Thus ep11's token specific init call does not really require a lock
since its access is serialize in ST_Initialize.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
Made following corrections,
- config dir is either OCK_EP11_TOKEN_DIR or OCK_CONFDIR.
- The config file name is always taken from the ep11 entry in opencryptoki.conf.
2. Moved print_mechanism and print_flags to get rid of build warnings.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
token does not implement an rng, it can use the generic one.
2. Since secure key tokens use software des3 rather than token's des3
to encrypt/decrypt private token objects, their masterkeys do not need
to be generated by the token. All this end up doing is creating a blob
and the blob is used for the key. Instead, just use the RNG to create
a spcific number of bytes for des3 key for the software des3 to use.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
When shm_open() creates shared memory object, it honors umask of the
caller. This patch ensures the shared memory has expected permissions
when it is created.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
This attribute must be passed in by user when generating EC keypair
and should not be over-written.
Since CKA_EC_POINT is for public key, does not require being in private key.
Created a routine to get signature length when length only.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
Needed to call encrypt_data_with_clear_key() and let it determine if
clear key or secure key and do appropriate actions.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
The return value was incorrect when a mechanism could not be found.
Corrected a few return values in the ica token specific get mechanism code.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
CBC-MAC for DES3 and AES
OFB and CFB mode for DES3 and AES
SHA384HMAC, SHA512HMAC
new method to retrieve mechanism list for ica token
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@linux.vnet.ibm.com>
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
the opencryptoki library the default behaviour rather than using
shared memory.
We still use shared memory for some process bookkeeping per slot.
Signed-off-by: Joy Latten <jmlatten@linux.vnet.ibm.com>
Part 2 of slot-info via socket.
This patch enables all the non-changing slot information to be
transmitted over the sockets, rather via shared memory. By doing this,
the members of the pkcs11 group can no longer override the locations of
the backend library .so files, and so can no longer execute arbitary
code with the preivileges of other pkcs11 group members.
Signed-off-by: Ross McIlroy <rmcilroy@google.com>
Part 1 of slot-info via socket.
Adds an option to use a unix domain socket for the transmission of slot
information from the slot daemon to the library, rather than shared
memory. In this patch, only ck_info is transmitted this way.
Signed-off-by: Ross McIlroy <rmcilroy@google.com>
Move the code in InitSharedMemory that populates the CKInfo and SlotInfo
structures into helper functions in pkcssllotd_util.c.
This is to avoid duplicating code in the upcoming socket slot info patch.
Signed-off-by: Ross McIlroy <rmcilroy@google.com>
