYTES 256 +#define XCP_MECH_WIRE_PRM_BYTES ((size_t) 4) +#define XCP_MECH_PRM_MAX_BYTES \ + (XCP_MECH_WIRE_PRM_BYTES +XCP_PBE_HDR_BYTES \ + +XCP_PBE_PWD_MAX_BYTES +XCP_PBE_SALT_MAX_BYTES) +#define XCP_WIRE_FILEHDR_BYTES ((size_t) (4+4+4)) +#define XCP_PBE_ITER_MAX (64*1024) +#define XCP_CSP_CONFIG_BYTES 40 +#define XCP_SESSIONBLOB_SALT_BYTES 16 +#define XCP_SESSIONBLOB_BYTES \ + (XCP_WK_BYTES +XCP_SESSIONBLOB_SALT_BYTES +XCP_HMAC_BYTES) +#define XCP_SIZEQ_WIRE_BYTES 8 +#define XCP_PSS_WIRE_BYTES (4+4+4) +#define XCP_PSS_DEFAULT_VALUE 0xffffffff +#define XCP_OAEP_MIN_WIRE_BYTES (4+4+4) +#define XCP_OAEP_MAX_SOURCE_BYTES 1024 +#define XCP_SHAKE_WIRE_BYTES 4 +#define XCP_ECDH1_DERIVE_MIN_WIRE_BYTES (4+4+4) +#define XCP_BTC_MIN_WIRE_BYTES (4+4+4+4) +#define XCP_BIP0032_CHAINCODE_BYTES 32 +#define XCP_BTC_VERSION 1 +#define XCP_KYBER_KEM_VERSION 0 +#define XCP_KYBER_KEM_MIN_WIRE_BYTES (4 + 4 + 4 + 4 + 4 + 4) +#define XCP_KYBER_RAW_BYTES 32 +#define XCP_ECDH1_DERIVE_MAX_PUBLIC_BYTES 1024 +#define XCP_ECDH1_DERIVE_MAX_SHARED_BYTES 1024 +#define XCP_RETAINID_BYTES (XCP_HMAC_BYTES +XCP_HMAC_BYTES) +#define XCP_RETAINLABEL_BYTES ((size_t) 64) +#define XCP_RETAINID_SHORT_BYTES 4 +typedef enum { + CKF_IBM_HW_EXTWNG = 1, + CKF_IBM_HW_ATTEST = 2, + CKF_IBM_HW_BATTERY = 4, + CKF_IBM_HW_SYSTEST = 8, + CKF_IBM_HW_RETAIN = 0x10, + CKF_IBM_HW_AUDIT = 0x40, + CKF_IBM_HW_ADM_DOMIMPORT + = 0x0200, + CKF_IBM_HW_PROTKEY_TOLERATION + = 0x0400, + CKF_IBM_HW_DUAL_OA = 0x1000, +} XCP_CK_EXTFLAGS_t; +#define XCP_MAX_MODULES 256 +#define XCP_SERIALNR_CHARS 8 +#define XCP_DOMAIN_INSTANCE_BYTES 4 +#define XCP_WRAPKEY_BYTES 32 +#define XCP_SPKISALT_BYTES 8 +#define XCP_DOMAINS 256 +#define XCP_DOMAIN_BYTES 4 +#define XCP_MAX_ADMINS 8 +#define XCP_MAX_KEYPARTS 20 +#define XCP_MIN_PINBYTES 8 +#define XCP_MAX_PINBYTES 16 +#define XCP_CERT_MAX_BYTES ((size_t) 12288) +#define XCP_CERTHASH_BYTES (256/8) +#define XCP_ADMCTR_BYTES ((size_t) (128/8)) +#define XCP_KEYCSUM_BYTES (256/8) +#define XCP_MAX_EC_COORD_BYTES ((size_t) 66) +#define XCP_MIN_EC_CURVE_BITS 192 +#define XCP_MAX_EC_CURVE_BITS 521 +#define XCP_MAX_DIL_SIGNATURE_BYTES 4668 +#define XCP_MAX_SINFO_META_BYTES 100 +#define MOD_MAX_SYMMKEY_BYTES 256 +#define XCP_FCV_PUBLIC_BYTES ((size_t) 76) +typedef enum { + XCP_FCV_RSA_BYTES = (76+ 4096/8), + XCP_FCV_EC_BYTES = (76+ 2*66), + XCP_FCV_MAX_BYTES = XCP_FCV_RSA_BYTES +} XCP_FCV_Bytes_t; +#define PKCS11_CHECKSUM_BYTES ((size_t) 3) +#define XCP_KEYBITS_FIELD_BYTES ((size_t) 4) +#define XCP_RSPSIG_RSA (4096 / 8) +#define XCP_RSPSIG_MAX_BYTES (XCP_MAX_SINFO_META_BYTES + \ + XCP_RSPSIG_RSA) +#define XCP_RSPSIG_QS_MAX_BYTES (XCP_MAX_SINFO_META_BYTES + \ + XCP_MAX_DIL_SIGNATURE_BYTES) +#define XCP_RSA_PKCS_MIN_PAD 11 +#define XCP_LOG_STATE_BYTES (256 /8) +#define XCP_LOG_HEADER_BYTE 0x42 +#define XCP_LOGEV_SPEC (0xffff0000) +#define XCP_LOGEV_QUERY 0 +#define XCP_LOGEV_FUNCTION 1 +#define XCP_LOGEV_ADMFUNCTION 2 +#define XCP_LOGEV_STARTUP 3 +#define XCP_LOGEV_SHUTDOWN 4 +#define XCP_LOGEV_SELFTEST 5 +#define XCP_LOGEV_DOM_IMPORT 6 +#define XCP_LOGEV_DOM_EXPORT 7 +#define XCP_LOGEV_FAILURE 8 +#define XCP_LOGEV_GENERATE 9 +#define XCP_LOGEV_REMOVE 10 +#define XCP_LOGEV_SPECIFIC 11 +#define XCP_LOGEV_STATE_IMPORT 12 +#define XCP_LOGEV_STATE_EXPORT 13 +#define XCP_LOGEV_IMPORT 14 +#define XCP_LOGEV_EXPORT 15 +#define XCP_LOGSPEV_TRANSACT_ZEROIZE (XCP_LOGEV_SPEC +1) +#define XCP_LOGSPEV_KAT_FAILED (XCP_LOGEV_SPEC +2) +#define XCP_LOGSPEV_KAT_COMPLETED (XCP_LOGEV_SPEC +3) +#define XCP_LOGSPEV_EARLY_Q_START (XCP_LOGEV_SPEC +4) +#define XCP_LOGSPEV_EARLY_Q_END (XCP_LOGEV_SPEC +5) +#define XCP_LOGSPEV_AUDIT_NEWCHAIN (XCP_LOGEV_SPEC +6) +#define XCP_LOGSPEV_TIMECHG_BEFORE (XCP_LOGEV_SPEC +7) +#define XCP_LOGSPEV_TIMECHG_AFTER (XCP_LOGEV_SPEC +8) +#define XCP_LOGSPEV_MODSTIMPORT_START (XCP_LOGEV_SPEC +9) +#define XCP_LOGSPEV_MODSTIMPORT_FAIL (XCP_LOGEV_SPEC +10) +#define XCP_LOGSPEV_MODSTIMPORT_END (XCP_LOGEV_SPEC +11) +#define XCP_LOGSPEV_MODSTEXPORT_START (XCP_LOGEV_SPEC +12) +#define XCP_LOGSPEV_MODSTEXPORT_FAIL (XCP_LOGEV_SPEC +13) +typedef enum { + XCP_LOGSYS_AUDIT = 1, + XCP_LOGSYS_CRYPTTEST = 2, + XCP_LOGSYS_SELFTEST = 3, + XCP_LOGSYS_FULL = 4, + XCP_LOGSYS_WK = 5, + XCP_LOGSYS_STATE = 6 +} XCP_LogSystem_t; +#define XCP_LOGFL_WK_PRESENT 0x80000000 +#define XCP_LOGFL_COMPLIANCE_PRESENT 0x40000000 +#define XCP_LOGFL_FINALWK_PRESENT 0x20000000 +#define XCP_LOGFL_KEYREC0_PRESENT 0x10000000 +#define XCP_LOGFL_KEYREC0_COMPL 0x08000000 +#define XCP_LOGFL_KEYREC1_PRESENT 0x04000000 +#define XCP_LOGFL_KEYREC2_PRESENT 0x02000000 +#define XCP_LOGFL_FINTIME_PRESENT 0x01000000 +#define XCP_LOGFL_SALT0_PRESENT 0x00800000 +#define XCP_LOGFL_SALT1_PRESENT 0x00400000 +#define XCP_LOGFL_SALT2_PRESENT 0x00200000 +#define XCP_LOGFL_REASON_PRESENT 0x00100000 +#define XCP_LOGFL_SEQPRF_PRESENT 0x00080000 +typedef enum { + XCP_IMPRKEY_RSA_2048 = 0, + XCP_IMPRKEY_RSA_4096 = 1, + XCP_IMPRKEY_EC_P256 = 2, + XCP_IMPRKEY_EC_P521 = 3, + XCP_IMPRKEY_EC_BP256r = 4, + XCP_IMPRKEY_EC_BP320r = 5, + XCP_IMPRKEY_EC_BP512r = 6, + XCP_IMPRKEY_RSA_3072 = 7, + XCP_IMPRKEY_EC_P521_TKE = 8, + XCP_IMPRKEY_MAX = XCP_IMPRKEY_EC_P521_TKE +} XCP_IMPRKEY_t; +typedef enum { + XCP_OAKEY_RSA_4096 = 1, + XCP_OAKEY_ECC_P521 = 2, + XCP_OAKEY_DIL_87R2 = 3, + XCP_OAKEY_MAX = XCP_OAKEY_DIL_87R2 +} XCP_OAKEY_t; +typedef struct CK_RETAINEDKEY_PARAMS { + CK_ULONG credits; + CK_VOID_PTR rkData; + CK_ULONG rkdLen; +} CK_RETAINEDKEY_PARAMS; +typedef enum { + XCP_OPCAT_ASYMM_SLOW = 1, + XCP_OPCAT_ASYMM_FAST = 2, + XCP_OPCAT_SYMM_PARTIAL = 3, + XCP_OPCAT_SYMM_FULL = 4, + XCP_OPCAT_ASYMM_GEN = 5, + XCP_OPCAT_ASYMM_MAX = XCP_OPCAT_ASYMM_GEN +} XCP_OPCAT_t; +typedef enum { + CK_IBM_XCPQ_API = 0, + CK_IBM_XCPQ_MODULE = 1, + CK_IBM_XCPQ_DOMAINS = 2, + CK_IBM_XCPQ_DOMAIN = 3, + CK_IBM_XCPQ_SELFTEST = 4, + CK_IBM_XCPQ_EXT_CAPS = 5, + CK_IBM_XCPQ_EXT_CAPLIST = 6, + CK_IBM_XCPQ_AUDITLOG = 8, + CK_IBM_XCPQ_EC_CURVES = 10, + CK_IBM_XCPQ_COMPAT = 11, + CK_IBM_XCPQ_EC_CURVEGRPS + = 12, + CK_IBM_XCPQ_CP_BLACKLIST + = 13, + CK_IBM_XCPQ_PQC_STRENGTHS + = 14, + CK_IBM_XCPQ_MAX = CK_IBM_XCPQ_PQC_STRENGTHS +} CK_IBM_XCPQUERY_t; +typedef enum { + CK_IBM_XCPMSQ_DEFAULT = 0, + CK_IBM_XCPMSQ_DESCRTEXT = 1, + CK_IBM_XCPMSQ_FNLIST = 2, + CK_IBM_XCPMSQ_FNS = 3, + CK_IBM_XCPMSQ_MOD_V1 = 4, + CK_IBM_XCPMSQ_ATTRLIST = 5, + CK_IBM_XCPMSQ_ATTRS = 6, + CK_IBM_XCPMSQ_MOD_V2 = 7, + CK_IBM_XCPMSQ_MAX = CK_IBM_XCPMSQ_MOD_V2 +} CK_IBM_XCPMSUBQUERY_t; +#define XCP_MSQ_FNLIST_SIZE 16 +#define XCP_XCPMSQ_FNS_SIZE 1 +#define CK_IBM_XCP_HOSTQ_IDX 0xff000000 +#define CK_IBM_XCPHQ_COUNT 0xff000000 +#define CK_IBM_XCPHQ_VERSION 0xff000001 +#define CK_IBM_XCPHQ_VERSION_HASH 0xff000002 +#define CK_IBM_XCPHQ_DIAGS 0xff000003 +#define CK_IBM_XCPHQ_HVERSION 0xff000004 +#define CK_IBM_XCPHQ_TGT_MODE 0xff000005 +#define CK_IBM_XCPHQ_ECDH_DERPRM 0xff000006 +#define CK__IBM_XCPHQ_MAX CK_IBM_XCPHQ_TGT_MODE +typedef enum { + CK_IBM_XCPHQ_TGT_MODES_TGTGRP = 1, + CK_IBM_XCPHQ_TGT_MODES_MAX = CK_IBM_XCPHQ_TGT_MODES_TGTGRP +} CK_IBM_XCPHQ_TGT_MODES_t; +typedef enum { + CK_IBM_XCPXQ_AUDIT_EV_BYTES = 2, + CK_IBM_XCPXQ_AUDIT_ENTRIES = 3, + CK_IBM_XCPXQ_DEBUGLVL_MAX = 4, + CK_IBM_XCPXQ_ERRINJECT_FREQ = 5, + CK_IBM_XCPXQ_MULTIDATA_N = 6, + CK_IBM_XCPXQ_IMPEXP_CAPS = 7, + CK_IBM_XCPXQ_CERT_MAXBYTES = 8, + CK_IBM_XCPXQ_MOD_COUNTERS = 9, + CK_IBM_XCPXQ_MAX_SESSIONS = 12, + CK_IBM_XCPXQ_AVAIL_SESSIONS = 13, + CK_IBM_XCPXQ_BTC_CAP = 14, + CK_IBM_XCPXQ_ECDSA_OTHER = 15, + CK_IBM_XCPXQ_OA_CAP = 16, + CK_IBM_XCPXQ_MAXIDX = CK_IBM_XCPXQ_OA_CAP, +} CK_IBM_XCPEXTCAP_t; +#define CK_IBM_DOM_ADMIND 1 +#define CK_IBM_DOM_CURR_WK 2 +#define CK_IBM_DOM_NEXT_WK 4 +#define CK_IBM_DOM_COMMITTED_NWK 8 +#define CK_IBM_DOM_IMPRINTED 0x10 +#define CK_IBM_DOM_IMPRINTS 0x80000000 +#define CK_IBM_DOM_PROTKEY_ALLOW 0x20 +#define CK_IBM_DOM_ACTIVE \ + (CK_IBM_DOM_ADMIND | \ + CK_IBM_DOM_CURR_WK | \ + CK_IBM_DOM_NEXT_WK | \ + CK_IBM_DOM_COMMITTED_NWK | \ + CK_IBM_DOM_IMPRINTED) +typedef enum { + CK_IBM_ECCURVE_NIST = 1, + CK_IBM_ECCURVE_BPOOL = 2, + CK_IBM_ECCURVE_S256K1 = 4, + CK_IBM_ECCURVE_25519 = 8, + CK_IBM_ECCURVE_ED448 = 0x20, +} CK_IBM_ECCURVEQ_t; +typedef struct CK_IBM_XCPAPI_INFO { + CK_ULONG firmwareApi; + CK_ULONG firmwareConfig; +} CK_IBM_XCPAPI_INFO; +typedef CK_IBM_XCPAPI_INFO CK_PTR CK_IBM_XCPAPI_INFO_PTR; +#define CK_IBM_XCP_INFO_MEMBERS_V0 \ + CK_ULONG firmwareApi; \ + \ + CK_ULONG firmwareId; \ + CK_VERSION firmwareVersion; \ + CK_VERSION cspVersion; \ + \ + CK_BYTE firmwareConfig[ 32 ]; \ + CK_BYTE xcpConfig[ 32 ]; \ + CK_BYTE cspConfig[ 32 ]; \ + CK_CHAR serialNumber[ 16 ]; \ + CK_CHAR utcTime[ 16 ]; \ + CK_ULONG opMode2; \ + CK_ULONG opMode1; \ + CK_FLAGS flags; \ + CK_FLAGS extflags; \ + CK_ULONG domains; \ + CK_ULONG symmStateBytes; \ + CK_ULONG digestStateBytes; \ + CK_ULONG pinBlockBytes; \ + CK_ULONG symmKeyBytes; \ + CK_ULONG spkiBytes; \ + CK_ULONG prvkeyBytes; \ + CK_ULONG maxPayloadBytes; \ + CK_ULONG cpProfileBytes; \ + CK_ULONG controlPoints; +#define CK_IBM_XCP_DESCINFO_MEMBER \ + CK_CHAR manufacturerID[ 32 ]; \ + CK_CHAR model[ 16 ]; +#define CK_IBM_XCP_ADMATTRLIST_MEMBER \ + CK_BYTE perm_modes[ 8 ]; \ + CK_BYTE infra_modes[ 8 ]; \ + CK_BYTE comp_modes[ 8 ]; +#define CK_IBM_XCP_ADMATTRCOUNT_MEMBER \ + CK_BYTE perm_count; \ + CK_BYTE infra_count; \ + CK_BYTE comp_count; +#define CK_IBM_XCP_ADMATTRLIST_MEMBER_V2 \ + CK_BYTE perm_ext01_modes[ 8 ]; +#define CK_IBM_XCP_ADMATTRCOUNT_MEMBER_V2 \ + CK_BYTE perm_ext01_count; +typedef struct CK_IBM_XCP_INFO { + CK_IBM_XCP_INFO_MEMBERS_V0 +} CK_IBM_XCP_INFO; +typedef struct CK_IBM_XCP_INFO_V1 { + CK_IBM_XCP_INFO_MEMBERS_V0 + CK_IBM_XCP_DESCINFO_MEMBER + CK_BYTE fnid_mask[ 16 ]; + CK_BYTE fnid_count; + CK_IBM_XCP_ADMATTRLIST_MEMBER + CK_IBM_XCP_ADMATTRCOUNT_MEMBER +} CK_IBM_XCP_INFO_V1; +typedef struct CK_IBM_XCP_INFO_V2 { + CK_IBM_XCP_INFO_MEMBERS_V0 + CK_IBM_XCP_DESCINFO_MEMBER + CK_BYTE fnid_mask[ 16 ]; + CK_BYTE fnid_count; + CK_IBM_XCP_ADMATTRLIST_MEMBER + CK_IBM_XCP_ADMATTRCOUNT_MEMBER + CK_IBM_XCP_ADMATTRLIST_MEMBER_V2 + CK_IBM_XCP_ADMATTRCOUNT_MEMBER_V2 +} CK_IBM_XCP_INFO_V2; +typedef struct CK_IBM_XCP_DESCINFO { + CK_IBM_XCP_DESCINFO_MEMBER +} CK_IBM_XCP_DESCINFO; +typedef struct CK_IBM_XCP_ATTRLIST { + CK_IBM_XCP_ADMATTRLIST_MEMBER + CK_IBM_XCP_ADMATTRLIST_MEMBER_V2 +} CK_IBM_XCP_ATTRLIST; +typedef struct CK_IBM_XCP_ATTRCOUNT { + CK_IBM_XCP_ADMATTRCOUNT_MEMBER + CK_IBM_XCP_ADMATTRCOUNT_MEMBER_V2 +} CK_IBM_XCP_ATTRCOUNT; +#define CK_IBM_XCP_INFO_INIT0 \ + { 0,0, {0,0,},{0,0,}, {0,},{0,},{0,}, {0,},{0,}, \ + 0,0, 0,0, 0,0,0,0,0,0,0, 0,0,0, } +#define CK_IBM_XCP_INFO_V2_INIT0 \ + { 0,0, {0,0,},{0,0,}, {0,},{0,},{0,}, {0,},{0,}, \ + 0,0, 0,0, 0,0,0,0,0,0,0, 0,0,0, \ + {0}, {0}, {0}, 0, {0}, {0}, {0}, 0, 0, 0, \ + {0}, 0} +typedef CK_IBM_XCP_INFO CK_PTR CK_IBM_XCP_INFO_PTR; +typedef CK_IBM_XCP_INFO_V1 CK_PTR CK_IBM_XCP_INFO_V1_PTR; +typedef CK_IBM_XCP_INFO_V2 CK_PTR CK_IBM_XCP_INFO_V2_PTR; +typedef CK_IBM_XCP_DESCINFO CK_PTR CK_IBM_XCP_DESCINFO_PTR; +typedef CK_IBM_XCP_ATTRLIST CK_PTR CK_IBM_XCP_ATTRLIST_PTR; +typedef CK_IBM_XCP_ATTRCOUNT CK_PTR CK_IBM_XCP_ATTRCOUNT_PTR; +typedef struct CK_IBM_DOMAIN_INFO { + CK_ULONG domain; + CK_BYTE wk[ XCP_KEYCSUM_BYTES ]; + CK_BYTE nextwk[ XCP_KEYCSUM_BYTES ]; + CK_ULONG flags; + CK_BYTE mode[ 8 ]; +} CK_IBM_DOMAIN_INFO; +#define CK_IBM_DOMAIN_INFO_INIT0 { 0, { 0, }, { 0, }, 0, { 0, } } +typedef CK_IBM_DOMAIN_INFO CK_PTR CK_IBM_DOMAIN_INFO_PTR; +typedef struct CK_IBM_BTC_DERIVE_PARAMS { + CK_ULONG type; + CK_ULONG childKeyIndex; + CK_BYTE_PTR pChainCode; + CK_ULONG ulChainCodeLen; + CK_ULONG version; +} CK_IBM_BTC_DERIVE_PARAMS; +typedef CK_IBM_BTC_DERIVE_PARAMS CK_PTR CK_IBM_BTC_DERIVE_PARAMS_PTR; +#define CK_IBM_BIP0032_HARDENED (0x80000000) +typedef enum { + CK_IBM_BIP0032_PRV2PRV = 1, + CK_IBM_BIP0032_PRV2PUB = 2, + CK_IBM_BIP0032_PUB2PUB = 3, + CK_IBM_BIP0032_MASTERK = 4, + CK_IBM_SLIP0010_PRV2PRV = 5, + CK_IBM_SLIP0010_PRV2PUB = 6, + CK_IBM_SLIP0010_PUB2PUB = 7, + CK_IBM_SLIP0010_MASTERK = 8, +} CK_IBM_BTC_t; +typedef enum { + XCP_KEM_ENCAPSULATE = 1, + XCP_KEM_DECAPSULATE = 2, +} XCP_KEM_t; +typedef CK_ULONG CK_IBM_KEM_MODE; +#define CK_IBM_KEM_ENCAPSULATE XCP_KEM_ENCAPSULATE +#define CK_IBM_KEM_DECAPSULATE XCP_KEM_DECAPSULATE +typedef struct XCP_KYBER_KEM_PARAMS { + CK_ULONG version; + CK_IBM_KEM_MODE mode; + CK_ULONG kdf; + CK_BBOOL prepend; + CK_BYTE *pCipher; + CK_ULONG ulCipherLen; + CK_BYTE *pSharedData; + CK_ULONG ulSharedDataLen; + CK_BYTE *pBlob; + CK_ULONG ulBlobLen; +} XCP_KYBER_KEM_PARAMS_t; +typedef enum { + XCP_BLOB_EXTRACTABLE = 1, + XCP_BLOB_NEVER_EXTRACTABLE = 2, + XCP_BLOB_MODIFIABLE = 4, + XCP_BLOB_NEVER_MODIFIABLE = 8, + XCP_BLOB_RESTRICTABLE = 0x10, + XCP_BLOB_LOCAL = 0x20, + XCP_BLOB_ATTRBOUND = 0x40, + XCP_BLOB_USE_AS_DATA = 0x80, + XCP_BLOB_SIGN = 0x0100, + XCP_BLOB_SIGN_RECOVER = 0x0200, + XCP_BLOB_DECRYPT = 0x0400, + XCP_BLOB_ENCRYPT = 0x0800, + XCP_BLOB_DERIVE = 0x1000, + XCP_BLOB_UNWRAP = 0x2000, + XCP_BLOB_WRAP = 0x4000, + XCP_BLOB_VERIFY = 0x8000, + XCP_BLOB_VERIFY_RECOVER = 0x010000, + XCP_BLOB_TRUSTED = 0x020000, + XCP_BLOB_WRAP_W_TRUSTED = 0x040000, + XCP_BLOB_RETAINED = 0x080000, + XCP_BLOB_ALWAYS_RETAINED = 0x100000, + XCP_BLOB_PROTKEY_EXTRACTABLE = 0x200000, + XCP_BLOB_PROTKEY_NEVER_EXTRACTABLE = 0x400000, + XCP_BLOB_BIT_MAX = XCP_BLOB_PROTKEY_NEVER_EXTRACTABLE +} XCP_Attr_t; +#define XCP_CPID_BYTES 8 +#define XCP_CPBLOCK_BITS 128 +typedef enum { + XCP_CPB_ADD_CPBS = 0, + XCP_CPB_DELETE_CPBS = 1, + XCP_CPB_SIGN_ASYMM = 2, + XCP_CPB_SIGN_SYMM = 3, + XCP_CPB_SIGVERIFY_SYMM = 4, + XCP_CPB_ENCRYPT_SYMM = 5, + XCP_CPB_DECRYPT_ASYMM = 6, + XCP_CPB_DECRYPT_SYMM = 7, + XCP_CPB_WRAP_ASYMM = 8, + XCP_CPB_WRAP_SYMM = 9, + XCP_CPB_UNWRAP_ASYMM = 10, + XCP_CPB_UNWRAP_SYMM = 11, + XCP_CPB_KEYGEN_ASYMM = 12, + XCP_CPB_KEYGEN_SYMM = 13, + XCP_CPB_RETAINKEYS = 14, + XCP_CPB_SKIP_KEYTESTS = 15, + XCP_CPB_NON_ATTRBOUND = 16, + XCP_CPB_MODIFY_OBJECTS = 17, + XCP_CPB_RNG_SEED = 18, + XCP_CPB_ALG_RAW_RSA = 19, + XCP_CPB_ALG_NFIPS2009 = 20, + XCP_CPB_ALG_NBSI2009 = 21, + XCP_CPB_KEYSZ_HMAC_ANY = 22, + XCP_CPB_KEYSZ_BELOW80BIT = 23, + XCP_CPB_KEYSZ_80BIT = 24, + XCP_CPB_KEYSZ_112BIT = 25, + XCP_CPB_KEYSZ_128BIT = 26, + XCP_CPB_KEYSZ_192BIT = 27, + XCP_CPB_KEYSZ_256BIT = 28, + XCP_CPB_KEYSZ_RSA65536 = 29, + XCP_CPB_ALG_RSA = 30, + XCP_CPB_ALG_DSA = 31, + XCP_CPB_ALG_EC = 32, + XCP_CPB_ALG_EC_BPOOLCRV = 33, + XCP_CPB_ALG_EC_NISTCRV = 34, + XCP_CPB_ALG_NFIPS2011 = 35, + XCP_CPB_ALG_NBSI2011 = 36, + XCP_CPB_USER_SET_TRUSTED = 37, + XCP_CPB_ALG_SKIP_CROSSCHK = 38, + XCP_CPB_WRAP_CRYPT_KEYS = 39, + XCP_CPB_SIGN_CRYPT_KEYS = 40, + XCP_CPB_WRAP_SIGN_KEYS = 