Documentation
¶
Overview ¶
Package cryptoki is a low-level Go binding for the OASIS PKCS #11 (Cryptoki) v3.2 cryptographic token interface.
It wraps a PKCS #11 module (a shared library such as a vendor HSM driver or SoftHSM) closely, exposing the Cryptoki C API as Go methods on a Ctx while applying Go idiom where it improves safety and ergonomics. Higher-level helpers built on top of this package live in module path .../p11.
The constant set in zconst.go is generated directly from the OASIS header pkcs11t.h by ./cmd/genconst; see the repository-root NOTICE.md for the headers' provenance and license. This binding is an independent, clean-room implementation derived solely from the OASIS PKCS #11 v3.2 specification and its published C headers.
Index ¶
- Constants
- func Wipe(b []byte)
- type Attribute
- type Ctx
- func (c *Ctx) CloseAllSessions(slot SlotID) error
- func (c *Ctx) CloseSession(sh SessionHandle) error
- func (c *Ctx) CopyObject(sh SessionHandle, obj ObjectHandle, tmpl []*Attribute) (ObjectHandle, error)
- func (c *Ctx) CreateObject(sh SessionHandle, tmpl []*Attribute) (ObjectHandle, error)
- func (c *Ctx) DecapsulateKey(sh SessionHandle, m *Mechanism, privKey ObjectHandle, tmpl []*Attribute, ...) (ObjectHandle, error)
- func (c *Ctx) Decrypt(sh SessionHandle, cipher []byte) ([]byte, error)
- func (c *Ctx) DecryptDigestUpdate(sh SessionHandle, cipher []byte) ([]byte, error)
- func (c *Ctx) DecryptFinal(sh SessionHandle) ([]byte, error)
- func (c *Ctx) DecryptInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
- func (c *Ctx) DecryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
- func (c *Ctx) DecryptVerifyUpdate(sh SessionHandle, cipher []byte) ([]byte, error)
- func (c *Ctx) DeriveKey(sh SessionHandle, m *Mechanism, baseKey ObjectHandle, tmpl []*Attribute) (ObjectHandle, error)
- func (c *Ctx) Destroy()
- func (c *Ctx) DestroyObject(sh SessionHandle, obj ObjectHandle) error
- func (c *Ctx) Digest(sh SessionHandle, data []byte) ([]byte, error)
- func (c *Ctx) DigestEncryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
- func (c *Ctx) DigestFinal(sh SessionHandle) ([]byte, error)
- func (c *Ctx) DigestInit(sh SessionHandle, m *Mechanism) error
- func (c *Ctx) DigestKey(sh SessionHandle, key ObjectHandle) error
- func (c *Ctx) DigestUpdate(sh SessionHandle, data []byte) error
- func (c *Ctx) EncapsulateKey(sh SessionHandle, m *Mechanism, pubKey ObjectHandle, tmpl []*Attribute) ([]byte, ObjectHandle, error)
- func (c *Ctx) Encrypt(sh SessionHandle, data []byte) ([]byte, error)
- func (c *Ctx) EncryptFinal(sh SessionHandle) ([]byte, error)
- func (c *Ctx) EncryptInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
- func (c *Ctx) EncryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
- func (c *Ctx) Finalize() error
- func (c *Ctx) FindObjects(sh SessionHandle, maxObjects int) ([]ObjectHandle, error)
- func (c *Ctx) FindObjectsFinal(sh SessionHandle) error
- func (c *Ctx) FindObjectsInit(sh SessionHandle, tmpl []*Attribute) error
- func (c *Ctx) GenerateKey(sh SessionHandle, m *Mechanism, tmpl []*Attribute) (ObjectHandle, error)
- func (c *Ctx) GenerateKeyPair(sh SessionHandle, m *Mechanism, public, private []*Attribute) (ObjectHandle, ObjectHandle, error)
- func (c *Ctx) GenerateRandom(sh SessionHandle, length int) ([]byte, error)
- func (c *Ctx) GetAttributeValue(sh SessionHandle, obj ObjectHandle, tmpl []*Attribute) ([]*Attribute, error)
- func (c *Ctx) GetInfo() (Info, error)
- func (c *Ctx) GetMechanismInfo(slot SlotID, mechanism uint) (MechanismInfo, error)
- func (c *Ctx) GetMechanismList(slot SlotID) ([]uint, error)
- func (c *Ctx) GetObjectSize(sh SessionHandle, obj ObjectHandle) (uint, error)
- func (c *Ctx) GetOperationState(sh SessionHandle) ([]byte, error)
- func (c *Ctx) GetSessionInfo(sh SessionHandle) (SessionInfo, error)
- func (c *Ctx) GetSessionValidationFlags(sh SessionHandle, flagType uint) (uint, error)
- func (c *Ctx) GetSlotInfo(slot SlotID) (SlotInfo, error)
- func (c *Ctx) GetSlotList(tokenPresent bool) ([]SlotID, error)
- func (c *Ctx) GetTokenInfo(slot SlotID) (TokenInfo, error)
- func (c *Ctx) InitPIN(sh SessionHandle, pin []byte) error
- func (c *Ctx) InitToken(slot SlotID, soPin []byte, label string) error
- func (c *Ctx) Initialize() error
- func (c *Ctx) InitializeWithFlags(flags uint) error
- func (c *Ctx) Login(sh SessionHandle, userType uint, pin []byte) error
- func (c *Ctx) Logout(sh SessionHandle) error
- func (c *Ctx) OpenSession(slot SlotID, flags uint) (SessionHandle, error)
- func (c *Ctx) SeedRandom(sh SessionHandle, seed []byte) error
- func (c *Ctx) SetAttributeValue(sh SessionHandle, obj ObjectHandle, tmpl []*Attribute) error
- func (c *Ctx) SetOperationState(sh SessionHandle, state []byte, encKey, authKey ObjectHandle) error
- func (c *Ctx) SetPIN(sh SessionHandle, oldPin, newPin []byte) error
- func (c *Ctx) Sign(sh SessionHandle, data []byte) ([]byte, error)
- func (c *Ctx) SignEncryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
- func (c *Ctx) SignFinal(sh SessionHandle) ([]byte, error)
- func (c *Ctx) SignInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
- func (c *Ctx) SignUpdate(sh SessionHandle, part []byte) error
- func (c *Ctx) SupportsV32() bool
- func (c *Ctx) UnwrapKey(sh SessionHandle, m *Mechanism, unwrappingKey ObjectHandle, wrapped []byte, ...) (ObjectHandle, error)
- func (c *Ctx) UnwrapKeyAuthenticated(sh SessionHandle, m *Mechanism, unwrappingKey ObjectHandle, ...) (ObjectHandle, error)
- func (c *Ctx) Verify(sh SessionHandle, data, signature []byte) error
