crypt/opencryptoki
1
0
Fork 0
mirror of https://github.com/opencryptoki/opencryptoki.git synced 2026-10-28 18:37:25 +03:00
Code Releases Activity

EP11: Perform certain mechanisms always as single operation

Browse Source 
These mechanisms do not support multi-part operations, and thus can be
safely executed as a single operation with the EP11 host library, even
independently from the OPTIMIZE_SINGLE_PART_OPERATIONS configuration
option.

These mechanisms also would produce a EP11 state blob that is not
encrypted, but MACed with the EP11 WK. As of today, the EP11 host library
does not allow to re-encipher such state blobs. So supporting a state
re-enciphering as part of a concurrent master key operation is not possible.
By performing them as single-operation, no state blob is used and thus no
problem with re-enciphering such state blobs during concurrent master key
changes.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2022-08-29 14:27:45 +02:00
committed by Ingo Franzki
parent 795aba5d1f
commit 45c8cf416b
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
usr/lib/ep11_stdll/ep11_specific.c
View File

@@ -8380,6 +8380,15 @@ CK_BOOL ep11tok_mech_single_only(CK_MECHANISM *mech)
switch (mech->mechanism) {
case CKM_IBM_ECDSA_OTHER:
case CKM_IBM_KYBER:
case CKM_RSA_PKCS:
case CKM_RSA_PKCS_OAEP:
case CKM_RSA_PKCS_PSS:
case CKM_RSA_X9_31:
case CKM_ECDSA:
case CKM_DSA:
case CKM_IBM_ED25519_SHA512:
case CKM_IBM_ED448_SHA3:
case CKM_IBM_DILITHIUM:
return CK_TRUE;
default:
return CK_FALSE;