41, + XCP_CPB_USER_SET_ATTRBOUND = 42, + XCP_CPB_ALLOW_PASSPHRASE = 43, + XCP_CPB_WRAP_STRONGER_KEY = 44, + XCP_CPB_WRAP_WITH_RAW_SPKI = 45, + XCP_CPB_ALG_DH = 46, + XCP_CPB_DERIVE = 47, + XCP_CPB_ALLOW_NONSESSION = 48, + XCP_CPB_ALG_EC_25519 = 55, + XCP_CPB_ALG_EC_SECGCRV = 60, + XCP_CPB_ALG_NBSI2017 = 61, + XCP_CPB_CPACF_PK = 64, + XCP_CPB_ALG_PQC = 65, + XCP_CPB_BTC = 66, + XCP_CPB_ECDSA_OTHER = 67, + XCP_CPB_ALG_NFIPS2021 = 68, + XCP_CPB_ALG_NFIPS2024 = 69, + XCP_CPB_COMPAT_LEGACY_SHA3 = 70, + XCP_CPB_DSA_PARAMETER_GEN = 71, + XCP_CPB_DERIVE_NON_AB_KEYS = 72, + XCP_CPBITS_MAX = XCP_CPB_DERIVE_NON_AB_KEYS +} XCP_CPbit_t; +#define XCP_CPCOUNT \ + (((XCP_CPBITS_MAX +XCP_CPBLOCK_BITS-1) /XCP_CPBLOCK_BITS) *XCP_CPBLOCK_BITS) +#define XCP_CP_BYTES (XCP_CPCOUNT /8) +#define XCP_CPB__INVERT (XCP_CPCOUNT-1) +#define XCP_ADM_QUERY 0x10000 +typedef enum { + XCP_ADM_ADMIN_LOGIN = 1, + XCP_ADM_DOM_ADMIN_LOGIN = 2, + XCP_ADM_ADMIN_LOGOUT = 3, + XCP_ADM_DOM_ADMIN_LOGOUT = 4, + XCP_ADM_ADMIN_REPLACE = 5, + XCP_ADM_DOM_ADMIN_REPLACE = 6, + XCP_ADM_SET_ATTR = 7, + XCP_ADM_DOM_SET_ATTR = 8, + XCP_ADM_GEN_DOM_IMPORTER = 9, + XCP_ADM_GEN_WK = 10, + XCP_ADM_EXPORT_WK = 11, + XCP_ADM_EXPORT_NEXT_WK = 38, + XCP_ADM_IMPORT_WK = 12, + XCP_ADM_COMMIT_WK = 13, + XCP_ADM_FINALIZE_WK = 14, + XCP_ADM_ZEROIZE = 15, + XCP_ADM_DOM_ZEROIZE = 16, + XCP_ADM_DOM_CTRLPOINT_SET = 17, + XCP_ADM_DOM_CTRLPOINT_ADD = 18, + XCP_ADM_DOM_CTRLPOINT_DEL = 19, + XCP_ADM_SET_CLOCK = 20, + XCP_ADM_SET_FCV = 21, + XCP_ADM_CTRLPOINT_SET = 22, + XCP_ADM_CTRLPOINT_ADD = 23, + XCP_ADM_CTRLPOINT_DEL = 24, + XCP_ADM_REENCRYPT = 25, + XCP_ADM_RK_REMOVE = 26, + XCP_ADM_CLEAR_WK = 27, + XCP_ADM_CLEAR_NEXT_WK = 28, + XCP_ADM_SYSTEM_ZEROIZE = 29, + XCP_ADM_EXPORT_STATE = 30, + XCP_ADM_IMPORT_STATE = 31, + XCP_ADM_COMMIT_STATE = 32, + XCP_ADM_REMOVE_STATE = 33, + XCP_ADM_GEN_MODULE_IMPORTER= 34, + XCP_ADM_SET_TRUSTED = 35, + XCP_ADM_DOMAINS_ZEROIZE = 36, + XCP_ADM_SESSION_REMOVE = 39, + XCP_ADMQ_ADMIN = 1 | XCP_ADM_QUERY, + XCP_ADMQ_DOMADMIN = 2 | XCP_ADM_QUERY, + XCP_ADMQ_DEVICE_CERT = 3 | XCP_ADM_QUERY, + XCP_ADMQ_DOM_IMPORTER_CERT = 4 | XCP_ADM_QUERY, + XCP_ADMQ_CTRLPOINTS = 5 | XCP_ADM_QUERY, + XCP_ADMQ_DOM_CTRLPOINTS = 6 | XCP_ADM_QUERY, + XCP_ADMQ_WK = 7 | XCP_ADM_QUERY, + XCP_ADMQ_NEXT_WK = 8 | XCP_ADM_QUERY, + XCP_ADMQ_ATTRS = 9 | XCP_ADM_QUERY, + XCP_ADMQ_DOM_ATTRS = 10 | XCP_ADM_QUERY, + XCP_ADMQ_FCV = 11 | XCP_ADM_QUERY, + XCP_ADMQ_WK_ORIGINS = 12 | XCP_ADM_QUERY, + XCP_ADMQ_RKLIST = 13 | XCP_ADM_QUERY, + XCP_ADMQ_INTERNAL_STATE = 14 | XCP_ADM_QUERY, + XCP_ADMQ_IMPORTER_CERT = 15 | XCP_ADM_QUERY, + XCP_ADMQ_AUDIT_STATE = 16 | XCP_ADM_QUERY, + XCP_ADMQ_LASTCMD_DOM_MASK = 17 | XCP_ADM_QUERY, + XCP_ADMQ_SVCADMIN = 18 | XCP_ADM_QUERY, +} XCP_Admcmd_t; +typedef enum { + XCP_ADMINT_SIGN_THR = 1, + XCP_ADMINT_REVOKE_THR = 2, + XCP_ADMINT_PERMS = 3, + XCP_ADMINT_MODE = 4, + XCP_ADMINT_STD = 5, + XCP_ADMINT_PERMS_EXT01 = 6, + XCP_ADMINT_IDX_MAX = XCP_ADMINT_PERMS_EXT01 +} XCP_AdmAttr_t; +#define XCP_ADMIN_ATTRIBUTE_COUNT XCP_ADMINT_IDX_MAX +#define XCP_ADM_SIGTHR__DEFAULT 0 +#define XCP_ADM_REVTHR__DEFAULT 0 +#define XCP_ADMP_WK_IMPORT 1 +#define XCP_ADMP_WK_EXPORT 2 +#define XCP_ADMP_WK_1PART 4 +#define XCP_ADMP_WK_RANDOM 8 +#define XCP_ADMP_1SIGN 0x10 +#define XCP_ADMP_CP_1SIGN 0x20 +#define XCP_ADMP_ZERO_1SIGN 0x40 +#define XCP_ADMP_NO_DOMAIN_IMPRINT \ + 0x0080 +#define XCP_ADMP_STATE_IMPORT 0x0100 +#define XCP_ADMP_STATE_EXPORT 0x0200 +#define XCP_ADMP_STATE_1PART 0x0400 +#define XCP_ADMP_DO_NOT_DISTURB 0x2000 +#define XCP_ADMP_CHG_WK_IMPORT 0x10000 +#define XCP_ADMP_CHG_WK_EXPORT 0x20000 +#define XCP_ADMP_CHG_WK_1PART 0x40000 +#define XCP_ADMP_CHG_WK_RANDOM 0x80000 +#define XCP_ADMP_CHG_SIGN_THR 0x100000 +#define XCP_ADMP_CHG_REVOKE_THR 0x200000 +#define XCP_ADMP_CHG_1SIGN 0x400000 +#define XCP_ADMP_CHG_CP_1SIGN 0x800000 +#define XCP_ADMP_CHG_ZERO_1SIGN \ + 0x01000000 +#define XCP_ADMP_CHG_ST_IMPORT \ + 0x02000000 +#define XCP_ADMP_CHG_ST_EXPORT \ + 0x04000000 +#define XCP_ADMP_CHG_ST_1PART 0x08000000 +#define XCP_ADMP_CHG_DO_NOT_DISTURB \ + 0x80000000 +#define XCP_ADMP_NQS_OA_SIGNATURES 1 +#define XCP_ADMP_QS_OA_SIGNATURES 2 +#define XCP_ADMP_NQS_ADM_SIGNATURES 4 +#define XCP_ADMP_QS_ADM_SIGNATURES 8 +#define XCP_ADMP_CHG_NQS_OA_SIGNATURES \ + 0x10000 +#define XCP_ADMP_CHG_QS_OA_SIGNATURES \ + 0x20000 +#define XCP_ADMP_CHG_NQS_ADM_SIGNATURES \ + 0x40000 +#define XCP_ADMP_CHG_QS_ADM_SIGNATURES \ + 0x80000 +#define XCP_ADMP__CHGBITS \ + (XCP_ADMP_CHG_WK_IMPORT | \ + XCP_ADMP_CHG_WK_EXPORT | \ + XCP_ADMP_CHG_WK_1PART | \ + XCP_ADMP_CHG_WK_RANDOM | \ + XCP_ADMP_CHG_SIGN_THR | \ + XCP_ADMP_CHG_REVOKE_THR | \ + XCP_ADMP_CHG_1SIGN | \ + XCP_ADMP_CHG_CP_1SIGN | \ + XCP_ADMP_CHG_ZERO_1SIGN | \ + XCP_ADMP_CHG_ST_IMPORT | \ + XCP_ADMP_CHG_ST_EXPORT | \ + XCP_ADMP_CHG_ST_1PART | \ + XCP_ADMP_CHG_DO_NOT_DISTURB) +#define XCP_ADMP__PERMS \ + (XCP_ADMP_WK_IMPORT | \ + XCP_ADMP_WK_EXPORT | \ + XCP_ADMP_WK_1PART | \ + XCP_ADMP_WK_RANDOM | \ + XCP_ADMP_1SIGN | \ + XCP_ADMP_CP_1SIGN | \ + XCP_ADMP_ZERO_1SIGN | \ + XCP_ADMP_NO_DOMAIN_IMPRINT | \ + XCP_ADMP_STATE_IMPORT | \ + XCP_ADMP_STATE_EXPORT | \ + XCP_ADMP_STATE_1PART | \ + XCP_ADMP_DO_NOT_DISTURB) +#define XCP_ADMP__CHGBITS_EXT01 \ + (XCP_ADMP_CHG_NQS_OA_SIGNATURES | \ + XCP_ADMP_CHG_QS_OA_SIGNATURES | \ + XCP_ADMP_CHG_NQS_ADM_SIGNATURES | \ + XCP_ADMP_CHG_QS_ADM_SIGNATURES) +#define XCP_ADMP__PERMS_EXT01 \ + (XCP_ADMP_NQS_OA_SIGNATURES | \ + XCP_ADMP_QS_OA_SIGNATURES | \ + XCP_ADMP_NQS_ADM_SIGNATURES | \ + XCP_ADMP_QS_ADM_SIGNATURES) +#define XCP__ADMP_SUP_EXT01 (XCP_ADMP__PERMS_EXT01 | \ + XCP_ADMP__CHGBITS_EXT01) +#define XCP_ADMP__DEFAULT \ + (XCP_ADMP_WK_IMPORT | \ + XCP_ADMP_1SIGN | \ + XCP_ADMP__CHGBITS) +#define XCP_ADMP__DEFAULT_EXT01 \ + (XCP_ADMP__CHGBITS_EXT01 | \ + XCP_ADMP_NQS_OA_SIGNATURES | \ + XCP_ADMP_QS_OA_SIGNATURES | \ + XCP_ADMP_NQS_ADM_SIGNATURES | \ + XCP_ADMP_QS_ADM_SIGNATURES) +#define XCPM_ADMP__MODULE_DEFAULTS_MASK \ + (XCP_ADMP_DO_NOT_DISTURB | \ + XCP_ADMP_CHG_DO_NOT_DISTURB) +#define XCPM_ADMP__MODULE_DEFAULTS_MASK_EXT01 \ + (XCP_ADMP_NQS_OA_SIGNATURES | \ + XCP_ADMP_CHG_NQS_OA_SIGNATURES | \ + XCP_ADMP_QS_OA_SIGNATURES | \ + XCP_ADMP_CHG_QS_OA_SIGNATURES | \ + XCP_ADMP_NQS_ADM_SIGNATURES | \ + XCP_ADMP_CHG_NQS_ADM_SIGNATURES | \ + XCP_ADMP_QS_ADM_SIGNATURES | \ + XCP_ADMP_CHG_QS_ADM_SIGNATURES) +#define XCP_ADMP__CARD_MASK \ + ~(XCP_ADMP_WK_IMPORT | \ + XCP_ADMP_WK_EXPORT | \ + XCP_ADMP_WK_1PART | \ + XCP_ADMP_WK_RANDOM | \ + XCP_ADMP_CP_1SIGN | \ + XCP_ADMP_CHG_WK_IMPORT | \ + XCP_ADMP_CHG_WK_EXPORT | \ + XCP_ADMP_CHG_WK_1PART | \ + XCP_ADMP_CHG_WK_RANDOM | \ + XCP_ADMP_CHG_CP_1SIGN) +#define XCP_ADMP__CARD_MASK_EXT01 \ + ~(0U) +#define XCP_ADMP__DOM_MASK \ + ~(XCP_ADMP_NO_DOMAIN_IMPRINT | \ + XCP_ADMP_STATE_IMPORT | \ + XCP_ADMP_STATE_EXPORT | \ + XCP_ADMP_STATE_1PART | \ + XCP_ADMP_CHG_ST_IMPORT | \ + XCP_ADMP_CHG_ST_EXPORT | \ + XCP_ADMP_CHG_ST_1PART) +#define XCP_ADMP__DOM_MASK_EXT01 \ + ~(0U) +#define XCP__ADMP_SUP ((XCP_ADMP__PERMS | XCP_ADMP__CHGBITS) &\ + ~XCP_ADMP_NOT_SUP) +#define XCP_ADMM_AUTHENTICATED 1U +#define XCP_ADMM_EXTWNG 2U +#define XCP_ADMM_STR_112BIT 4U +#define XCP_ADMM_STR_128BIT 8U +#define XCP_ADMM_STR_160BIT 0x10U +#define XCP_ADMM_STR_192BIT 0x20U +#define XCP_ADMM_STR_256BIT 0x40U +#define