- func (c *Ctx) VerifyFinal(sh SessionHandle, signature []byte) error
- func (c *Ctx) VerifyInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
- func (c *Ctx) VerifySignature(sh SessionHandle, data []byte) error
- func (c *Ctx) VerifySignatureFinal(sh SessionHandle) error
- func (c *Ctx) VerifySignatureInit(sh SessionHandle, m *Mechanism, key ObjectHandle, signature []byte) error
- func (c *Ctx) VerifySignatureUpdate(sh SessionHandle, part []byte) error
- func (c *Ctx) VerifyUpdate(sh SessionHandle, part []byte) error
- func (c *Ctx) WaitForSlotEvent(flags uint) (SlotID, error)
- func (c *Ctx) WrapKey(sh SessionHandle, m *Mechanism, wrappingKey, key ObjectHandle) ([]byte, error)
- func (c *Ctx) WrapKeyAuthenticated(sh SessionHandle, m *Mechanism, wrappingKey, key ObjectHandle, aad []byte) ([]byte, error)
- type Error
- type GCMParams
- type Info
- type Mechanism
- type MechanismInfo
- type MechanismParams
- type ObjectHandle
- type SessionHandle
- type SessionInfo
- type SlotID
- type SlotInfo
- type TokenInfo
- type Version
Constants ¶
const ( CK_TRUE = true CK_FALSE = false CK_UNAVAILABLE_INFORMATION = ^uint(0) CK_EFFECTIVELY_INFINITE = 0 CK_INVALID_HANDLE = 0 CKN_SURRENDER = 0 CKN_OTP_CHANGED = 1 CKF_TOKEN_PRESENT = 0x00000001 // a token is there CKF_REMOVABLE_DEVICE = 0x00000002 // removable devices CKF_HW_SLOT = 0x00000004 // hardware slot CKF_RNG = 0x00000001 // has random # generator CKF_WRITE_PROTECTED = 0x00000002 // token is write-protected CKF_LOGIN_REQUIRED = 0x00000004 // user must login CKF_USER_PIN_INITIALIZED = 0x00000008 // normal user's PIN is set CKF_RESTORE_KEY_NOT_NEEDED = 0x00000020 CKF_CLOCK_ON_TOKEN = 0x00000040 CKF_PROTECTED_AUTHENTICATION_PATH = 0x00000100 CKF_DUAL_CRYPTO_OPERATIONS = 0x00000200 CKF_TOKEN_INITIALIZED = 0x00000400 CKF_SECONDARY_AUTHENTICATION = 0x00000800 CKF_USER_PIN_COUNT_LOW = 0x00010000 CKF_USER_PIN_FINAL_TRY = 0x00020000 CKF_USER_PIN_LOCKED = 0x00040000 CKF_USER_PIN_TO_BE_CHANGED = 0x00080000 CKF_SO_PIN_COUNT_LOW = 0x00100000 CKF_SO_PIN_FINAL_TRY = 0x00200000 CKF_SO_PIN_LOCKED = 0x00400000 CKF_SO_PIN_TO_BE_CHANGED = 0x00800000 CKF_ERROR_STATE = 0x01000000 CKF_SEED_RANDOM_REQUIRED = 0x02000000 CKF_ASYNC_SESSION_SUPPORTED = 0x04000000 CKU_SO = 0 CKU_USER = 1 CKU_CONTEXT_SPECIFIC = 2 CKS_RO_PUBLIC_SESSION = 0 CKS_RO_USER_FUNCTIONS = 1 CKS_RW_PUBLIC_SESSION = 2 CKS_RW_USER_FUNCTIONS = 3 CKS_RW_SO_FUNCTIONS = 4 CKF_RW_SESSION = 0x00000002 // session is r/w CKF_SERIAL_SESSION = 0x00000004 // no parallel CKF_ASYNC_SESSION = 0x00000008 // session is async CKO_DATA = 0x00000000 CKO_CERTIFICATE = 0x00000001 CKO_PUBLIC_KEY = 0x00000002 CKO_PRIVATE_KEY = 0x00000003 CKO_SECRET_KEY = 0x00000004 CKO_HW_FEATURE = 0x00000005 CKO_DOMAIN_PARAMETERS = 0x00000006 CKO_MECHANISM = 0x00000007 CKO_OTP_KEY = 0x00000008 CKO_PROFILE = 0x00000009 CKO_VALIDATION = 0x0000000a CKO_TRUST = 0x0000000b CKO_VENDOR_DEFINED = 0x80000000 CKP_INVALID_ID = 0x00000000 // Profile CKP_BASELINE_PROVIDER = 0x00000001 // Profile CKP_EXTENDED_PROVIDER = 0x00000002 // Profile CKP_AUTHENTICATION_TOKEN = 0x00000003 // Profile CKP_PUBLIC_CERTIFICATES_TOKEN = 0x00000004 // Profile CKP_COMPLETE_PROVIDER = 0x00000005 // Profile CKP_HKDF_TLS_TOKEN = 0x00000006 // Profile CKP_VENDOR_DEFINED = 0x80000000 // Profile CKH_MONOTONIC_COUNTER = 0x00000001 CKH_CLOCK = 0x00000002 CKH_USER_INTERFACE = 0x00000003 CKH_VENDOR_DEFINED = 0x80000000 CKK_RSA = 0x00000000 CKK_DSA = 0x00000001 CKK_DH = 0x00000002 CKK_ECDSA = 0x00000003 // Deprecated CKK_EC = 0x00000003 CKK_X9_42_DH = 0x00000004 CKK_KEA = 0x00000005 // Historical CKK_GENERIC_SECRET = 0x00000010 CKK_RC2 = 0x00000011 // Historical CKK_RC4 = 0x00000012 // Historical CKK_DES = 0x00000013 // Historical CKK_DES2 = 0x00000014 CKK_DES3 = 0x00000015 CKK_CAST = 0x00000016 // Historical CKK_CAST3 = 0x00000017 // Historical CKK_CAST5 = 0x00000018 // Deprecated CKK_CAST128 = 0x00000018 // Historical CKK_RC5 = 0x00000019 // Historical CKK_IDEA = 0x0000001A // Historical CKK_SKIPJACK = 0x0000001B // Historical CKK_BATON = 0x0000001C // Historical CKK_JUNIPER = 0x0000001D // Historical CKK_CDMF = 0x0000001E // Historical CKK_AES = 0x0000001F CKK_BLOWFISH = 0x00000020 CKK_TWOFISH = 0x00000021 CKK_SECURID = 0x00000022 CKK_HOTP = 0x00000023 // Historical CKK_ACTI = 0x00000024 // Historical CKK_CAMELLIA = 0x00000025 CKK_ARIA = 0x00000026 CKK_MD5_HMAC = 0x00000027 // Historical CKK_SHA_1_HMAC = 0x00000028 CKK_RIPEMD128_HMAC = 0x00000029 // Historical CKK_RIPEMD160_HMAC = 0x0000002A // Historical CKK_SHA256_HMAC = 0x0000002B CKK_SHA384_HMAC = 0x0000002C CKK_SHA512_HMAC = 0x0000002D CKK_SHA224_HMAC = 0x0000002E CKK_SEED = 0x0000002F CKK_GOSTR3410 = 0x00000030 CKK_GOSTR3411 = 0x00000031 CKK_GOST28147 = 0x00000032 CKK_CHACHA20 = 0x00000033 CKK_POLY1305 = 0x00000034 CKK_AES_XTS = 0x00000035 CKK_SHA3_224_HMAC = 0x00000036 CKK_SHA3_256_HMAC = 0x00000037 CKK_SHA3_384_HMAC = 0x00000038 CKK_SHA3_512_HMAC = 0x00000039 CKK_BLAKE2B_160_HMAC = 0x0000003a CKK_BLAKE2B_256_HMAC = 0x0000003b CKK_BLAKE2B_384_HMAC = 0x0000003c CKK_BLAKE2B_512_HMAC = 0x0000003d CKK_SALSA20 = 0x0000003e CKK_X2RATCHET = 0x0000003f CKK_EC_EDWARDS = 0x00000040 CKK_EC_MONTGOMERY = 0x00000041 CKK_HKDF = 0x00000042 CKK_SHA512_224_HMAC = 0x00000043 CKK_SHA512_256_HMAC = 0x00000044 CKK_SHA512_T_HMAC = 0x00000045 CKK_HSS = 0x00000046 CKK_XMSS = 0x00000047 CKK_XMSSMT = 0x00000048 CKK_ML_KEM = 0x00000049 CKK_ML_DSA = 0x0000004a CKK_SLH_DSA = 0x0000004b CKK_VENDOR_DEFINED = 0x80000000 CK_CERTIFICATE_CATEGORY_UNSPECIFIED = 0 CK_CERTIFICATE_CATEGORY_TOKEN_USER = 1 