When the caller provides a too short output buffer, send back RSN_TOO_SHORT
to correctly indicate this situation.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Update ICSF mock server to behave like the real ICSF and generate as well
as require DH keys that are complaint per NIST SP 800-56A R3 5.6.2.1.2.
Fail the key derivation with 8 / 2116 if the used private key is not
compliant, just like ICSF is doing.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add a self-contained Python 3 mock of the z/OS ICSF LDAP interface,
designed to let you run the openCryptoki ICSF token driver and the
pkcsicsf configuration tool without a real z/OS system.
Assisted-by: IBM Bob:2.1.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The commit adds support for BLS 12 381 curve as part of CKM_IBM_ECDSA_OTHER
with CKM_IBM_BLS submechanism for EP11 token.
Signed-off-by: Vishnudatha Kanjur <kanjur@ibm.com>
When building this in 2025, it claims Copyright 2025
without any copyright-worthy work happening in that year.
Also note that the number does not have to be updated every year
as copyright does not expire for 70+ years.
This patch was done while working on reproducible builds for openSUSE, sponsored by the NLnet NGI0 fund.
Signed-off-by: Bernhard M. Wiedemann <bwiedemann@suse.de>
PKCS#11 v3.0 adds mechanisms like CKM_SHA3_nnn_KEY_DERIVE for SHA3 based key
derivation. For whatever reason, the SHA3 variants of those mechanisms are
called like ..._KEY_DERIVE while the SHA1 and SHA2 variants are called like
..._KEY_DERIVATION.
In PKCS#11 v3.1 this has been aligned and these mechanisms are now called
CKM_SHA3_nnn_KEY_DERIVATION, but there are aliases for the old mechanism
names like CKM_SHA3_nnn_KEY_DERIVE to map to the new names.
Update the code to use the new names, but also add the aliases so that
existing applications that use the old names continue to work. Also add
the aliases to the policy parser, to allow parsing existing policy files
that use the old names.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The *_SP800 KDFs use the algorithm defined by FIPS SP800-56A/SP800-56C
instead of the algorithm defined by ANSI X9.63.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Ensure that the new SHA3 mechanisms, KDFs and MGFs are supported by all
common code utility functions, as well as policy and statistics code.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
AIX does not have any of the BSD's warnx and friends functions, and neither
does it have getopt_long. Both of these are included, sourced from a pool of
permissive licenses, with their license notices intact.
In an effort to preserve nativity, this code is not used on other platforms,
instead preferring to use the native behaviours available on respective
platforms.
Additionally, this commit also includes some changes that _removes_
platform-specificity for the Linux platform, setting the _GNU_SOURCE macro
once in autoconf, instead of duplicating that in every source file.
Signed-off-by: Akash Kulhalli <akash.kulhalli@ibm.com>
Fix various places where GCC 14 reports type inconsistencies with the size_t
and CK_ULONG (unsigned long) types.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Allow to specify the pkcsslotd user and the pkcs11 group during
configuration.
Use '--with-pkcsslotd-user=USER' and/or '--with-pkcs-group=GROUP'
to specify the user and group name. The defaults are 'pkcsslotd'
and 'pkcs11'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Support cross compilation by making sure that the build tools are
built with a local compiler.
Note: This requires the AX_PROG_CC_FOR_BUILD` autoconf macro from
the autoconf archive.
Tested-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
These files will also be installed automatically via autotools into the
correct doc folder (typically /usr/share/doc/opencryptoki).
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Add a single source mechanism table to be used by policy and other code. This
should remove the various tables and switches over mechanisms in the code and
provide a common way to translate between numeric and string representation.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