XCP_ADMM_WKCLEAN_EXTWNG 0x80U +#define XCP_ADMM_BATT_LOW 0x0100U +#define XCP_ADMM_API_ACTIVE 0x0200U +#define XCP_ADMM__DEFAULT \ + (XCP_ADMM_EXTWNG | \ + XCP_ADMM_API_ACTIVE) +#define XCP_ADMM__MASK \ + (XCP_ADMM_AUTHENTICATED | \ + XCP_ADMM_EXTWNG | \ + XCP_ADMM_STR_112BIT | \ + XCP_ADMM_STR_128BIT | \ + XCP_ADMM_STR_160BIT | \ + XCP_ADMM_STR_192BIT | \ + XCP_ADMM_STR_256BIT | \ + XCP_ADMM_WKCLEAN_EXTWNG | \ + XCP_ADMM_BATT_LOW | \ + XCP_ADMM_API_ACTIVE) +#define XCP_ADMM__CARD_ONLY_ATTR \ + (XCP_ADMM_EXTWNG | \ + XCP_ADMM_WKCLEAN_EXTWNG | \ + XCP_ADMM_API_ACTIVE) +#define XCP_ADMM__READ_ONLY_ATTR \ + (XCP_ADMM_AUTHENTICATED | \ + XCP_ADMM_BATT_LOW) +#define XCP__ADMM_ADMSTR \ + (XCP_ADMM_STR_112BIT | \ + XCP_ADMM_STR_128BIT | \ + XCP_ADMM_STR_160BIT | \ + XCP_ADMM_STR_192BIT | \ + XCP_ADMM_STR_256BIT) +#define XCP__ADMM_SUP XCP_ADMM__MASK +#define XCP_ADMS_FIPS2009 1 +#define XCP_ADMS_BSI2009 2 +#define XCP_ADMS_FIPS2011 4 +#define XCP_ADMS_BSI2011 8 +#define XCP_ADMS_SIGG_IMPORT 0x10 +#define XCP_ADMS_SIGG 0x20 +#define XCP_ADMS_BSICC2017 0x40 +#define XCP_ADMS_FIPS2021 0x80 +#define XCP_ADMS_FIPS2024 0x100 +#define XCP_ADMS_ADM_FIPS2021 0x200 +#define XCP_ADMS__ALL \ + (XCP_ADMS_FIPS2009 | \ + XCP_ADMS_BSI2009 | \ + XCP_ADMS_FIPS2011 | \ + XCP_ADMS_BSI2011 | \ + XCP_ADMS_BSICC2017 | \ + XCP_ADMS_FIPS2021 | \ + XCP_ADMS_FIPS2024 | \ + XCP_ADMS_ADM_FIPS2021) +#define XCP_ADMS__SUPP (XCP_ADMS__ALL & \ + ~(XCP_ADMS_FIPS2021 | \ + XCP_ADMS_ADM_FIPS2021 | \ + XCP_ADMS_FIPS2024)) +#define XCP__ADMP_SUP_LEGACY \ + (XCP_ADMP_WK_IMPORT | \ + XCP_ADMP_WK_EXPORT | \ + XCP_ADMP_WK_1PART | \ + XCP_ADMP_WK_RANDOM | \ + XCP_ADMP_1SIGN | \ + XCP_ADMP_CP_1SIGN | \ + XCP_ADMP_ZERO_1SIGN | \ + XCP_ADMP_NO_DOMAIN_IMPRINT | \ + XCP_ADMP_STATE_IMPORT | \ + XCP_ADMP_STATE_EXPORT | \ + XCP_ADMP_STATE_1PART | \ + XCP_ADMP_CHG_WK_IMPORT | \ + XCP_ADMP_CHG_WK_EXPORT | \ + XCP_ADMP_CHG_WK_1PART | \ + XCP_ADMP_CHG_WK_RANDOM | \ + XCP_ADMP_CHG_SIGN_THR | \ + XCP_ADMP_CHG_REVOKE_THR | \ + XCP_ADMP_CHG_1SIGN | \ + XCP_ADMP_CHG_CP_1SIGN | \ + XCP_ADMP_CHG_ZERO_1SIGN | \ + XCP_ADMP_CHG_ST_IMPORT | \ + XCP_ADMP_CHG_ST_EXPORT | \ + XCP_ADMP_CHG_ST_1PART) +#define XCP__ADMM_SUP_LEGACY \ + (XCP_ADMM_AUTHENTICATED | \ + XCP_ADMM_EXTWNG | \ + XCP_ADMM_WKCLEAN_EXTWNG | \ + XCP_ADMM_BATT_LOW | \ + XCP_ADMM_API_ACTIVE) +#define XCP_ADMS__ALL_LEGACY \ + (XCP_ADMS_FIPS2009 | \ + XCP_ADMS_BSI2009 | \ + XCP_ADMS_FIPS2011 | \ + XCP_ADMS_BSI2011 | \ + XCP_ADMS_BSICC2017) +#define XCP__ADMP_SUP_EXT01_LEGACY (0) +#define XCP_ADMS_IS_BSI(mode) (!!((mode) & (XCP_ADMS_BSI2009 | \ + XCP_ADMS_BSI2011 | \ + XCP_ADMS_BSICC2017 )) ) +#define XCP_ADM_IMPEXP_KEYS__MASK \ + ((1 << XCP_IMPRKEY_RSA_2048) | \ + (1 << XCP_IMPRKEY_EC_P256) | \ + (1 << XCP_IMPRKEY_EC_P521) | \ + (1 << XCP_IMPRKEY_EC_BP256r) | \ + (1 << XCP_IMPRKEY_EC_BP320r) | \ + (1 << XCP_IMPRKEY_EC_BP512r) | \ + (1 << XCP_IMPRKEY_EC_P521_TKE)) +#define XCP_LOG_KEYREC_BYTES 24 +#define XCP_LOG_SEQNR_BYTES 6 +#define XCP_LOG_INSTANCEID_BYTES 2 +#define XCP_LOG_TIMET_BYTES (4+2) +#define XCP_LOG_SEQNR_OFFSET ((size_t) 4) +#define XCP_LOG_SEQPRF_BASE_BYTES \ + ((size_t) XCP_LOG_SEQNR_BYTES +XCP_LOG_TIMET_BYTES) +#define XCP_LOG_COMPLIANCE_BYTES 8 +#define XCP_LOG_REASON_BYTES 4 +#define XCP_LOG_SALTUNIT_BYTES 4 +#define XCP_LOG_SALT_MAX_UNITS 3 +#define XCP_LOG_SALT_MAX_BYTES \ + (XCP_LOG_SALT_MAX_UNITS * XCP_LOG_SALTUNIT_BYTES) +#define XCP_LOG_PRFSALT_BYTES ((size_t) 64/8) +#define XCP_LOG_CONTEXT_BYTES \ + (2* XCP_SERIALNR_CHARS+ \ + 2+2+ \ + 4+4+ \ + 4+4 ) +#define XCP_LOG_OPTFIELD_MAX_BYTES \ + (2* XCP_WK_BYTES + \ + XCP_LOG_COMPLIANCE_BYTES + \ + 3* XCP_LOG_KEYREC_BYTES + \ + XCP_LOG_TIMET_BYTES + \ + XCP_LOG_COMPLIANCE_BYTES + \ + XCP_LOG_REASON_BYTES + \ + XCP_LOG_SALT_MAX_BYTES) +#define XCP_LOG_HEADER_BYTES \ + (1+1+2 + \ + XCP_LOG_SEQNR_BYTES + \ + XCP_LOG_TIMET_BYTES) +#define XCP_LOG_ENTRY_MAX_BYTES \ + (XCP_LOG_HEADER_BYTES + \ + XCP_LOG_STATE_BYTES + \ + XCP_LOG_CONTEXT_BYTES + \ + XCP_LOG_OPTFIELD_MAX_BYTES + \ + XCP_LOG_STATE_BYTES) +typedef enum { + XCP_STSTYPE_SECTIONCOUNT = 1, + XCP_STSTYPE_DOMAINIDX_MAX = 2, + XCP_STSTYPE_DOMAINS_MASK = 3, + XCP_STSTYPE_SERIALNR = 4, + XCP_STSTYPE_CREATE_TIME = 5, + XCP_STSTYPE_FCV = 6, + XCP_STSTYPE_CARD_QUERY = 7, + XCP_STSTYPE_CARD_ADM_SKIS = 8, + XCP_STSTYPE_CARD_ADM_CERTS = 9, + XCP_STSTYPE_DOM_ADM_SKIS = 10, + XCP_STSTYPE_DOM_ADM_CERTS = 11, + XCP_STSTYPE_DOM_QUERY = 12, + XCP_STSTYPE_KPH_SKIS = 13, + XCP_STSTYPE_CARD_ATTRS = 14, + XCP_STSTYPE_DOM_ATTRS = 15, + XCP_STSTYPE_CARD_TRANSCTR = 16, + XCP_STSTYPE_DOM_TRANSCTR = 17, + XCP_STSTYPE_WK_ENCR_ALG = 18, + XCP_STSTYPE_WK_ENCR_DATA = 19, + XCP_STSTYPE_SIG_CERT_COUNT = 20, + XCP_STSTYPE_SIG_CERTS = 21, + XCP_STSTYPE_FILE_SIG = 22, + XCP_STSTYPE_DOM_CPS = 23, + XCP_STSTYPE_STATE_SALT = 24, + XCP_STSTYPE_KEYPART = 25, + XCP_STSTYPE_KEYPART_SIG = 26, + XCP_STSTYPE_KEYPART_COUNT = 27, + XCP_STSTYPE_KEYPART_LIMIT = 28, + XCP_STSTYPE_KEYPART_CERT = 29, + XCP_STSTYPE_CERT_AUTH = 30, + XCP_STSTYPE_STATE_SCOPE = 31, + XCP_STSTYPE_MULTIIMPORT_MASK = 32, + XCP_STSTYPE_CPS_MASK = 33, + XCP_STSTYPE_CARD_QUERY_V1 = 34, + XCP_STSTYPE_CARD_QUERY_V2 = 35, + XCP_STSTYPE_CARD_EXTADM_SKIS = 36, + XCP_STSTYPE_CARD_EXTADM_CERTS = 37, + XCP_STSTYPE_DOM_EXTADM_SKIS = 38, + XCP_STSTYPE_DOM_EXTADM_CERTS = 39, + XCP_STSTYPE_MAX = XCP_STSTYPE_DOM_EXTADM_CERTS +} XCP_StateSection_t; +typedef enum { + XCP_STALG_AES256_CBC = 1 +} XCP_StateEncrAlg_t; +typedef enum { + XCP_FILEID_SAVED_STATE = 1, + XCP_FILEID_KEYPARTS = 2, + XCP_FILEID_TESTDATA = 3, + XCP_FILEID_EXPREQUEST = 4, + XCP_FILEID_MAX = XCP_FILEID_EXPREQUEST +} XCP_FileId_t; +typedef enum { + XCP_STDATA_DOMAIN = 1, + XCP_STDATA_NONSENSITIVE = 2, + XCP_STWK_KP_NO_CERT = 4, + XCP_STWK_KP_NO_OA_CHAIN = 8, + XCP_STDATA_NQS = 0x20, + XCP_STDATA_QS = 0x40, + XCP_STDATA_MAX = ((XCP_STDATA_QS *2) -1) +} XCP_StateType_t; +#define XCP_STSTYPE_TYPE_BYTES 2 +#define XCP_STSTYPE_TYPEID_BYTES 4 +#define XCP_EC_P192 "\x06\x08\x2a\x86\x48\xce\x3d\x03\x01\x01" +#define XCP_EC_P192_BYTES 10 +#define XCP_EC_P224 "\x06\x05\x2b\x81\x04\x00\x21" +#define XCP_EC_P224_BYTES 7 +#define XCP_EC_P256 "\x06\x08\x2a\x86\x48\xce\x3d\x03\x01\x07" +#define XCP_EC_P256_BYTES 10 +#define XCP_EC_P384 "\x06\x05\x2b\x81\x04\x00\x22" +#define XCP_EC_P384_BYTES 7 +#define XCP_EC_P521 "\x06\x05\x2b\x81\x04\x00\x23" +#define XCP_EC_P521_BYTES 7 +#define XCP_EC_P192_NAME "\x50\x2d\x31\x39\x32" +#define XCP_EC_P192_NAME_BYTES 5 +#define XCP_EC_P224_NAME "\x50\x2d\x32\x32\x34" +#define XCP_EC_P224_NAME_BYTES 5 +#define XCP_EC_P256_NAME "\x50\x2d\x32\x35\x36" +#define XCP_EC_P256_NAME_BYTES 5 +#define XCP_EC_P384_NAME "\x50\x2d\x33\x38\x34" +#define XCP_EC_P384_NAME_BYTES 5 +#define XCP_EC_P521_NAME "\x50\x2d\x35\x32\x31" +#define XCP_EC_P521_NAME_BYTES 5 +#define XCP_EC_BP160R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x01" +#define XCP_EC_BP160R_BYTES 11 +#define XCP_EC_BP160T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x02" +#define XCP_EC_BP160T_BYTES 11 +#define XCP_EC_BP192R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x03" +#define XCP_EC_BP192R_BYTES 11 +#define XCP_EC_BP192T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x04" +#define XCP_EC_BP192T_BYTES 11 +#define XCP_EC_BP224R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x05" +#define