CK_CERTIFICATE_CATEGORY_AUTHORITY = 2 CK_CERTIFICATE_CATEGORY_OTHER_ENTITY = 3 CK_SECURITY_DOMAIN_UNSPECIFIED = 0 CK_SECURITY_DOMAIN_MANUFACTURER = 1 CK_SECURITY_DOMAIN_OPERATOR = 2 CK_SECURITY_DOMAIN_THIRD_PARTY = 3 CKC_X_509 = 0x00000000 CKC_X_509_ATTR_CERT = 0x00000001 CKC_WTLS = 0x00000002 CKC_VENDOR_DEFINED = 0x80000000 CKF_ARRAY_ATTRIBUTE = 0x40000000 CK_OTP_FORMAT_DECIMAL = 0 CK_OTP_FORMAT_HEXADECIMAL = 1 CK_OTP_FORMAT_ALPHANUMERIC = 2 CK_OTP_FORMAT_BINARY = 3 CK_OTP_PARAM_IGNORED = 0 CK_OTP_PARAM_OPTIONAL = 1 CK_OTP_PARAM_MANDATORY = 2 CKA_CLASS = 0x00000000 CKA_TOKEN = 0x00000001 CKA_PRIVATE = 0x00000002 CKA_LABEL = 0x00000003 CKA_UNIQUE_ID = 0x00000004 CKA_APPLICATION = 0x00000010 CKA_VALUE = 0x00000011 CKA_OBJECT_ID = 0x00000012 CKA_CERTIFICATE_TYPE = 0x00000080 CKA_ISSUER = 0x00000081 CKA_SERIAL_NUMBER = 0x00000082 CKA_AC_ISSUER = 0x00000083 CKA_OWNER = 0x00000084 CKA_ATTR_TYPES = 0x00000085 CKA_TRUSTED = 0x00000086 CKA_CERTIFICATE_CATEGORY = 0x00000087 CKA_JAVA_MIDP_SECURITY_DOMAIN = 0x00000088 CKA_URL = 0x00000089 CKA_HASH_OF_SUBJECT_PUBLIC_KEY = 0x0000008a CKA_HASH_OF_ISSUER_PUBLIC_KEY = 0x0000008b CKA_NAME_HASH_ALGORITHM = 0x0000008c CKA_CHECK_VALUE = 0x00000090 CKA_KEY_TYPE = 0x00000100 CKA_SUBJECT = 0x00000101 CKA_ID = 0x00000102 CKA_SENSITIVE = 0x00000103 CKA_ENCRYPT = 0x00000104 CKA_DECRYPT = 0x00000105 CKA_WRAP = 0x00000106 CKA_UNWRAP = 0x00000107 CKA_SIGN = 0x00000108 CKA_SIGN_RECOVER = 0x00000109 CKA_VERIFY = 0x0000010a CKA_VERIFY_RECOVER = 0x0000010b CKA_DERIVE = 0x0000010c CKA_START_DATE = 0x00000110 CKA_END_DATE = 0x00000111 CKA_MODULUS = 0x00000120 CKA_MODULUS_BITS = 0x00000121 CKA_PUBLIC_EXPONENT = 0x00000122 CKA_PRIVATE_EXPONENT = 0x00000123 CKA_PRIME_1 = 0x00000124 CKA_PRIME_2 = 0x00000125 CKA_EXPONENT_1 = 0x00000126 CKA_EXPONENT_2 = 0x00000127 CKA_COEFFICIENT = 0x00000128 CKA_PUBLIC_KEY_INFO = 0x00000129 CKA_PRIME = 0x00000130 CKA_SUBPRIME = 0x00000131 CKA_BASE = 0x00000132 CKA_PRIME_BITS = 0x00000133 CKA_SUBPRIME_BITS = 0x00000134 CKA_SUB_PRIME_BITS = CKA_SUBPRIME_BITS CKA_VALUE_BITS = 0x00000160 CKA_VALUE_LEN = 0x00000161 CKA_EXTRACTABLE = 0x00000162 CKA_LOCAL = 0x00000163 CKA_NEVER_EXTRACTABLE = 0x00000164 CKA_ALWAYS_SENSITIVE = 0x00000165 CKA_KEY_GEN_MECHANISM = 0x00000166 CKA_MODIFIABLE = 0x00000170 CKA_COPYABLE = 0x00000171 CKA_DESTROYABLE = 0x00000172 CKA_ECDSA_PARAMS = 0x00000180 // Deprecated CKA_EC_PARAMS = 0x00000180 CKA_EC_POINT = 0x00000181 CKA_SECONDARY_AUTH = 0x00000200 // Deprecated CKA_AUTH_PIN_FLAGS = 0x00000201 // Deprecated CKA_ALWAYS_AUTHENTICATE = 0x00000202 CKA_WRAP_WITH_TRUSTED = 0x00000210 CKA_WRAP_TEMPLATE = (CKF_ARRAY_ATTRIBUTE | 0x00000211) CKA_UNWRAP_TEMPLATE = (CKF_ARRAY_ATTRIBUTE | 0x00000212) CKA_DERIVE_TEMPLATE = (CKF_ARRAY_ATTRIBUTE | 0x00000213) CKA_OTP_FORMAT = 0x00000220 CKA_OTP_LENGTH = 0x00000221 CKA_OTP_TIME_INTERVAL = 0x00000222 CKA_OTP_USER_FRIENDLY_MODE = 0x00000223 CKA_OTP_CHALLENGE_REQUIREMENT = 0x00000224 CKA_OTP_TIME_REQUIREMENT = 0x00000225 CKA_OTP_COUNTER_REQUIREMENT = 0x00000226 CKA_OTP_PIN_REQUIREMENT = 0x00000227 CKA_OTP_COUNTER = 0x0000022e CKA_OTP_TIME = 0x0000022f CKA_OTP_USER_IDENTIFIER = 0x0000022a CKA_OTP_SERVICE_IDENTIFIER = 0x0000022b CKA_OTP_SERVICE_LOGO = 0x0000022c CKA_OTP_SERVICE_LOGO_TYPE = 0x0000022d CKA_GOSTR3410_PARAMS = 0x00000250 CKA_GOSTR3411_PARAMS = 0x00000251 CKA_GOST28147_PARAMS = 0x00000252 CKA_HW_FEATURE_TYPE = 0x00000300 CKA_RESET_ON_INIT = 0x00000301 CKA_HAS_RESET = 0x00000302 CKA_PIXEL_X = 0x00000400 CKA_PIXEL_Y = 0x00000401 CKA_RESOLUTION = 0x00000402 CKA_CHAR_ROWS = 0x00000403 CKA_CHAR_COLUMNS = 0x00000404 CKA_COLOR = 0x00000405 CKA_BITS_PER_PIXEL = 0x00000406 CKA_CHAR_SETS = 0x00000480 CKA_ENCODING_METHODS = 0x00000481 CKA_MIME_TYPES = 0x00000482 CKA_MECHANISM_TYPE = 0x00000500 CKA_REQUIRED_CMS_ATTRIBUTES = 0x00000501 CKA_DEFAULT_CMS_ATTRIBUTES = 0x00000502 CKA_SUPPORTED_CMS_ATTRIBUTES = 0x00000503 CKA_ALLOWED_MECHANISMS = (CKF_ARRAY_ATTRIBUTE | 0x00000600) CKA_PROFILE_ID = 0x00000601 CKA_X2RATCHET_BAG = 0x00000602 CKA_X2RATCHET_BAGSIZE = 0x00000603 CKA_X2RATCHET_BOBS1STMSG = 0x00000604 CKA_X2RATCHET_CKR = 0x00000605 CKA_X2RATCHET_CKS = 0x00000606 CKA_X2RATCHET_DHP = 0x00000607 CKA_X2RATCHET_DHR = 0x00000608 CKA_X2RATCHET_DHS = 0x00000609 CKA_X2RATCHET_HKR = 0x0000060a CKA_X2RATCHET_HKS = 0x0000060b CKA_X2RATCHET_ISALICE = 0x0000060c CKA_X2RATCHET_NHKR = 0x0000060d CKA_X2RATCHET_NHKS = 0x0000060e CKA_X2RATCHET_NR = 0x0000060f CKA_X2RATCHET_NS = 0x00000610 CKA_X2RATCHET_PNS = 0x00000611 CKA_X2RATCHET_RK = 0x00000612 CKA_HSS_LEVELS = 0x00000617 CKA_HSS_LMS_TYPE = 0x00000618 CKA_HSS_LMOTS_TYPE = 0x00000619 CKA_HSS_LMS_TYPES = 0x0000061a CKA_HSS_LMOTS_TYPES = 0x0000061b CKA_HSS_KEYS_REMAINING = 0x0000061c CKA_PARAMETER_SET = 0x0000061d CKA_OBJECT_VALIDATION_FLAGS = 0x0000061e CKA_VALIDATION_TYPE = 0x0000061f CKA_VALIDATION_VERSION = 0x00000620 CKA_VALIDATION_LEVEL = 0x00000621 CKA_VALIDATION_MODULE_ID = 0x00000622 CKA_VALIDATION_FLAG = 0x00000623 CKA_VALIDATION_AUTHORITY_TYPE = 0x00000624 CKA_VALIDATION_COUNTRY = 0x00000625 CKA_VALIDATION_CERTIFICATE_IDENTIFIER = 0x00000626 CKA_VALIDATION_CERTIFICATE_URI = 0x00000627 CKA_VALIDATION_VENDOR_URI = 0x00000628 CKA_VALIDATION_PROFILE = 0x00000629 CKA_ENCAPSULATE_TEMPLATE = 0x0000062a CKA_DECAPSULATE_TEMPLATE = 0x0000062b CKA_TRUST_SERVER_AUTH = 0x0000062c CKA_TRUST_CLIENT_AUTH = 0x0000062d CKA_TRUST_CODE_SIGNING = 0x0000062e CKA_TRUST_EMAIL_PROTECTION = 0x0000062f CKA_TRUST_IPSEC_IKE = 0x00000630 CKA_TRUST_TIME_STAMPING = 0x00000631 CKA_TRUST_OCSP_SIGNING = 0x00000632 CKA_ENCAPSULATE = 0x00000633 CKA_DECAPSULATE = 0x00000634 CKA_HASH_OF_CERTIFICATE = 0x00000635 CKA_PUBLIC_CRC64_VALUE = 0x00000636 CKA_SEED = 0x00000637 CKA_VENDOR_DEFINED = 0x80000000 CKM_RSA_PKCS_KEY_PAIR_GEN = 0x00000000 CKM_RSA_PKCS = 0x00000001 CKM_RSA_9796 = 0x00000002 CKM_RSA_X_509 = 0x00000003 CKM_MD2_RSA_PKCS = 0x00000004 CKM_MD5_RSA_PKCS = 0x00000005 CKM_SHA1_RSA_PKCS = 0x00000006 CKM_RIPEMD128_RSA_PKCS = 0x00000007 CKM_RIPEMD160_RSA_PKCS = 0x00000008 CKM_RSA_PKCS_OAEP = 0x00000009 CKM_RSA_X9_31_KEY_PAIR_GEN = 0x0000000a CKM_RSA_X9_31 = 0x0000000b CKM_SHA1_RSA_X9_31 = 0x0000000c CKM_RSA_PKCS_PSS = 0x0000000d CKM_SHA1_RSA_PKCS_PSS = 0x0000000e CKM_DSA_KEY_PAIR_GEN = 0x00000010 CKM_DSA = 0x00000011 CKM_DSA_SHA1 = 0x00000012 CKM_DSA_SHA224 = 0x00000013 CKM_DSA_SHA256 = 0x00000014 CKM_DSA_SHA384 = 0x00000015 CKM_DSA_SHA512 = 0x00000016 CKM_DSA_SHA3_224 = 0x00000018 CKM_DSA_SHA3_256 = 0x00000019 CKM_DSA_SHA3_384 = 0x0000001a CKM_DSA_SHA3_512 = 0x0000001b CKM_DH_PKCS_KEY_PAIR_GEN = 0x00000020 CKM_DH_PKCS_DERIVE = 0x00000021 CKM_X9_42_DH_KEY_PAIR_GEN = 0x00000030 CKM_X9_42_DH_DERIVE = 0x00000031 CKM_X9_42_DH_HYBRID_DERIVE = 0x00000032 CKM_X9_42_MQV_DERIVE = 0x00000033 CKM_SHA256_RSA_PKCS = 0x00000040 CKM_SHA384_RSA_PKCS = 0x00000041 CKM_SHA512_RSA_PKCS = 0x00000042 CKM_SHA256_RSA_PKCS_PSS = 0x00000043 CKM_SHA384_RSA_PKCS_PSS = 0x00000044 CKM_SHA512_RSA_PKCS_PSS = 0x00000045 CKM_SHA224_RSA_PKCS = 0x00000046 CKM_SHA224_RSA_PKCS_PSS = 0x00000047 CKM_SHA512_224 = 0x00000048 CKM_SHA512_224_HMAC = 0x00000049 CKM_SHA512_224_HMAC_GENERAL = 0x0000004a CKM_SHA512_224_KEY_DERIVATION = 0x0000004b CKM_SHA512_256 = 0x0000004c CKM_SHA512_256_HMAC = 0x0000004d CKM_SHA512_256_HMAC_GENERAL = 0x0000004e CKM_SHA512_256_KEY_DERIVATION = 0x0000004f CKM_SHA512_T = 0x00000050 CKM_SHA512_T_HMAC = 0x00000051 CKM_SHA512_T_HMAC_GENERAL = 0x00000052 CKM_SHA512_T_KEY_DERIVATION = 0x00000053 CKM_SHA3_256_RSA_PKCS = 0x00000060 CKM_SHA3_384_RSA_PKCS = 0x00000061 CKM_SHA3_512_RSA_PKCS = 0x00000062 CKM_SHA3_256_RSA_PKCS_PSS = 0x00000063 CKM_SHA3_384_RSA_PKCS_PSS = 0x00000064 CKM_SHA3_512_RSA_PKCS_PSS = 0x00000065 CKM_SHA3_224_RSA_PKCS = 0x00000066 CKM_SHA3_224_RSA_PKCS_PSS = 0x00000067 CKM_RC2_KEY_GEN = 0x00000100 // Historical CKM_RC2_ECB = 0x00000101 // Historical CKM_RC2_CBC = 0x00000102 // Historical CKM_RC2_MAC = 0x00000103 // Historical CKM_RC2_MAC_GENERAL = 0x00000104 // Historical CKM_RC2_CBC_PAD = 0x00000105 // Historical CKM_RC4_KEY_GEN = 0x00000110 // Historical CKM_RC4 = 0x00000111 // Historical CKM_DES_KEY_GEN = 0x00000120 // Historical CKM_DES_ECB = 0x00000121 // Historical CKM_DES_CBC = 0x00000122 // Historical CKM_DES_MAC = 0x00000123 // Historical CKM_DES_MAC_GENERAL = 0x00000124 // Historical CKM_DES_CBC_PAD = 0x00000125 // Historical CKM_DES2_KEY_GEN = 0x00000130 CKM_DES3_KEY_GEN = 0x00000131 CKM_DES3_ECB = 0x00000132 CKM_DES3_CBC = 0x00000133 CKM_DES3_MAC = 0x00000134 CKM_DES3_MAC_GENERAL = 0x00000135 CKM_DES3_CBC_PAD = 0x00000136 CKM_DES3_CMAC_GENERAL = 0x00000137 CKM_DES3_CMAC = 0x00000138 CKM_CDMF_KEY_GEN = 0x00000140 // Historical CKM_CDMF_ECB = 0x00000141 // Historical CKM_CDMF_CBC = 0x00000142 // Historical CKM_CDMF_MAC = 0x00000143 // Historical CKM_CDMF_MAC_GENERAL = 0x00000144 // Historical CKM_CDMF_CBC_PAD = 0x00000145 // Historical CKM_DES_OFB64 = 0x00000150 CKM_DES_OFB8 = 0x00000151 CKM_DES_CFB64 = 0x00000152 CKM_DES_CFB8 = 0x00000153 CKM_MD2 = 0x00000200 // Historical CKM_MD2_HMAC = 0x00000201 // Historical CKM_MD2_HMAC_GENERAL = 0x00000202 // Historical CKM_MD5 = 0x00000210 // Historical CKM_MD5_HMAC = 0x00000211 // Historical CKM_MD5_HMAC_GENERAL = 0x00000212 // Historical CKM_SHA_1 = 0x00000220 CKM_SHA_1_HMAC = 0x00000221 CKM_SHA_1_HMAC_GENERAL = 0x00000222 CKM_RIPEMD128 = 0x00000230 // Historical CKM_RIPEMD128_HMAC = 0x00000231 // Historical CKM_RIPEMD128_HMAC_GENERAL = 0x00000232 // Historical CKM_RIPEMD160 = 0x00000240 // Historical CKM_RIPEMD160_HMAC = 0x00000241 // Historical CKM_RIPEMD160_HMAC_GENERAL = 0x00000242 // Historical CKM_SHA256 = 0x00000250 CKM_SHA256_HMAC = 0x00000251 CKM_SHA256_HMAC_GENERAL = 0x00000252 CKM_SHA224 = 0x00000255 CKM_SHA224_HMAC = 0x00000256 CKM_SHA224_HMAC_GENERAL = 0x00000257 CKM_SHA384 = 0x00000260 CKM_SHA384_HMAC = 0x00000261 CKM_SHA384_HMAC_GENERAL = 0x00000262 CKM_SHA512 = 0x00000270 CKM_SHA512_HMAC = 0x00000271 CKM_SHA512_HMAC_GENERAL = 0x00000272 CKM_SECURID_KEY_GEN = 0x00000280 CKM_SECURID = 0x00000282 CKM_HOTP_KEY_GEN = 0x00000290 CKM_HOTP = 0x00000291 CKM_ACTI = 0x000002a0 CKM_ACTI_KEY_GEN = 0x000002a1 CKM_SHA3_256 = 0x000002b0 CKM_SHA3_256_HMAC = 0x000002b1 CKM_SHA3_256_HMAC_GENERAL = 0x000002b2 CKM_SHA3_256_KEY_GEN = 0x000002b3 CKM_SHA3_224 = 0x000002b5 CKM_SHA3_224_HMAC = 0x000002b6 CKM_SHA3_224_HMAC_GENERAL = 0x000002b7 CKM_SHA3_224_KEY_GEN = 0x000002b8 CKM_SHA3_384 = 0x000002c0 CKM_SHA3_384_HMAC = 0x000002c1 CKM_SHA3_384_HMAC_GENERAL = 0x000002c2 CKM_SHA3_384_KEY_GEN = 0x000002c3 CKM_SHA3_512 = 0x000002d0 CKM_SHA3_512_HMAC = 0x000002d1 CKM_SHA3_512_HMAC_GENERAL = 0x000002d2 CKM_SHA3_512_KEY_GEN = 0x000002d3 CKM_CAST_KEY_GEN = 0x00000300 // Historical CKM_CAST_ECB = 0x00000301 // Historical CKM_CAST_CBC = 0x00000302 // Historical CKM_CAST_MAC = 0x00000303 // Historical CKM_CAST_MAC_GENERAL = 0x00000304 // Historical CKM_CAST_CBC_PAD = 0x00000305 // Historical CKM_CAST3_KEY_GEN = 0x00000310 // Historical CKM_CAST3_ECB = 0x00000311 // Historical CKM_CAST3_CBC = 0x00000312 // Historical CKM_CAST3_MAC = 0x00000313 // Historical CKM_CAST3_MAC_GENERAL = 0x00000314 // Historical CKM_CAST3_CBC_PAD = 0x00000315 // Historical CKM_CAST5_KEY_GEN = 0x00000320 // Historical CKM_CAST128_KEY_GEN = 0x00000320 // Historical CKM_CAST5_ECB = 0x00000321 // Historical CKM_CAST128_ECB = 0x00000321 // Historical CKM_CAST5_CBC = 0x00000322 // Deprecated CKM_CAST128_CBC = 0x00000322 // Historical CKM_CAST5_MAC = 0x00000323 // Deprecated CKM_CAST128_MAC = 0x00000323 // Historical CKM_CAST5_MAC_GENERAL = 0x00000324 // Deprecated CKM_CAST128_MAC_GENERAL = 0x00000324 // Historical CKM_CAST5_CBC_PAD = 0x00000325 // Deprecated CKM_CAST128_CBC_PAD = 0x00000325 // Historical CKM_RC5_KEY_GEN = 0x00000330 // Historical CKM_RC5_ECB = 0x00000331 // Historical CKM_RC5_CBC = 0x00000332 // Historical CKM_RC5_MAC = 0x00000333 // Historical CKM_RC5_MAC_GENERAL = 0x00000334 // Historical CKM_RC5_CBC_PAD = 0x00000335 // Historical CKM_IDEA_KEY_GEN = 0x00000340 // Historical CKM_IDEA_ECB = 0x00000341 // Historical CKM_IDEA_CBC = 0x00000342 // Historical CKM_IDEA_MAC = 0x00000343 // Historical CKM_IDEA_MAC_GENERAL = 0x00000344 // Historical CKM_IDEA_CBC_PAD = 0x00000345 // Historical CKM_GENERIC_SECRET_KEY_GEN = 0x00000350 CKM_CONCATENATE_BASE_AND_KEY = 0x00000360 CKM_CONCATENATE_BASE_AND_DATA = 0x00000362 CKM_CONCATENATE_DATA_AND_BASE = 0x00000363 CKM_XOR_BASE_AND_DATA = 0x00000364 CKM_EXTRACT_KEY_FROM_KEY = 0x00000365 CKM_SSL3_PRE_MASTER_KEY_GEN = 0x00000370 CKM_SSL3_MASTER_KEY_DERIVE = 0x00000371 CKM_SSL3_KEY_AND_MAC_DERIVE = 0x00000372 CKM_SSL3_MASTER_KEY_DERIVE_DH = 0x00000373 CKM_TLS_PRE_MASTER_KEY_GEN = 0x00000374 CKM_TLS_MASTER_KEY_DERIVE = 0x00000375 CKM_TLS_KEY_AND_MAC_DERIVE = 0x00000376 CKM_TLS_MASTER_KEY_DERIVE_DH = 0x00000377 CKM_TLS_PRF = 0x00000378 CKM_SSL3_MD5_MAC = 0x00000380 CKM_SSL3_SHA1_MAC = 0x00000381 CKM_MD5_KEY_DERIVATION = 0x00000390 // Historical CKM_MD2_KEY_DERIVATION = 0x00000391 // Historical CKM_SHA1_KEY_DERIVATION = 0x00000392 CKM_SHA256_KEY_DERIVATION = 0x00000393 CKM_SHA384_KEY_DERIVATION = 0x00000394 CKM_SHA512_KEY_DERIVATION = 0x00000395 CKM_SHA224_KEY_DERIVATION = 0x00000396 CKM_SHA3_256_KEY_DERIVATION = 0x00000397 CKM_SHA3_224_KEY_DERIVATION = 0x00000398 CKM_SHA3_384_KEY_DERIVATION = 0x00000399 CKM_SHA3_512_KEY_DERIVATION = 0x0000039a CKM_SHAKE_128_KEY_DERIVATION = 0x0000039b CKM_SHAKE_256_KEY_DERIVATION = 0x0000039c CKM_SHA3_256_KEY_DERIVE = CKM_SHA3_256_KEY_DERIVATION CKM_SHA3_224_KEY_DERIVE = CKM_SHA3_224_KEY_DERIVATION CKM_SHA3_384_KEY_DERIVE = CKM_SHA3_384_KEY_DERIVATION CKM_SHA3_512_KEY_DERIVE = CKM_SHA3_512_KEY_DERIVATION CKM_SHAKE_128_KEY_DERIVE = CKM_SHAKE_128_KEY_DERIVATION CKM_SHAKE_256_KEY_DERIVE = CKM_SHAKE_256_KEY_DERIVATION CKM_PBE_MD2_DES_CBC = 0x000003a0 // Historical CKM_PBE_MD5_DES_CBC = 0x000003a1 // Historical CKM_PBE_MD5_CAST_CBC = 0x000003a2 // Historical CKM_PBE_MD5_CAST3_CBC = 0x000003a3 // Historical CKM_PBE_MD5_CAST5_CBC = 0x000003a4 // Deprecated CKM_PBE_MD5_CAST128_CBC = 0x000003a4 // Historical CKM_PBE_SHA1_CAST5_CBC = 0x000003a5 // Deprecated CKM_PBE_SHA1_CAST128_CBC = 0x000003a5 // Historical CKM_PBE_SHA1_RC4_128 = 0x000003a6 // Historical CKM_PBE_SHA1_RC4_40 = 0x000003a7 // Historical CKM_PBE_SHA1_DES3_EDE_CBC = 0x000003a8 CKM_PBE_SHA1_DES2_EDE_CBC = 0x000003a9 CKM_PBE_SHA1_RC2_128_CBC = 0x000003aa CKM_PBE_SHA1_RC2_40_CBC = 0x000003ab CKM_PKCS5_PBKD2 = 0x000003b0 CKM_PBA_SHA1_WITH_SHA1_HMAC = 0x000003c0 CKM_WTLS_PRE_MASTER_KEY_GEN = 0x000003d0 CKM_WTLS_MASTER_KEY_DERIVE = 0x000003d1 CKM_WTLS_MASTER_KEY_DERIVE_DH_ECC = 0x000003d2 CKM_WTLS_PRF = 0x000003d3 CKM_WTLS_SERVER_KEY_AND_MAC_DERIVE = 0x000003d4 CKM_WTLS_CLIENT_KEY_AND_MAC_DERIVE = 0x000003d5 CKM_TLS10_MAC_SERVER = 0x000003d6 CKM_TLS10_MAC_CLIENT = 0x000003d7 CKM_TLS12_MAC = 0x000003d8 CKM_TLS12_KDF = 0x000003d9 CKM_TLS12_MASTER_KEY_DERIVE = 0x000003e0 CKM_TLS12_KEY_AND_MAC_DERIVE = 0x000003e1 CKM_TLS12_MASTER_KEY_DERIVE_DH = 0x000003e2 CKM_TLS12_KEY_SAFE_DERIVE = 0x000003e3 CKM_TLS_MAC = 0x000003e4 CKM_TLS_KDF = 0x000003e5 CKM_KEY_WRAP_LYNKS = 0x00000400 CKM_KEY_WRAP_SET_OAEP = 0x00000401 CKM_CMS_SIG = 0x00000500 CKM_KIP_DERIVE = 0x00000510 CKM_KIP_WRAP = 0x00000511 CKM_KIP_MAC = 0x00000512 CKM_CAMELLIA_KEY_GEN = 0x00000550 CKM_CAMELLIA_ECB = 0x00000551 CKM_CAMELLIA_CBC = 0x00000552 CKM_CAMELLIA_MAC = 0x00000553 CKM_CAMELLIA_MAC_GENERAL = 0x00000554 CKM_CAMELLIA_CBC_PAD = 0x00000555 CKM_CAMELLIA_ECB_ENCRYPT_DATA = 0x00000556 CKM_CAMELLIA_CBC_ENCRYPT_DATA = 0x00000557 CKM_CAMELLIA_CTR = 0x00000558 // Historical CKM_ARIA_KEY_GEN = 0x00000560 CKM_ARIA_ECB = 0x00000561 CKM_ARIA_CBC = 0x00000562 CKM_ARIA_MAC = 0x00000563 CKM_ARIA_MAC_GENERAL = 0x00000564 CKM_ARIA_CBC_PAD = 0x00000565 CKM_ARIA_ECB_ENCRYPT_DATA = 0x00000566 CKM_ARIA_CBC_ENCRYPT_DATA = 0x00000567 CKM_SEED_KEY_GEN = 0x00000650 CKM_SEED_ECB = 0x00000651 CKM_SEED_CBC = 0x00000652 CKM_SEED_MAC = 0x00000653 CKM_SEED_MAC_GENERAL = 0x00000654 CKM_SEED_CBC_PAD = 0x00000655 CKM_SEED_ECB_ENCRYPT_DATA = 0x00000656 CKM_SEED_CBC_ENCRYPT_DATA = 0x00000657 CKM_SKIPJACK_KEY_GEN = 0x00001000 // Historical CKM_SKIPJACK_ECB64 = 0x00001001 // Historical CKM_SKIPJACK_CBC64 = 0x00001002 // Historical CKM_SKIPJACK_OFB64 = 0x00001003 // Historical CKM_SKIPJACK_CFB64 = 0x00001004 // Historical CKM_SKIPJACK_CFB32 = 0x00001005 // Historical CKM_SKIPJACK_CFB16 = 0x00001006 // Historical CKM_SKIPJACK_CFB8 = 0x00001007 // Historical CKM_SKIPJACK_WRAP = 0x00001008 // Historical CKM_SKIPJACK_PRIVATE_WRAP = 0x00001009 // Historical CKM_SKIPJACK_RELAYX = 0x0000100a // Historical CKM_KEA_KEY_PAIR_GEN = 0x00001010 // Historical CKM_KEA_KEY_DERIVE = 0x00001011 // Historical CKM_KEA_DERIVE = 0x00001012 // Historical CKM_FORTEZZA_TIMESTAMP = 0x00001020 // Historical CKM_BATON_KEY_GEN = 