From 45c8cf416b855626de503cc33dfd841d6f4eda85 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 29 Aug 2022 14:27:45 +0200 Subject: [PATCH] EP11: Perform certain mechanisms always as single operation These mechanisms do not support multi-part operations, and thus can be safely executed as a single operation with the EP11 host library, even independently from the OPTIMIZE_SINGLE_PART_OPERATIONS configuration option. These mechanisms also would produce a EP11 state blob that is not encrypted, but MACed with the EP11 WK. As of today, the EP11 host library does not allow to re-encipher such state blobs. So supporting a state re-enciphering as part of a concurrent master key operation is not possible. By performing them as single-operation, no state blob is used and thus no problem with re-enciphering such state blobs during concurrent master key changes. Signed-off-by: Ingo Franzki --- usr/lib/ep11_stdll/ep11_specific.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c index 8fc150e1..04e40ff0 100644 --- a/usr/lib/ep11_stdll/ep11_specific.c +++ b/usr/lib/ep11_stdll/ep11_specific.c @@ -8380,6 +8380,15 @@ CK_BOOL ep11tok_mech_single_only(CK_MECHANISM *mech) switch (mech->mechanism) { case CKM_IBM_ECDSA_OTHER: case CKM_IBM_KYBER: + case CKM_RSA_PKCS: + case CKM_RSA_PKCS_OAEP: + case CKM_RSA_PKCS_PSS: + case CKM_RSA_X9_31: + case CKM_ECDSA: + case CKM_DSA: + case CKM_IBM_ED25519_SHA512: + case CKM_IBM_ED448_SHA3: + case CKM_IBM_DILITHIUM: return CK_TRUE; default: return CK_FALSE;