XCP_EC_BP224R_BYTES 11 +#define XCP_EC_BP224T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x06" +#define XCP_EC_BP224T_BYTES 11 +#define XCP_EC_BP256R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x07" +#define XCP_EC_BP256R_BYTES 11 +#define XCP_EC_BP256T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x08" +#define XCP_EC_BP256T_BYTES 11 +#define XCP_EC_BP320R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x09" +#define XCP_EC_BP320R_BYTES 11 +#define XCP_EC_BP320T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x0a" +#define XCP_EC_BP320T_BYTES 11 +#define XCP_EC_BP384R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x0b" +#define XCP_EC_BP384R_BYTES 11 +#define XCP_EC_BP384T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x0c" +#define XCP_EC_BP384T_BYTES 11 +#define XCP_EC_BP512R "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x0d" +#define XCP_EC_BP512R_BYTES 11 +#define XCP_EC_BP512T "\x06\x09\x2b\x24\x03\x03\x02\x08\x01\x01\x0e" +#define XCP_EC_BP512T_BYTES 11 +#define XCP_EC_BPOID_BYTES 11 +#define XCP_EC_BPOIDS 14 +#define XCP_EC_BP160R_NAME "\x42\x50\x2d\x31\x36\x30\x52" +#define XCP_EC_BP160R_NAME_BYTES 7 +#define XCP_EC_BP160T_NAME "\x42\x50\x2d\x31\x36\x30\x54" +#define XCP_EC_BP160T_NAME_BYTES 7 +#define XCP_EC_BP192R_NAME "\x42\x50\x2d\x31\x39\x32\x52" +#define XCP_EC_BP192R_NAME_BYTES 7 +#define XCP_EC_BP192T_NAME "\x42\x50\x2d\x31\x39\x32\x54" +#define XCP_EC_BP192T_NAME_BYTES 7 +#define XCP_EC_BP224R_NAME "\x42\x50\x2d\x32\x32\x34\x52" +#define XCP_EC_BP224R_NAME_BYTES 7 +#define XCP_EC_BP224T_NAME "\x42\x50\x2d\x32\x32\x34\x54" +#define XCP_EC_BP224T_NAME_BYTES 7 +#define XCP_EC_BP256R_NAME "\x42\x50\x2d\x32\x35\x36\x52" +#define XCP_EC_BP256R_NAME_BYTES 7 +#define XCP_EC_BP256T_NAME "\x42\x50\x2d\x32\x35\x36\x54" +#define XCP_EC_BP256T_NAME_BYTES 7 +#define XCP_EC_BP320R_NAME "\x42\x50\x2d\x33\x32\x30\x52" +#define XCP_EC_BP320R_NAME_BYTES 7 +#define XCP_EC_BP320T_NAME "\x42\x50\x2d\x33\x32\x30\x54" +#define XCP_EC_BP320T_NAME_BYTES 7 +#define XCP_EC_BP384R_NAME "\x42\x50\x2d\x33\x38\x34\x52" +#define XCP_EC_BP384R_NAME_BYTES 7 +#define XCP_EC_BP384T_NAME "\x42\x50\x2d\x33\x38\x34\x54" +#define XCP_EC_BP384T_NAME_BYTES 7 +#define XCP_EC_BP512R_NAME "\x42\x50\x2d\x35\x31\x32\x52" +#define XCP_EC_BP512R_NAME_BYTES 7 +#define XCP_EC_BP512T_NAME "\x42\x50\x2d\x35\x31\x32\x54" +#define XCP_EC_BP512T_NAME_BYTES 7 +#define XCP_EC_S256K1 "\x06\x05" "\x2b\x81\x04\x00\x0a" +#define XCP_EC_S256K1_BYTES 7 +#define XCP_EC_S256K1_NAME "\x53\x45\x43\x50\x32\x35\x36\x4b\x31" +#define XCP_EC_S256K1_NAME_BYTES 9 +#define XCP_EC_X25519 "\x06\x03\x2b\x65\x6e" +#define XCP_EC_X25519_BYTES 5 +#define XCP_EC_X25519_NAME "\x63\x75\x72\x76\x65\x32\x35\x35\x31\x39" +#define XCP_EC_X25519_NAME_BYTES 10 +#define XCP_EC_X448 "\x06\x03\x2b\x65\x6f" +#define XCP_EC_X448_BYTES 5 +#define XCP_EC_X448_NAME "\x78\x34\x34\x38" +#define XCP_EC_X448_NAME_BYTES 4 +#define XCP_EC_DSA25519 "\x06\x03\x2b\x65\x70" +#define XCP_EC_DSA25519_BYTES 5 +#define XCP_EC_DSA25519_NAME "\x65\x64\x32\x35\x35\x31\x39" +#define XCP_EC_DSA25519_NAME_BYTES 7 +#define XCP_EC_DSA448 "\x06\x03\x2b\x65\x71" +#define XCP_EC_DSA448_BYTES 5 +#define XCP_EC_DSA448_NAME "\x65\x64\x34\x34\x38" +#define XCP_EC_DSA448_NAME_BYTES 5 +#define XCP_EC_MAX_ID_BYTES 11 +typedef enum { + XCP_EC_C_NIST_P192 = 1, + XCP_EC_C_NIST_P224 = 2, + XCP_EC_C_NIST_P256 = 3, + XCP_EC_C_NIST_P384 = 4, + XCP_EC_C_NIST_P521 = 5, + XCP_EC_C_BP160R = 6, + XCP_EC_C_BP160T = 7, + XCP_EC_C_BP192R = 8, + XCP_EC_C_BP192T = 9, + XCP_EC_C_BP224R = 10, + XCP_EC_C_BP224T = 11, + XCP_EC_C_BP256R = 12, + XCP_EC_C_BP256T = 13, + XCP_EC_C_BP320R = 14, + XCP_EC_C_BP320T = 15, + XCP_EC_C_BP384R = 16, + XCP_EC_C_BP384T = 17, + XCP_EC_C_BP512R = 18, + XCP_EC_C_BP512T = 19, + XCP_EC_C_25519 = 20, + XCP_EC_C_SECP256K1 = 23, + XCP_EC_C_ED448 = 24, + XCP_EC_C_448 = 25, + XCP_EC_C_ED25519 = 26, + XCP_EC_C_MAX = 27 +} XCP_ECcurve_t; +typedef enum { + XCP_EC_CG_NIST = 1, + XCP_EC_CG_BPOOL = 2, + XCP_EC_CG_C25519 = 3, + XCP_EC_CG_SECP256K1 = 4, + XCP_EC_CG_C448 = 6, + XCP_EC_CG_MAX = XCP_EC_CG_C448 +} XCP_ECCurveGrp_t; +#define XCP_PQC_DILITHIUM_R2_54 "\x6\xb\x2b\x6\x1\x4\x1\x2\x82\xb\x1\x5\x4" +#define XCP_PQC_DILITHIUM_R2_54_BYTES 13 +#define XCP_PQC_DILITHIUM_R2_65 "\x6\xb\x2b\x6\x1\x4\x1\x2\x82\xb\x1\x6\x5" +#define XCP_PQC_DILITHIUM_R2_65_BYTES 13 +#define XCP_PQC_DILITHIUM_R2_87 "\x6\xb\x2b\x6\x1\x4\x1\x2\x82\xb\x1\x8\x7" +#define XCP_PQC_DILITHIUM_R2_87_BYTES 13 +#define XCP_PQC_DILITHIUM_R3_44 "\x6\xb\x2b\x6\x1\x4\x1\x2\x82\xb\x7\x4\x4" +#define XCP_PQC_DILITHIUM_R3_44_BYTES 13 +#define XCP_PQC_DILITHIUM_R3_65 "\x6\xb\x2b\x6\x1\x4\x1\x2\x82\xb\x7\x6\x5" +#define XCP_PQC_DILITHIUM_R3_65_BYTES 13 +#define XCP_PQC_DILITHIUM_R3_87 "\x6\xb\x2b\x6\x1\x4\x1\x2\x82\xb\x7\x8\x7" +#define XCP_PQC_DILITHIUM_R3_87_BYTES 13 +#define XCP_PQC_KYBER_R2_512 "\x6\x9\x2B\x6\x1\x4\x1\x2\x82\xB\x5" +#define XCP_PQC_KYBER_R2_512_BYTES 11 +#define XCP_PQC_KYBER_R2_768 "\x6\xB\x2B\x6\x1\x4\x1\x2\x82\xB\x5\x3\x3" +#define XCP_PQC_KYBER_R2_768_BYTES 13 +#define XCP_PQC_KYBER_R2_1024 "\x6\xB\x2B\x6\x1\x4\x1\x2\x82\xB\x5\x4\x4" +#define XCP_PQC_KYBER_R2_1024_BYTES 13 +typedef enum { + XCP_PQC_S_DILITHIUM_R2_54 = 1, + XCP_PQC_S_DILITHIUM_R2_65 = 2, + XCP_PQC_S_DILITHIUM_R2_87 = 3, + XCP_PQC_S_DILITHIUM_R3_44 = 4, + XCP_PQC_S_DILITHIUM_R3_65 = 5, + XCP_PQC_S_DILITHIUM_R3_87 = 6, + XCP_PQC_S_KYBER_R2_512 = 7, + XCP_PQC_S_KYBER_R2_768 = 8, + XCP_PQC_S_KYBER_R2_1024 = 9, + XCP_PQC_MAX = XCP_PQC_S_KYBER_R2_1024, +} XCP_PQCStrength_t; +#define XCP_VERS_QUERY_REQ 0x30,0x03,0x04,0x01,0x00 +#define XCP_VERS_QUERY_REQ_BYTES 5 +typedef enum { + XCP_DEV_SET_WK = 1, + XCP_DEV_SET_NEXT_WK = 2, + XCP_DEV_AES_ENCR_CYCLE = 3, + XCP_DEV_AES_DECR_CYCLE = 4, + XCP_DEV_DES_ENCR_CYCLE = 5, + XCP_DEV_DES_DECR_CYCLE = 6, + XCP_DEV_ZEROIZE_CARD = 7, + XCP_DEV_ZEROIZE_DOMAIN = 8, + XCP_DEV_SET_DOMAIN_CPS = 9, + XCP_DEV_SET_WK_RAW = 10, + XCP_DEV_COMMIT_NEXT_WK = 11, + XCP_DEVQ_ADMINLIST = 12, + XCP_DEVQ_DOM_ADMINLIST = 13, + XCP_DEV_SET_NEXT_WK_RAW = 14, + XCP_DEV_FSMODE = 15, + XCP_DEV_ADMSIGN = 16, + XCP_DEV_FSWRITE = 17, + XCP_DEV_DSA_PQG_GEN = 18, + XCP_DEVQ_BLOBCONFIG = 19, + XCP_DEV_RSA_X931_KEYGEN = 20, + XCP_DEV_RNGSTATE = 21, + XCP_DEV_RNG_SEED = 22, + XCP_DEVQ_ENTROPY = 23, + XCP_DEVQ_PERFMODE = 24, + XCP_DEV_PERFMODE = 25, + XCP_DEV_RSA_DECR_CYCLE = 26, + XCP_DEV_RSACRT_DECR_CYCLE = 27, + XCP_DEV_ECMUL_CYCLE = 28, + XCP_DEV_PERFMARK = 29, + XCP_DEVQ_PERF_LOCK = 30, + XCP_DEVQ_PERF_WAKE = 31, + XCP_DEVQ_PERF_SCALE = 32, + XCP_DEV_CACHE_MODE = 33, + XCP_DEVQ_CACHE_STATS = 34, + XCP_DEV_DELAY = 35, + XCP_DEV_COMPRESS = 36, + XCP_DEV_XOR_FF = 37, + XCP_DEV_PRF = 38, + XCP_DEV_TRANSPORTSTATE1 = 39, + XCP_DEVQ_CACHEINDEX = 40, + XCP_DEVQ_CSP_OBJCOUNT = 41, + XCP_DEV_CSPTYPE = 42, + XCP_DEV_FCV = 43, + XCP_DEV_CLEAR_FCV = 44, + XCP_DEVQ_ASSERTIONS = 45, + XCP_DEV_TEST_LATESTART = 46, + XCP_DEV_ENVSEED = 47, + XCP_DEVQ_RAWENTROPY = 48, + XCP_DEV_EC_SIGVER_CYCLE = 49, + XCP_DEV_DRAIN_ENTROPY = 50, + XCP_DEV_CONV_EC_BLOB = 51, + XCP_DEVQ_COUNTERS = 52, + XCP_DEV_RSACRT_MSG_CYCLE = 53, + XCP_DEV_AUDIT_CYCLE = 54, + XCP_DEV_EDDSA = 55, + XCP_DEV_ECDH = 56, + XCP_DEV_PQC_DILITHIUM = 57, + XCP_DEV_ABORT = 63, + XCP_DEV_DRNG = 64, + XCP_DEV_DRNG_RESEED = 65, + XCP_DEV_FAULT_INJECT = 66, + XCP_DEVQ_FAULTLIST = 67, + XCP_DEV_FLIP_ERRORSTATE = 68, + XCP_DEV_AESKW = 69, + XCP_DEV_UNIT_TEST = 72, + XCP_DEV_MAX_INDEX = XCP_DEV_UNIT_TEST +} XCP_DEVcmd_t; +#define XCP_DEV_MAX_DATABYTES ((size_t) 64000) +#define XCP_DEV_MAX_ITERATIONS ((unsigned int) 128*1024) +#define XCP_DEV_C25519 (unsigned int)255 +#define XCP_DEV_C448 (unsigned int)448 +#define XCP_DEV_ED25519 ~((unsigned int)255) +#define XCP_DEV_ED448 ~((unsigned int)448) +#define XCP_DEV_ED25519_2 ~((unsigned int)256) +#define XCP_DEV_ED448_2 ~((unsigned int)456) +#define XCP_DEV_AESKW_WRAP (unsigned int)1 +#define XCP_DEV_AESKW_UNWRAP (unsigned int)2 +#define XCP_DEV_AESKW_WRAP_PAD (unsigned int)3 +#define XCP_DEV_AESKW_UNWRAP_PAD (unsigned int)4 +typedef enum { + XCP_DEVC_CACHE_ACTIVE = 1, + XCP_DEVC_CACHE_INACTIVE = 2, + XCP_DEVC_CACHE_FLUSH = 4, +} XCP_DEVcache_t; +typedef enum { + XCP_DEV_RNG_TRNG = 0, + XCP_DEV_RNG_DRNG = 1, + XCP_DEV_RNG_MIXED = 2, + XCP_DEV_RNG_SWDRNG = 4, + XCP_DEV_RNG_TYPE_MAX = XCP_DEV_RNG_SWDRNG +} XCP_DEVrng_t; +typedef enum { + XCP_DEVFS_QUERY = 0, + XCP_DEVFS_READONLY = 1, + XCP_DEVFS_NOACCESS = 2 +} XCP_DEVfs_t; +#define XCP_DEV_CTR_SIZE 4 +#define XCP_DEV_CTR_TYPE uint32_t +typedef enum { + XCP_DEV_FAULT_EXPR = 1, + XCP_DEV_FAULT_FUNC = 2, + XCP_DEV_FAULT_MSLEEP = 4, + XCP_DEV_FAULT_RV = 8, + XCP_DEV_FAULT_DBIT = 16, + XCP_DEV_FAULT_DNULL = 32, + XCP_DEV_FAULT_RBIT = 64, +} XCP_DEVfault_t; +#if !defined(CKG_VENDOR_DEFINED) +#define CKG_VENDOR_DEFINED 0x80000000UL +#endif +#define CKG_IBM_MGF1_SHA3_224 (CKG_VENDOR_DEFINED +1) +#define CKG_IBM_MGF1_SHA3_256 (CKG_VENDOR_DEFINED +2) +#define CKG_IBM_MGF1_SHA3_384 (CKG_VENDOR_DEFINED +3) +#define CKG_IBM_MGF1_SHA3_512 (CKG_VENDOR_DEFINED +4) +#if !defined(CKD_VENDOR_DEFINED) +#define CKD_VENDOR_DEFINED 0x80000000UL +#endif +#define CKD_IBM_HYBRID_NULL (CKD_VENDOR_DEFINED + 0x00000001UL) +#define CKD_IBM_HYBRID_SHA1_KDF (CKD_VENDOR_DEFINED + 0x00000002UL) +#define CKD_IBM_HYBRID_SHA224_KDF (CKD_VENDOR_DEFINED + 0x00000003UL) +#define CKD_IBM_HYBRID_SHA256_KDF (CKD_VENDOR_DEFINED + 0x00000004UL) +#define CKD_IBM_HYBRID_SHA384_KDF (CKD_VENDOR_DEFINED + 0x00000005UL) +#define CKD_IBM_HYBRID_SHA512_KDF (CKD_VENDOR_DEFINED + 0x00000006UL) +#define XCP_MODEL_CEX4P 4 +#define XCP_MODEL_CEX5P 5 +#define XCP_MODEL_CEX6P 6 +#define XCP_MODEL_CEX7P 7 +#define XCP_MODEL_CEX8P 8 +#define XCP_MAX_GRPIDX 1024u +#define XCPTGTMASK_SET_DOM(mask,domain) \ + ((mask)[((domain)/8)] |= (1 << (7-(domain)%8))) +#define XCPTGTMASK_DOM_IS_SET(mask,domain) \ + ((mask)[((domain)/8)] & (1 << (7-(domain)%8))) +#define XCPTGTMASK_CLR_DOM(mask,domain) \ + ((mask)[((domain)/8)] &= ~(1 << (7-(domain)%8))) +#define XCP_TGTFL_WCAP 0x10000000 +#define XCP_TGTFL_WCAP_SQ 0x20000000 +#define XCP_TGTFL_SET_SCMD 0x40000000 +#define XCP_TGTFL_API_CHKD 0x80000000 +#define XCP_TGTFL_NO_LOCK 0x01000000 +#define XCP_TGTFL_CHK_ATTR 0x02000000 +#define XCP_TGTFL_SET_ACMD 0x04000000 +#define XCP_TGTFL_NO_SPLIT 0x08000000 +#define XCP_MAXCONNECTIONS 64 +#define XCP_MAX_PORT 0xffff +typedef struct XCP_ModuleSocket { + char host[ MAX_FNAME_CHARS +1 ]; + uint32_t port; +} *XCP_ModuleSocket_t ; +typedef struct XCP_DomainPerf { + unsigned int lastperf[ 256 ]; +} *XCP_DomainPerf_t; +#define XCP_MOD_VERSION 2 +typedef struct XCP_Module { + uint32_t version; + uint64_t flags; + uint32_t domains; + unsigned char domainmask[ 256 /8 ]; + struct XCP_ModuleSocket socket; + uint32_t module_nr; + void *mhandle; + struct XCP_DomainPerf perf; + uint32_t api; +} *XCP_Module_t ; +typedef enum { + XCP_MFL_SOCKET = 1, + XCP_MFL_MODULE = 2, + XCP_MFL_MHANDLE = 4, + XCP_MFL_PERF = 8, + XCP_MFL_VIRTUAL = 0x10, + XCP_MFL_STRICT = 0x20, + XCP_MFL_PROBE = 0x40, + XCP_MFL_ALW_TGT_ADD = 0x80, + XCP_MFL_MAX = 0xff +} XCP_Module_Flags; +typedef uint64_t target_t; +#define XCP_TGT_INIT ~0UL +#define XCP_TGT_FMT "x%016" PRIx64 +int m_add_module(XCP_Module_t module, target_t *target) ; +int m_rm_module(XCP_Module_t module, target_t target) ; +CK_RV m_admin (unsigned char *response1, size_t *r1len, + unsigned char *response2, size_t *r2len, + const unsigned char *cmd, size_t clen, + const unsigned char *sigs, size_t slen, + target_t target) ; +CK_RV m_Login ( CK_UTF8CHAR_PTR pin, CK_ULONG pinlen, + const unsigned char *nonce, size_t nlen, + unsigned char *pinblob, size_t *pinbloblen, + target_t target) ; +CK_RV m_Logout ( const unsigned char *pin, size_t len, target_t target) ; +CK_RV m_LoginExtended( CK_UTF8CHAR_PTR pin, CK_ULONG pinlen, + const unsigned char *nonce, size_t nlen, + const unsigned char *xstruct, size_t xslen, + unsigned char *pinblob, size_t *pinbloblen, + target_t target) ; +CK_RV m_LogoutExtended( CK_UTF8CHAR_PTR pin, CK_ULONG pinlen, + const unsigned char *nonce, size_t nlen, + const unsigned char *xstruct, size_t xslen, + target_t target) ; +CK_RV m_GenerateRandom (CK_BYTE_PTR rnd, CK_ULONG len, target_t target) ; +CK_RV m_SeedRandom (CK_BYTE_PTR pSeed, CK_ULONG ulSeedLen, + target_t target) ; +CK_RV m_DigestInit (unsigned char *state, size_t *len, + const CK_MECHANISM_PTR pmech, + target_t target) ; +CK_RV m_Digest (const unsigned char *state, size_t slen, + CK_BYTE_PTR data, CK_ULONG len, + CK_BYTE_PTR digest, CK_ULONG_PTR dglen, + target_t target) ; +CK_RV m_DigestUpdate (unsigned char *state, size_t slen, + CK_BYTE_PTR data, CK_ULONG dlen, + target_t target) ; +CK_RV m_DigestKey (unsigned char *state, size_t slen, + const unsigned char *key, size_t klen, + target_t target) ; +CK_RV m_DigestFinal (const unsigned char *state, size_t slen, + CK_BYTE_PTR digest, CK_ULONG_PTR dlen, + target_t target) ; +CK_RV m_DigestSingle (CK_MECHANISM_PTR pmech, + CK_BYTE_PTR data, CK_ULONG len, + CK_BYTE_PTR digest, CK_ULONG_PTR dlen, + target_t target) ; +CK_RV m_GenerateKey (CK_MECHANISM_PTR pmech, + CK_ATTRIBUTE_PTR ptempl, CK_ULONG templcount, + const unsigned char *pin, size_t pinlen, + unsigned char *key, size_t *klen, + unsigned char *csum, size_t *clen, + target_t target) ; +CK_RV m_GenerateKeyPair (CK_MECHANISM_PTR pmech, + CK_ATTRIBUTE_PTR ppublic, CK_ULONG pubattrs, + CK_ATTRIBUTE_PTR pprivate, CK_ULONG prvattrs, + const unsigned char *pin, size_t pinlen, + unsigned char *key, size_t *klen, + unsigned char *pubkey, size_t *pklen, + target_t target) ; +CK_RV m_WrapKey (const unsigned char *key, size_t keylen, + const unsigned char *kek, size_t keklen, + const unsigned char *mackey, size_t mklen, + const CK_MECHANISM_PTR pmech, + CK_BYTE_PTR wrapped, CK_ULONG_PTR wlen, + target_t target) ; +CK_RV m_UnwrapKey (const CK_BYTE_PTR wrapped, CK_ULONG wlen, + const unsigned char *kek, size_t keklen, + const unsigned char *mackey, size_t mklen, + const unsigned char *pin, size_t pinlen, + const CK_MECHANISM_PTR uwmech, + const CK_ATTRIBUTE_PTR ptempl, CK_ULONG pcount, + unsigned char *unwrapped, size_t *uwlen, + CK_BYTE_PTR csum, CK_ULONG *cslen, + target_t target) ; +CK_RV m_DeriveKey ( CK_MECHANISM_PTR pderivemech, + CK_ATTRIBUTE_PTR ptempl, CK_ULONG templcount, + const unsigned char *basekey, size_t bklen, + const unsigned char *data, size_t dlen, + const unsigned char *pin, size_t pinlen, + unsigned char *newkey, size_t *nklen, + unsigned char *csum, size_t *cslen, + target_t target) ; +CK_RV m_GetAttributeValue (const unsigned char *obj, size_t olen, + CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, + target_t target) ; +CK_RV m_SetAttributeValue (unsigned char *obj, size_t olen, + CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount, + target_t target) ; +CK_RV m_GetMechanismList (CK_SLOT_ID slot, + CK_MECHANISM_TYPE_PTR mechs, + CK_ULONG_PTR count, + target_t target) ; +CK_RV m_GetMechanismInfo (CK_SLOT_ID slot, + CK_MECHANISM_TYPE mech, + CK_MECHANISM_INFO_PTR pmechinfo, + target_t target) ; +CK_RV m_get_xcp_info (CK_VOID_PTR pinfo, CK_ULONG_PTR infbytes, + unsigned int query, + unsigned int subquery, + target_t target) ; +CK_RV m_EncryptInit (unsigned char *state, size_t *slen, + CK_MECHANISM_PTR pmech, + const unsigned char *key, size_t klen, + target_t target) ; +CK_RV m_DecryptInit (unsigned char *state, size_t *slen, + CK_MECHANISM_PTR pmech, + const unsigned char *key, size_t klen, + target_t target) ; +CK_RV m_EncryptUpdate (unsigned char *state, size_t slen, + CK_BYTE_PTR plain, CK_ULONG plen, + CK_BYTE_PTR cipher, CK_ULONG_PTR clen, + target_t target) ; +CK_RV m_DecryptUpdate (unsigned char *state, size_t slen, + CK_BYTE_PTR cipher, CK_ULONG clen, + CK_BYTE_PTR plain, CK_ULONG_PTR plen, + target_t target) ; +CK_RV m_Encrypt (const unsigned char *state, size_t slen, + CK_BYTE_PTR plain, CK_ULONG plen, + CK_BYTE_PTR cipher, CK_ULONG_PTR clen, + target_t target) ; +CK_RV m_Decrypt (const unsigned char *state, size_t slen, + CK_BYTE_PTR cipher, CK_ULONG clen, + CK_BYTE_PTR plain, CK_ULONG_PTR plen, + target_t target) ; +CK_RV m_EncryptFinal (const unsigned char *state, size_t slen, + CK_BYTE_PTR output, CK_ULONG_PTR len, + target_t target) ; +CK_RV m_DecryptFinal (const unsigned char *state, size_t slen, + CK_BYTE_PTR output, CK_ULONG_PTR len, + target_t target) ; +CK_RV m_EncryptSingle (const unsigned char *key, size_t klen, + CK_MECHANISM_PTR mech, + CK_BYTE_PTR plain, CK_ULONG plen, + CK_BYTE_PTR cipher, CK_ULONG_PTR clen, + target_t target) ; +CK_RV m_DecryptSingle (const unsigned char *key, size_t klen, + CK_MECHANISM_PTR mech, + CK_BYTE_PTR cipher, CK_ULONG clen, + CK_BYTE_PTR plain, CK_ULONG_PTR plen, + target_t target) ; +CK_RV m_SignInit (unsigned char *state, size_t *slen, + CK_MECHANISM_PTR alg, + const unsigned char *key, size_t klen, + target_t target) ; +CK_RV m_VerifyInit (unsigned char *state, size_t *slen, + CK_MECHANISM_PTR alg, + const unsigned char *key, size_t klen, + target_t target) ; +CK_RV m_SignUpdate (unsigned char *state, size_t slen, + CK_BYTE_PTR data, CK_ULONG dlen, + target_t target) ; +CK_RV m_VerifyUpdate (unsigned char *state, size_t slen, + CK_BYTE_PTR data, CK_ULONG dlen, + target_t target) ; +CK_RV m_SignFinal (const unsigned char *state, size_t stlen, + CK_BYTE_PTR sig, CK_ULONG_PTR siglen, + target_t target) ; +CK_RV m_VerifyFinal (const unsigned char *state, size_t stlen, + CK_BYTE_PTR sig, CK_ULONG siglen, + target_t target) ; +CK_RV m_Sign (const unsigned char *state, size_t stlen, + CK_BYTE_PTR data, CK_ULONG dlen, + CK_BYTE_PTR sig, CK_ULONG_PTR siglen, + target_t target) ; +CK_RV m_Verify (const unsigned char *state, size_t stlen, + CK_BYTE_PTR data, CK_ULONG dlen, + CK_BYTE_PTR sig, CK_ULONG siglen, + target_t target) ; +CK_RV m_SignSingle (const unsigned char *key, size_t klen, + CK_MECHANISM_PTR pmech, + CK_BYTE_PTR data, CK_ULONG dlen, + CK_BYTE_PTR sig, CK_ULONG_PTR slen, + target_t target) ; +CK_RV m_VerifySingle (const unsigned char *key, size_t klen, + CK_MECHANISM_PTR pmech, + CK_BYTE_PTR data, CK_ULONG dlen, + CK_BYTE_PTR sig, CK_ULONG slen, + target_t target) ; +#define XCP_CHN_RETURN_RAW 1 +#define XCP_CHN_HIGH_PRIORITY 2 +#define XCP_CHN_MEDIUM_PRIORITY 4 +#define XCP_CHN_NODEV_LOG_SKIP 8 +#define XCP_CHN_PARSE_IRV 0x10 +CK_RV m_wire (unsigned char *rsp, size_t *rsplen, CK_RV *irv, + const unsigned char *req, size_t reqlen, + unsigned int flags, + target_t target) ; +#define XCP_W_NO_SEND_CPRB 1 +#define XCP_W_NO_RECV_CPRB 2 +int m_init(void); +int m_shutdown(void); +#define XCP_BUILD_ID 0x4801b799 +#define XCP_BUILD_DATE 0x20230120 +#define XCP_BUILD_TIME 0x135721 +#define __XCP_REASONCODES_H__ 1 +typedef enum { + XCP_RSC_NO_IMPORTER = 1, + XCP_RSC_NO_KEYPARTS = 2, + XCP_RSC_IMPR_CMDBLK_BER = 3, + XCP_RSC_IMPR_CMDBLK_FIELDS = 4, + XCP_RSC_IMPR_CMDBLK_FIELDCOUNT = 5, + XCP_RSC_IMPR_EMBEDDED_FN = 6, + XCP_RSC_IMPR_DOMAIN_DIFF = 7, + XCP_RSC_IMPR_NO_INT_CMDBLK = 8, + XCP_RSC_IMPR_NO_INT_SIGNATURE = 9, + XCP_RSC_IMPR_BAD_CMDBLK_BER = 10, + XCP_RSC_CMD_EMBEDDED_FN = 11, + XCP_RSC_CMD_DOMAIN_RANGE = 12, + XCP_RSC_DOMAIN_INST_FMT = 13, + XCP_RSC_DOMAIN_INST_MISMATCH = 14, + XCP_RSC_MODULE_INST_FMT = 15, + XCP_RSC_MODULE_INST_MISMATCH = 16, + XCP_RSC_MODULE_SERNO_MISMATCH = 17, + XCP_RSC_TCTR_FMT = 18, + XCP_RSC_TCTR_VALUE = 19, + XCP_RSC_DOMAIN_INST_DIFF = 20, + XCP_RSC_SIGS_INSUFFICIENT = 21, + XCP_RSC_SIGS_REJECTED = 22, + XCP_RSC_RCPTINFO_FMT = 23, + XCP_RSC_RCPTINFO_ENCRD_SIZE = 24, + XCP_RSC_RCPTINFO_ECDH_SRC = 25, + XCP_RSC_RCPTINFO_KDF_SHARED = 26, + XCP_RSC_RCPTINFO_KDF = 27, + XCP_RSC_RCPTINFO_KEY_SIZE = 28, + XCP_RSC_RCPTINFO_KEY_MIXMODE = 29, + XCP_RSC_RCPTINFO_KEY_VPS_DIFF = 30, + XCP_RSC_RCPTINFO_KEY_VPS_MISMATCH = 31, + XCP_RSC_SKI_MALFORMED = 32, + XCP_RSC_SKI_NOT_FOUND = 33, + XCP_RSC_MODE_IMPRINT = 34, + XCP_RSC_MODE_NONIMPRINT = 35, + XCP_RSC_IMPRINT_EXIT_INVD = 36, + XCP_RSC_CP_MODE_SET = 37, + XCP_RSC_SKI_FOUND = 38, + XCP_RSC_ADMINLIST_FULL = 39, + XCP_RSC_CERT_FMT = 40, + XCP_RSC_ATTRS_FMT = 41, + XCP_RSC_ATTRS_TYPE_INVALID = 42, + XCP_RSC_ATTRS_REPEAT = 43, + XCP_RSC_CPS_FMT = 44, + XCP_RSC_CPS_SET_INCONSISTENT = 45, + XCP_RSC_CPS_PREVENT_ADD = 46, + XCP_RSC_CPS_PREVENT_DEL = 47, + XCP_RSC_WK_MISMATCH = 48, + XCP_RSC_WK_MISSING = 49, + XCP_RSC_NEXT_WK_MISSING = 50, + XCP_RSC_EC_IMPORT_SYMM = 51, + XCP_RSC_RANDOM_WK_PROHIBITED = 52, + XCP_RSC_WKS_PRESENT = 53, + XCP_RSC_IMPR_FIELD_SIZE = 54, + XCP_RSC_IMPORTER_INVD_TYPE = 55, + XCP_RSC_IMPR_REVOKE_ZERO = 56, + XCP_RSC_IMPR_TOOMANY_SIGNERS = 57, + XCP_RSC_IMPR_TOOMANY_REVOKERS = 58, + XCP_RSC_OAIDX_FIELD_SIZE = 59, + XCP_RSC_OAIDX_INVALID = 60, + XCP_RSC_FCV_NOT_PRESENT = 61, + XCP_RSC_FCV_FMT = 62, + XCP_RSC_FCV_DIFFERS = 63, + XCP_RSC_COMMITTED_WK_MISSING = 64, + XCP_RSC_IMPR_EMBEDDED_FN_FMT = 65, + XCP_RSC_LOGOUT_BELOW_THRESHOLD = 66, + XCP_RSC_LOGOUT_NO_SINGLE_SIGN = 67, + XCP_RSC_LOGOUT_LAST_ADMIN = 68, + XCP_RSC_REACTIVATE_RO_ATTRS = 69, + XCP_RSC_CHG_PROTECTED_ATTRS = 70, + XCP_RSC_CHG_PROTECTED_THRESHOLD = 71, + XCP_RSC_CHG_READONLY_ATTRS = 72, + XCP_RSC_INACTIVE_CHG_ATTRS = 73, + XCP_RSC_CHG_ATTRS_PREVENTED = 74, + XCP_RSC_IMPR_MANY_KEYPARTS = 75, + XCP_RSC_LOWERING_SIGNERS_TO_ZERO = 76, + XCP_RSC_LOWERING_REVOKERS_TO_ZERO = 77, + XCP_RSC_CHG_SIGNERS_TO_ONE_NO_1SIGN = 78, + XCP_RSC_CHG_REVOKERS_TO_ONE_NO_1SIGN = 79, + XCP_RSC_IMPORT_WK_PROHIBITED = 80, + XCP_RSC_IMPR_SINGLE_KEYPART = 81, + XCP_RSC_IMPR_CSP = 82, + XCP_RSC_QUERY_DMASK_VERSION = 83, + XCP_RSC_QUERY_DMASK_FMT = 84, + XCP_RSC_LEAVE_DOM_IMPR_CARD_STILL = 85, + XCP_RSC_BLOB_REENCRYPT_REJECT = 86, + XCP_RSC_TOO_MANY_SIGNERINFOS = 87, + XCP_RSC_NO_GLOBAL_CONTEXT = 88, + XCP_RSC_ATTRS_TOO_MANY = 89, + XCP_RSC_CP_SET_INVALID = 90, + XCP_RSC_RK_IDLEN_INVALID = 91, + XCP_RSC_RK_ID_INVALID = 92, + XCP_RSC_FILEID_UNKNOWN = 93, + XCP_RSC_FILEID_UNSUPPORTED = 94, + XCP_RSC_CPS_REJECTED_FCV = 95, + XCP_RSC_EXPR_KEYPART_LIMIT = 96, + XCP_RSC_EXPR_KEYPART_ZEROLIMIT = 97, + XCP_RSC_EXPR_KEYPART_DIFF_LIMIT = 98, + XCP_RSC_EXPR_KEYPART_DIFF_COUNT = 99, + XCP_RSC_EXPR_DOMMASK_DIFF = 100, + XCP_RSC_EXPR_INDEX_INVALID = 101, + XCP_RSC_EXPR_CERT_INVALID = 102, + XCP_RSC_IMPR_STATE_STRUCT = 103, + XCP_RSC_EXPR_AUTHCERT_INVALID = 104, + XCP_RSC_IMPR_KEYPARTS_STRUCT = 105, + XCP_RSC_IMPR_STATE_REPEAT = 106, + XCP_RSC_IMPR_ENCR_ALG = 107, + XCP_RSC_IMPR_FILESIG_INFRASTRUCTURE = 108, + XCP_RSC_IMPR_FILESIG = 109, + XCP_RSC_EXPR_SINGLE_KEYPART = 110, + XCP_RSC_IMPR_KEYPARTS_REASSEMBLY = 111, + XCP_RSC_IMPR_KEYPARTS_CONFLICT = 112, + XCP_RSC_IMPR_ENCRD_DATA_DIFF = 113, + XCP_RSC_IMPR_ENCRD_DATA_STRUCT = 114, + XCP_RSC_IMPR_ENCR_PARAMS = 115, + XCP_RSC_IMPR_ENCRD_CONSISTENCY = 116, + XCP_RSC_BLOB_SETTRUST_REJECT = 117, + XCP_RSC_BLOB_SETCLK_FIELD = 118, + XCP_RSC_BLOB_SETCLK_TIME = 119, + XCP_RSC_EXPR_SCOPE_INVALID = 120, + XCP_RSC_IMPR_SCOPE_INVALID = 121, + XCP_RSC_IMPR_SCOPE_DOM_RES_VIOLATION = 122, + XCP_RSC_IMPR_AMBIGUOUS_DOMAIN_SOURCE = 123, + XCP_RSC_IMPR_MDOMAIN_IMPORT_MASK_INVALID = 124, + XCP_RSC_IMPR_NO_CARD_IMPORTER = 125, + XCP_RSC_IMPR_IMPORT_DOM_DATA_FAILED = 126, + XCP_RSC_IMPR_IMPORT_DOM_WKS_FAILED = 127, + XCP_RSC_IMPR_IMPORT_TGT_DOM_ZEROIZE_FAILED = 128, + XCP_RSC_AUDIT_QUERY_PAYLOAD_SIZE = 129, + XCP_RSC_AUDIT_QUERY_INVALID_INDEX = 130, + XCP_RSC_EXPORT_WK_PROHIBITED = 131, + XCP_RSC_EXPORT_STATE_PROHIBITED = 132, + XCP_RSC_IMPORT_STATE_PROHIBITED = 133, + XCP_RSC_EXPORT_WK_UNAUTHORIZED = 134, + XCP_RSC_OA_SIG_POLICY_VIOLATION = 135, + XCP_RSC_OA_SIG_NOT_SUPPORTED = 136, + XCP_RSC_ASN_FMT_INVALID = 137, + XCP_RSC_CERT_TYPE_INVALID = 138, + XCP_RSC_ROLE_ID_INVALID = 139, + XCP_RSC_ADM_SIG_POLICY_VIOLATION = 140, + XCP_RSC_KEY_STRENGTH_POLICY_VIOLATION = 141, + XCP_RSC_ADM_SIG_CHANGE_PROHIBITED = 142, + XCP_RSC_KEY_STRENGTH_CHANGE_PROHIBITED = 143, + XCP_RSC_MAX = XCP_RSC_KEY_STRENGTH_CHANGE_PROHIBITED +} XCP_ReasonCode_t ; +#define __MIN_MOD_FNID 1 +#define __MAX_MOD_FNID 42 +#define __FNID_Login 1 +#define __FNID_Logout 2 +#define __FNID_SeedRandom 3 +#define __FNID_GenerateRandom 4 +#define __FNID_DigestInit 5 +#define __FNID_DigestUpdate 6 +#define __FNID_DigestKey 7 +#define __FNID_DigestFinal 8 +#define __FNID_Digest 9 +#define __FNID_DigestSingle 10 +#define __FNID_EncryptInit 11 +#define __FNID_DecryptInit 12 +#define __FNID_EncryptUpdate 13 +#define __FNID_DecryptUpdate 14 +#define __FNID_EncryptFinal 15 +#define __FNID_DecryptFinal 16 +#define __FNID_Encrypt 17 +#define __FNID_Decrypt 18 +#define __FNID_EncryptSingle 19 +#define __FNID_DecryptSingle 20 +#define __FNID_GenerateKey 21 +#define __FNID_GenerateKeyPair 22 +#define __FNID_SignInit 23 +#define __FNID_SignUpdate 24 +#define __FNID_SignFinal 25 +#define __FNID_Sign 26 +#define __FNID_VerifyInit 27 +#define __FNID_VerifyUpdate 28 +#define __FNID_VerifyFinal 29 +#define __FNID_Verify 30 +#define __FNID_SignSingle 31 +#define __FNID_VerifySingle 32 +#define __FNID_WrapKey 33 +#define __FNID_UnwrapKey 34 +#define __FNID_DeriveKey 35 +#define __FNID_GetMechanismList 36 +#define __FNID_GetMechanismInfo 37 +#define __FNID_get_xcp_info 38 +#define __FNID_GetAttributeValue 39 +#define __FNID_SetAttributeValue 40 +#define __FNID_admin 41 +#define __FNID_ReencryptSingle 42 +#define __FNID_NEXT_AVAILABLE 43 +#define __FNID_MAX __FNID_ReencryptSingle +#define XCP__FNIDS_BIT0 0x8000000000000000ULL +#define XCP__FNIDS_DW0 \ + ( (XCP__FNIDS_BIT0) |\ + (XCP__FNIDS_BIT0 >> __FNID_Login) |\ + (XCP__FNIDS_BIT0 >> __FNID_Logout) |\ + (XCP__FNIDS_BIT0 >> __FNID_SeedRandom) |\ + (XCP__FNIDS_BIT0 >> __FNID_GenerateRandom) |\ + (XCP__FNIDS_BIT0 >> __FNID_DigestInit) |\ + (XCP__FNIDS_BIT0 >> __FNID_DigestUpdate) |\ + \ + (XCP__FNIDS_BIT0 >> __FNID_DigestFinal) |\ + (XCP__FNIDS_BIT0 >> __FNID_Digest) |\ + (XCP__FNIDS_BIT0 >> __FNID_DigestSingle) |\ + (XCP__FNIDS_BIT0 >> __FNID_EncryptInit) |\ + (XCP__FNIDS_BIT0 >> __FNID_DecryptInit) |\ + (XCP__FNIDS_BIT0 >> __FNID_EncryptUpdate) |\ + (XCP__FNIDS_BIT0 >> __FNID_DecryptUpdate) |\ + (XCP__FNIDS_BIT0 >> __FNID_EncryptFinal) |\ + (XCP__FNIDS_BIT0 >> __FNID_DecryptFinal) |\ + (XCP__FNIDS_BIT0 >> __FNID_Encrypt) |\ + (XCP__FNIDS_BIT0 >> __FNID_Decrypt) |\ + (XCP__FNIDS_BIT0 >> __FNID_EncryptSingle) |\ + (XCP__FNIDS_BIT0 >> __FNID_DecryptSingle) |\ + (XCP__FNIDS_BIT0 >> __FNID_GenerateKey) |\ + (XCP__FNIDS_BIT0 >> __FNID_GenerateKeyPair) |\ + (XCP__FNIDS_BIT0 >> __FNID_SignInit) |\ + (XCP__FNIDS_BIT0 >> __FNID_SignUpdate) |\ + (XCP__FNIDS_BIT0 >> __FNID_SignFinal) |\ + (XCP__FNIDS_BIT0 >> __FNID_Sign) |\ + (XCP__FNIDS_BIT0 >> __FNID_VerifyInit) |\ + (XCP__FNIDS_BIT0 >> __FNID_VerifyUpdate) |\ + (XCP__FNIDS_BIT0 >> __FNID_VerifyFinal) |\ + (XCP__FNIDS_BIT0 >> __FNID_Verify) |\ + (XCP__FNIDS_BIT0 >> __FNID_SignSingle) |\ + (XCP__FNIDS_BIT0 >> __FNID_VerifySingle) |\ + (XCP__FNIDS_BIT0 >> __FNID_WrapKey) |\ + (XCP__FNIDS_BIT0 >> __FNID_UnwrapKey) |\ + (XCP__FNIDS_BIT0 >> __FNID_DeriveKey) |\ + (XCP__FNIDS_BIT0 >> __FNID_GetMechanismList) |\ + (XCP__FNIDS_BIT0 >> __FNID_GetMechanismInfo) |\ + (XCP__FNIDS_BIT0 >> __FNID_get_xcp_info) |\ + (XCP__FNIDS_BIT0 >> __FNID_GetAttributeValue) |\ + (XCP__FNIDS_BIT0 >> __FNID_SetAttributeValue) |\ + (XCP__FNIDS_BIT0 >> __FNID_admin) |\ + (XCP__FNIDS_BIT0 >> __FNID_ReencryptSingle)) +#define XCP__FNIDS_DW1 0 +#define __HOST2MOD_DATAPRM 9 +#define __MOD2HOST_DATAPRM 2 +#endif \ No newline at end of file diff --git a/hpcs-pkcs11/samples/grep11.h b/hpcs-pkcs11/samples/grep11.h new file mode 100644 index 000000000..202ce87e9 --- /dev/null +++ b/hpcs-pkcs11/samples/grep11.h @@ -0,0 +1,25 @@ +/* +Copyright IBM Corp. All Rights Reserved. +SPDX-License-Identifier: Apache-2.0 +*/ + +#ifndef _GREP11_H_ +#define _GREP11_H_ 1 + +#if !defined(CKR_VENDOR_DEFINED) +#error "We need CKR_VENDOR_DEFINED type from , please include before this file." +#endif + +#define CKR_VENDOR_DEFINED_GREP11 CKR_VENDOR_DEFINED + 0x40000 +#define CKR_IBM_GREP11_NOT_AUTHENTICATED CKR_VENDOR_DEFINED_GREP11 + 0x01 +#define CKR_IBM_GREP11_CANNOT_UNMARSHAL CKR_VENDOR_DEFINED_GREP11 + 0x02 +#define CKR_IBM_GREP11_CANNOT_MARSHAL CKR_VENDOR_DEFINED_GREP11 + 0x03 +#define CKR_IBM_GREP11_CONFLICT CKR_VENDOR_DEFINED_GREP11 + 0x04 +#define CKR_IBM_GREP11_DBINTERNAL CKR_VENDOR_DEFINED_GREP11 + 0x05 +#define CKR_IBM_GREP11_MISSING CKR_VENDOR_DEFINED_GREP11 + 0x06 + +#define CKA_VENDOR_DEFINED_GREP11 CKA_VENDOR_DEFINED + 0x40000 +#define CKA_GREP11_TOKEN_LABEL CKA_VENDOR_DEFINED_GREP11 + 0x01 +#define CKA_GREP11_WKID CKA_VENDOR_DEFINED_GREP11 + 0x02 +#define CKA_GREP11_KEYSTORE_PASSWORD CKA_VENDOR_DEFINED_GREP11 + 0x03 +#endif diff --git a/hpcs-pkcs11/samples/pkcs11-attrs.c b/hpcs-pkcs11/samples/pkcs11-attrs.c new file mode 100644 index 000000000..6fc299c75 --- /dev/null +++ b/hpcs-pkcs11/samples/pkcs11-attrs.c @@ -0,0 +1,872 @@ + /**************************************************************** + * Copyright IBM Corp. All Rights Reserved. + * + * SPDX-License-Identifier: Apache-2.0 + * + * pkcs11-attrs.c + * + * A sample application demonstrating how to extract and display key attributes using the PKCS11 library + * + * Compile using: + * gcc -o pkcs11-attrs pkcs11-attrs.c -ldl + * + * Usage: + * ./pkcs11-attrs -p -s -u -l