0x00001030 // Historical CKM_BATON_ECB128 = 0x00001031 // Historical CKM_BATON_ECB96 = 0x00001032 // Historical CKM_BATON_CBC128 = 0x00001033 // Historical CKM_BATON_COUNTER = 0x00001034 // Historical CKM_BATON_SHUFFLE = 0x00001035 // Historical CKM_BATON_WRAP = 0x00001036 // Historical CKM_ECDSA_KEY_PAIR_GEN = 0x00001040 // Deprecated CKM_EC_KEY_PAIR_GEN = 0x00001040 CKM_ECDSA = 0x00001041 CKM_ECDSA_SHA1 = 0x00001042 CKM_ECDSA_SHA224 = 0x00001043 CKM_ECDSA_SHA256 = 0x00001044 CKM_ECDSA_SHA384 = 0x00001045 CKM_ECDSA_SHA512 = 0x00001046 CKM_EC_KEY_PAIR_GEN_W_EXTRA_BITS = 0x0000140b CKM_ECDH1_DERIVE = 0x00001050 CKM_ECDH1_COFACTOR_DERIVE = 0x00001051 CKM_ECMQV_DERIVE = 0x00001052 CKM_ECDH_AES_KEY_WRAP = 0x00001053 CKM_RSA_AES_KEY_WRAP = 0x00001054 CKM_JUNIPER_KEY_GEN = 0x00001060 // Historical CKM_JUNIPER_ECB128 = 0x00001061 // Historical CKM_JUNIPER_CBC128 = 0x00001062 // Historical CKM_JUNIPER_COUNTER = 0x00001063 // Historical CKM_JUNIPER_SHUFFLE = 0x00001064 // Historical CKM_JUNIPER_WRAP = 0x00001065 // Historical CKM_FASTHASH = 0x00001070 CKM_AES_XTS = 0x00001071 CKM_AES_XTS_KEY_GEN = 0x00001072 CKM_AES_KEY_GEN = 0x00001080 CKM_AES_ECB = 0x00001081 CKM_AES_CBC = 0x00001082 CKM_AES_MAC = 0x00001083 CKM_AES_MAC_GENERAL = 0x00001084 CKM_AES_CBC_PAD = 0x00001085 CKM_AES_CTR = 0x00001086 CKM_AES_GCM = 0x00001087 CKM_AES_CCM = 0x00001088 CKM_AES_CTS = 0x00001089 CKM_AES_CMAC = 0x0000108a CKM_AES_CMAC_GENERAL = 0x0000108b CKM_AES_XCBC_MAC = 0x0000108c CKM_AES_XCBC_MAC_96 = 0x0000108d CKM_AES_GMAC = 0x0000108e CKM_BLOWFISH_KEY_GEN = 0x00001090 CKM_BLOWFISH_CBC = 0x00001091 CKM_TWOFISH_KEY_GEN = 0x00001092 CKM_TWOFISH_CBC = 0x00001093 CKM_BLOWFISH_CBC_PAD = 0x00001094 CKM_TWOFISH_CBC_PAD = 0x00001095 CKM_DES_ECB_ENCRYPT_DATA = 0x00001100 CKM_DES_CBC_ENCRYPT_DATA = 0x00001101 CKM_DES3_ECB_ENCRYPT_DATA = 0x00001102 CKM_DES3_CBC_ENCRYPT_DATA = 0x00001103 CKM_AES_ECB_ENCRYPT_DATA = 0x00001104 CKM_AES_CBC_ENCRYPT_DATA = 0x00001105 CKM_GOSTR3410_KEY_PAIR_GEN = 0x00001200 CKM_GOSTR3410 = 0x00001201 CKM_GOSTR3410_WITH_GOSTR3411 = 0x00001202 CKM_GOSTR3410_KEY_WRAP = 0x00001203 CKM_GOSTR3410_DERIVE = 0x00001204 CKM_GOSTR3411 = 0x00001210 CKM_GOSTR3411_HMAC = 0x00001211 CKM_GOST28147_KEY_GEN = 0x00001220 CKM_GOST28147_ECB = 0x00001221 CKM_GOST28147 = 0x00001222 CKM_GOST28147_MAC = 0x00001223 CKM_GOST28147_KEY_WRAP = 0x00001224 CKM_CHACHA20_KEY_GEN = 0x00001225 CKM_CHACHA20 = 0x00001226 CKM_POLY1305_KEY_GEN = 0x00001227 CKM_POLY1305 = 0x00001228 CKM_DSA_PARAMETER_GEN = 0x00002000 CKM_DH_PKCS_PARAMETER_GEN = 0x00002001 CKM_X9_42_DH_PARAMETER_GEN = 0x00002002 CKM_DSA_PROBABILISTIC_PARAMETER_GEN = 0x00002003 CKM_DSA_PROBABLISTIC_PARAMETER_GEN = CKM_DSA_PROBABILISTIC_PARAMETER_GEN // Depricated CKM_DSA_SHAWE_TAYLOR_PARAMETER_GEN = 0x00002004 CKM_DSA_FIPS_G_GEN = 0x00002005 CKM_AES_OFB = 0x00002104 CKM_AES_CFB64 = 0x00002105 CKM_AES_CFB8 = 0x00002106 CKM_AES_CFB128 = 0x00002107 CKM_AES_CFB1 = 0x00002108 CKM_AES_KEY_WRAP = 0x00002109 // WAS: 0x00001090 CKM_AES_KEY_WRAP_PAD = 0x0000210A // WAS: 0x00001091 CKM_AES_KEY_WRAP_KWP = 0x0000210B CKM_AES_KEY_WRAP_PKCS7 = 0x0000210C CKM_RSA_PKCS_TPM_1_1 = 0x00004001 CKM_RSA_PKCS_OAEP_TPM_1_1 = 0x00004002 CKM_SHA_1_KEY_GEN = 0x00004003 CKM_SHA224_KEY_GEN = 0x00004004 CKM_SHA256_KEY_GEN = 0x00004005 CKM_SHA384_KEY_GEN = 0x00004006 CKM_SHA512_KEY_GEN = 0x00004007 CKM_SHA512_224_KEY_GEN = 0x00004008 CKM_SHA512_256_KEY_GEN = 0x00004009 CKM_SHA512_T_KEY_GEN = 0x0000400a CKM_NULL = 0x0000400b CKM_BLAKE2B_160 = 0x0000400c CKM_BLAKE2B_160_HMAC = 0x0000400d CKM_BLAKE2B_160_HMAC_GENERAL = 0x0000400e CKM_BLAKE2B_160_KEY_DERIVE = 0x0000400f CKM_BLAKE2B_160_KEY_GEN = 0x00004010 CKM_BLAKE2B_256 = 0x00004011 CKM_BLAKE2B_256_HMAC = 0x00004012 CKM_BLAKE2B_256_HMAC_GENERAL = 0x00004013 CKM_BLAKE2B_256_KEY_DERIVE = 0x00004014 CKM_BLAKE2B_256_KEY_GEN = 0x00004015 CKM_BLAKE2B_384 = 0x00004016 CKM_BLAKE2B_384_HMAC = 0x00004017 CKM_BLAKE2B_384_HMAC_GENERAL = 0x00004018 CKM_BLAKE2B_384_KEY_DERIVE = 0x00004019 CKM_BLAKE2B_384_KEY_GEN = 0x0000401a CKM_BLAKE2B_512 = 0x0000401b CKM_BLAKE2B_512_HMAC = 0x0000401c CKM_BLAKE2B_512_HMAC_GENERAL = 0x0000401d CKM_BLAKE2B_512_KEY_DERIVE = 0x0000401e CKM_BLAKE2B_512_KEY_GEN = 0x0000401f CKM_SALSA20 = 0x00004020 CKM_CHACHA20_POLY1305 = 0x00004021 CKM_SALSA20_POLY1305 = 0x00004022 CKM_X3DH_INITIALIZE = 0x00004023 CKM_X3DH_RESPOND = 0x00004024 CKM_X2RATCHET_INITIALIZE = 0x00004025 CKM_X2RATCHET_RESPOND = 0x00004026 CKM_X2RATCHET_ENCRYPT = 0x00004027 CKM_X2RATCHET_DECRYPT = 0x00004028 CKM_XEDDSA = 0x00004029 CKM_HKDF_DERIVE = 0x0000402a CKM_HKDF_DATA = 0x0000402b CKM_HKDF_KEY_GEN = 0x0000402c CKM_SALSA20_KEY_GEN = 0x0000402d CKM_ECDSA_SHA3_224 = 0x00001047 CKM_ECDSA_SHA3_256 = 0x00001048 CKM_ECDSA_SHA3_384 = 0x00001049 CKM_ECDSA_SHA3_512 = 0x0000104a CKM_EC_EDWARDS_KEY_PAIR_GEN = 0x00001055 CKM_EC_MONTGOMERY_KEY_PAIR_GEN = 0x00001056 CKM_EDDSA = 0x00001057 CKM_SP800_108_COUNTER_KDF = 0x000003ac CKM_SP800_108_FEEDBACK_KDF = 0x000003ad CKM_SP800_108_DOUBLE_PIPELINE_KDF = 0x000003ae CKM_IKE2_PRF_PLUS_DERIVE = 0x0000402e CKM_IKE_PRF_DERIVE = 0x0000402f CKM_IKE1_PRF_DERIVE = 0x00004030 CKM_IKE1_EXTENDED_DERIVE = 0x00004031 CKM_HSS_KEY_PAIR_GEN = 0x00004032 CKM_HSS = 0x00004033 CKM_XMSS_KEY_PAIR_GEN = 0x00004034 CKM_XMSSMT_KEY_PAIR_GEN = 0x00004035 CKM_XMSS = 0x00004036 CKM_XMSSMT = 0x00004037 CKM_ECDH_X_AES_KEY_WRAP = 0x00004038 CKM_ECDH_COF_AES_KEY_WRAP = 0x00004039 CKM_PUB_KEY_FROM_PRIV_KEY = 0x0000403a CKM_ML_KEM_KEY_PAIR_GEN = 0x0000000f CKM_ML_KEM = 0x00000017 CKM_ML_DSA_KEY_PAIR_GEN = 0x0000001c CKM_ML_DSA = 0x0000001d CKM_HASH_ML_DSA = 0x0000001f CKM_HASH_ML_DSA_SHA224 = 0x00000023 CKM_HASH_ML_DSA_SHA256 = 0x00000024 CKM_HASH_ML_DSA_SHA384 = 0x00000025 CKM_HASH_ML_DSA_SHA512 = 0x00000026 CKM_HASH_ML_DSA_SHA3_224 = 0x00000027 CKM_HASH_ML_DSA_SHA3_256 = 0x00000028 CKM_HASH_ML_DSA_SHA3_384 = 0x00000029 CKM_HASH_ML_DSA_SHA3_512 = 0x0000002a CKM_HASH_ML_DSA_SHAKE128 = 0x0000002b CKM_HASH_ML_DSA_SHAKE256 = 0x0000002c CKM_SLH_DSA_KEY_PAIR_GEN = 0x0000002d CKM_SLH_DSA = 0x0000002e CKM_HASH_SLH_DSA = 0x00000034 CKM_HASH_SLH_DSA_SHA224 = 0x00000036 CKM_HASH_SLH_DSA_SHA256 = 0x00000037 CKM_HASH_SLH_DSA_SHA384 = 0x00000038 CKM_HASH_SLH_DSA_SHA512 = 0x00000039 CKM_HASH_SLH_DSA_SHA3_224 = 0x0000003a CKM_HASH_SLH_DSA_SHA3_256 = 0x0000003b CKM_HASH_SLH_DSA_SHA3_384 = 0x0000003c CKM_HASH_SLH_DSA_SHA3_512 = 0x0000003d CKM_HASH_SLH_DSA_SHAKE128 = 0x0000003e CKM_HASH_SLH_DSA_SHAKE256 = 0x0000003f CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE = 0x00000056 CKM_TLS12_EXTENDED_MASTER_KEY_DERIVE_DH = 0x00000057 CKM_VENDOR_DEFINED = 0x80000000 CKF_HW = 0x00000001 // performed by HW CKF_MESSAGE_ENCRYPT = 0x00000002 CKF_MESSAGE_DECRYPT = 0x00000004 CKF_MESSAGE_SIGN = 0x00000008 CKF_MESSAGE_VERIFY = 0x00000010 CKF_MULTI_MESSAGE = 0x00000020 CKF_MULTI_MESSGE = CKF_MULTI_MESSAGE CKF_FIND_OBJECTS = 0x00000040 CKF_ENCRYPT = 0x00000100 CKF_DECRYPT = 0x00000200 CKF_DIGEST = 0x00000400 CKF_SIGN = 0x00000800 CKF_SIGN_RECOVER = 0x00001000 CKF_VERIFY = 0x00002000 CKF_VERIFY_RECOVER = 0x00004000 CKF_GENERATE = 0x00008000 CKF_GENERATE_KEY_PAIR = 0x00010000 CKF_WRAP = 0x00020000 CKF_UNWRAP = 0x00040000 CKF_DERIVE = 0x00080000 CKF_EC_F_P = 0x00100000 CKF_EC_F_2M = 0x00200000 CKF_EC_ECPARAMETERS = 0x00400000 CKF_EC_OID = 0x00800000 CKF_EC_NAMEDCURVE = CKF_EC_OID // deprecated since PKCS#11 3.00 CKF_EC_UNCOMPRESS = 0x01000000 CKF_EC_COMPRESS = 0x02000000 CKF_EC_CURVENAME = 0x04000000 CKF_ENCAPSULATE = 0x10000000 CKF_DECAPSULATE = 0x20000000 CKF_EXTENSION = 0x80000000 CKR_OK = 0x00000000 CKR_CANCEL = 0x00000001 CKR_HOST_MEMORY = 0x00000002 CKR_SLOT_ID_INVALID = 0x00000003 CKR_GENERAL_ERROR = 0x00000005 CKR_FUNCTION_FAILED = 0x00000006 CKR_ARGUMENTS_BAD = 0x00000007 CKR_NO_EVENT = 0x00000008 CKR_NEED_TO_CREATE_THREADS = 0x00000009 CKR_CANT_LOCK = 0x0000000A CKR_ATTRIBUTE_READ_ONLY = 0x00000010 CKR_ATTRIBUTE_SENSITIVE = 0x00000011 CKR_ATTRIBUTE_TYPE_INVALID = 0x00000012 CKR_ATTRIBUTE_VALUE_INVALID = 0x00000013 CKR_ACTION_PROHIBITED = 0x0000001B CKR_DATA_INVALID = 0x00000020 CKR_DATA_LEN_RANGE = 0x00000021 CKR_DEVICE_ERROR = 0x00000030 CKR_DEVICE_MEMORY = 0x00000031 CKR_DEVICE_REMOVED = 0x00000032 CKR_ENCRYPTED_DATA_INVALID = 0x00000040 CKR_ENCRYPTED_DATA_LEN_RANGE = 0x00000041 CKR_AEAD_DECRYPT_FAILED = 0x00000042 CKR_FUNCTION_CANCELED = 0x00000050 CKR_FUNCTION_NOT_PARALLEL = 0x00000051 CKR_FUNCTION_NOT_SUPPORTED = 0x00000054 CKR_KEY_HANDLE_INVALID = 0x00000060 CKR_KEY_SIZE_RANGE = 0x00000062 CKR_KEY_TYPE_INCONSISTENT = 0x00000063 CKR_KEY_NOT_NEEDED = 0x00000064 CKR_KEY_CHANGED = 0x00000065 CKR_KEY_NEEDED = 0x00000066 CKR_KEY_INDIGESTIBLE = 0x00000067 CKR_KEY_FUNCTION_NOT_PERMITTED = 0x00000068 CKR_KEY_NOT_WRAPPABLE = 0x00000069 CKR_KEY_UNEXTRACTABLE = 0x0000006A CKR_MECHANISM_INVALID = 0x00000070 CKR_MECHANISM_PARAM_INVALID = 0x00000071 CKR_OBJECT_HANDLE_INVALID = 0x00000082 CKR_OPERATION_ACTIVE = 0x00000090 CKR_OPERATION_NOT_INITIALIZED = 0x00000091 CKR_PIN_INCORRECT = 0x000000A0 CKR_PIN_INVALID = 0x000000A1 CKR_PIN_LEN_RANGE = 0x000000A2 CKR_PIN_EXPIRED = 0x000000A3 CKR_PIN_LOCKED = 0x000000A4 CKR_SESSION_CLOSED = 0x000000B0 CKR_SESSION_COUNT = 0x000000B1 CKR_SESSION_HANDLE_INVALID = 0x000000B3 CKR_SESSION_PARALLEL_NOT_SUPPORTED = 0x000000B4 CKR_SESSION_READ_ONLY = 0x000000B5 CKR_SESSION_EXISTS = 0x000000B6 CKR_SESSION_READ_ONLY_EXISTS = 0x000000B7 CKR_SESSION_READ_WRITE_SO_EXISTS = 0x000000B8 CKR_SIGNATURE_INVALID = 0x000000C0 CKR_SIGNATURE_LEN_RANGE = 0x000000C1 CKR_TEMPLATE_INCOMPLETE = 0x000000D0 CKR_TEMPLATE_INCONSISTENT = 0x000000D1 CKR_TOKEN_NOT_PRESENT = 0x000000E0 CKR_TOKEN_NOT_RECOGNIZED = 0x000000E1 CKR_TOKEN_WRITE_PROTECTED = 0x000000E2 CKR_UNWRAPPING_KEY_HANDLE_INVALID = 0x000000F0 CKR_UNWRAPPING_KEY_SIZE_RANGE = 0x000000F1 CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT = 0x000000F2 CKR_USER_ALREADY_LOGGED_IN = 0x00000100 CKR_USER_NOT_LOGGED_IN = 0x00000101 CKR_USER_PIN_NOT_INITIALIZED = 0x00000102 CKR_USER_TYPE_INVALID = 0x00000103 CKR_USER_ANOTHER_ALREADY_LOGGED_IN = 0x00000104 CKR_USER_TOO_MANY_TYPES = 0x00000105 CKR_WRAPPED_KEY_INVALID = 0x00000110 CKR_WRAPPED_KEY_LEN_RANGE = 0x00000112 CKR_WRAPPING_KEY_HANDLE_INVALID = 0x00000113 CKR_WRAPPING_KEY_SIZE_RANGE = 0x00000114 CKR_WRAPPING_KEY_TYPE_INCONSISTENT = 0x00000115 CKR_RANDOM_SEED_NOT_SUPPORTED = 0x00000120 CKR_RANDOM_NO_RNG = 0x00000121 CKR_DOMAIN_PARAMS_INVALID = 0x00000130 CKR_CURVE_NOT_SUPPORTED = 0x00000140 CKR_BUFFER_TOO_SMALL = 0x00000150 CKR_SAVED_STATE_INVALID = 0x00000160 CKR_INFORMATION_SENSITIVE = 0x00000170 CKR_STATE_UNSAVEABLE = 0x00000180 CKR_CRYPTOKI_NOT_INITIALIZED = 0x00000190 CKR_CRYPTOKI_ALREADY_INITIALIZED = 0x00000191 CKR_MUTEX_BAD = 0x000001A0 CKR_MUTEX_NOT_LOCKED = 0x000001A1 CKR_NEW_PIN_MODE = 0x000001B0 CKR_NEXT_OTP = 0x000001B1 CKR_EXCEEDED_MAX_ITERATIONS = 0x000001B5 CKR_FIPS_SELF_TEST_FAILED = 0x000001B6 CKR_LIBRARY_LOAD_FAILED = 0x000001B7 CKR_PIN_TOO_WEAK = 0x000001B8 CKR_PUBLIC_KEY_INVALID = 0x000001B9 CKR_FUNCTION_REJECTED = 0x00000200 CKR_TOKEN_RESOURCE_EXCEEDED = 0x00000201 CKR_OPERATION_CANCEL_FAILED = 0x00000202 CKR_KEY_EXHAUSTED = 0x00000203 CKR_PENDING = 0x00000204 CKR_SESSION_ASYNC_NOT_SUPPORTED = 0x00000205 CKR_SEED_RANDOM_REQUIRED = 0x00000206 CKR_OPERATION_NOT_VALIDATED = 0x00000207 CKR_TOKEN_NOT_INITIALIZED = 0x00000208 CKR_PARAMETER_SET_NOT_SUPPORTED = 0x00000209 CKR_VENDOR_DEFINED = 0x80000000 CKF_END_OF_MESSAGE = 0x00000001 CKF_INTERFACE_FORK_SAFE = 0x00000001 CKF_LIBRARY_CANT_CREATE_OS_THREADS = 0x00000001 CKF_OS_LOCKING_OK = 0x00000002 CKF_DONT_BLOCK = 1 CKG_MGF1_SHA1 = 0x00000001 CKG_MGF1_SHA256 = 0x00000002 CKG_MGF1_SHA384 = 0x00000003 CKG_MGF1_SHA512 = 0x00000004 CKG_MGF1_SHA224 = 0x00000005 CKG_MGF1_SHA3_224 = 0x00000006 CKG_MGF1_SHA3_256 = 0x00000007 CKG_MGF1_SHA3_384 = 0x00000008 CKG_MGF1_SHA3_512 = 0x00000009 CKZ_DATA_SPECIFIED = 0x00000001 CKD_NULL = 0x00000001 CKD_SHA1_KDF = 0x00000002 CKD_SHA1_KDF_ASN1 = 0x00000003 CKD_SHA1_KDF_CONCATENATE = 0x00000004 CKD_SHA224_KDF = 0x00000005 CKD_SHA256_KDF = 0x00000006 CKD_SHA384_KDF = 0x00000007 CKD_SHA512_KDF = 0x00000008 CKD_CPDIVERSIFY_KDF = 0x00000009 CKD_SHA3_224_KDF = 0x0000000A CKD_SHA3_256_KDF = 0x0000000B CKD_SHA3_384_KDF = 0x0000000C CKD_SHA3_512_KDF = 0x0000000D CKD_SHA1_KDF_SP800 = 0x0000000E CKD_SHA224_KDF_SP800 = 0x0000000F CKD_SHA256_KDF_SP800 = 0x00000010 CKD_SHA384_KDF_SP800 = 0x00000011 CKD_SHA512_KDF_SP800 = 0x00000012 CKD_SHA3_224_KDF_SP800 = 0x00000013 CKD_SHA3_256_KDF_SP800 = 0x00000014 CKD_SHA3_384_KDF_SP800 = 0x00000015 CKD_SHA3_512_KDF_SP800 = 0x00000016 CKD_BLAKE2B_160_KDF = 0x00000017 CKD_BLAKE2B_256_KDF = 0x00000018 CKD_BLAKE2B_384_KDF = 0x00000019 CKD_BLAKE2B_512_KDF = 0x0000001a CKP_PKCS5_PBKD2_HMAC_SHA1 = 0x00000001 CKP_PKCS5_PBKD2_HMAC_GOSTR3411 = 0x00000002 CKP_PKCS5_PBKD2_HMAC_SHA224 = 0x00000003 CKP_PKCS5_PBKD2_HMAC_SHA256 = 0x00000004 CKP_PKCS5_PBKD2_HMAC_SHA384 = 0x00000005 CKP_PKCS5_PBKD2_HMAC_SHA512 = 0x00000006 CKP_PKCS5_PBKD2_HMAC_SHA512_224 = 0x00000007 CKP_PKCS5_PBKD2_HMAC_SHA512_256 = 0x00000008 CKZ_SALT_SPECIFIED = 0x00000001 CK_OTP_VALUE = 0 CK_OTP_PIN = 1 CK_OTP_CHALLENGE = 2 CK_OTP_TIME = 3 CK_OTP_COUNTER = 4 CK_OTP_FLAGS = 5 CK_OTP_OUTPUT_LENGTH = 6 CK_OTP_OUTPUT_FORMAT = 7 CKF_NEXT_OTP = 0x00000001 CKF_EXCLUDE_TIME = 0x00000002 CKF_EXCLUDE_COUNTER = 0x00000004 CKF_EXCLUDE_CHALLENGE = 0x00000008 CKF_EXCLUDE_PIN = 0x00000010 CKF_USER_FRIENDLY_OTP = 0x00000020 CKG_NO_GENERATE = 0x00000000 CKG_GENERATE = 0x00000001 CKG_GENERATE_COUNTER = 0x00000002 CKG_GENERATE_RANDOM = 0x00000003 CKG_GENERATE_COUNTER_XOR = 0x00000004 CK_SP800_108_ITERATION_VARIABLE = 0x00000001 CK_SP800_108_OPTIONAL_COUNTER = 0x00000002 CK_SP800_108_DKM_LENGTH = 0x00000003 CK_SP800_108_BYTE_ARRAY = 0x00000004 CK_SP800_108_COUNTER = CK_SP800_108_OPTIONAL_COUNTER CK_SP800_108_KEY_HANDLE = 0x00000005 CK_SP800_108_DKM_LENGTH_SUM_OF_KEYS = 0x00000001 CK_SP800_108_DKM_LENGTH_SUM_OF_SEGMENTS = 0x00000002 CKF_HKDF_SALT_NULL = 0x00000001 CKF_HKDF_SALT_DATA = 0x00000002 CKF_HKDF_SALT_KEY = 0x00000004 CKS_LAST_VALIDATION_OK = 0x00000001 CKV_AUTHORITY_TYPE_UNSPECIFIED = 0x00000000 CKV_AUTHORITY_TYPE_NIST_CMVP = 0x00000001 CKV_AUTHORITY_TYPE_COMMON_CRITERIA = 0x00000002 CKV_TYPE_UNSPECIFIED = 0x00000000 CKV_TYPE_SOFTWARE = 0x00000001 CKV_TYPE_HARDWARE = 0x00000002 CKV_TYPE_FIRMWARE = 0x00000003 CKV_TYPE_HYBRID = 0x00000004 CKH_HEDGE_PREFERRED = 0x00000000 CKH_HEDGE_REQUIRED = 0x00000001 CKH_DETERMINISTIC_REQUIRED = 0x00000002 CKP_ML_DSA_44 = 0x00000001 CKP_ML_DSA_65 = 0x00000002 CKP_ML_DSA_87 = 0x00000003 CKP_SLH_DSA_SHA2_128S = 0x00000001 CKP_SLH_DSA_SHAKE_128S = 0x00000002 CKP_SLH_DSA_SHA2_128F = 0x00000003 CKP_SLH_DSA_SHAKE_128F = 0x00000004 CKP_SLH_DSA_SHA2_192S = 0x00000005 CKP_SLH_DSA_SHAKE_192S = 0x00000006 CKP_SLH_DSA_SHA2_192F = 0x00000007 CKP_SLH_DSA_SHAKE_192F = 0x00000008 CKP_SLH_DSA_SHA2_256S = 0x00000009 CKP_SLH_DSA_SHAKE_256S = 0x0000000a CKP_SLH_DSA_SHA2_256F = 0x0000000b CKP_SLH_DSA_SHAKE_256F = 0x0000000c CKP_ML_KEM_512 = 0x00000001 CKP_ML_KEM_768 = 0x00000002 CKP_ML_KEM_1024 = 0x00000003 CKT_TRUST_UNKNOWN = 0x00000000 CKT_TRUSTED = 0x00000001 CKT_TRUST_ANCHOR = 0x00000002 CKT_NOT_TRUSTED = 0x00000003 CKT_TRUST_MUST_VERIFY_TRUST = 0x00000004 )
Variables ¶
This section is empty.
Functions ¶
func Wipe ¶
func Wipe(b []byte)
Wipe overwrites b with zeros. Call it on any Go-side buffer that held a PIN or key material once you are done with it. The runtime.KeepAlive keeps the compiler from eliding the writes if it can prove b is otherwise unused.
Wipe reduces, but cannot eliminate, secret exposure in a garbage-collected runtime: the Go GC may already have copied b while moving the stack or growing a slice. For maximum assurance keep secrets inside the HSM (generate non-extractable, sensitive keys) so they never reach process memory.
Types ¶
type Attribute ¶
Attribute is one object attribute (CK_ATTRIBUTE): a CKA_ type and its raw value bytes. A nil Value requests the attribute's length or marks it absent, matching Cryptoki's pValue == NULL convention.
func NewAttribute ¶
NewAttribute builds an Attribute for a CKA_ type, encoding value into the raw bytes Cryptoki expects:
nil → no value (length query / absent) bool → CK_BBOOL (1 byte) int, uint → CK_ULONG in the platform's native width string, []byte → the bytes as-is (copied, so later mutation/wipe is safe)
It panics on an unsupported value type, a negative int, or a value that does not fit the platform's CK_ULONG, mirroring how a misuse here is a programming error rather than a runtime condition.
type Ctx ¶
type Ctx struct {
// contains filtered or unexported fields
}
Ctx is a loaded PKCS #11 module. It wraps the module's CK_FUNCTION_LIST and dispatches Cryptoki calls to it. Obtain one with New and release it with Destroy. A Ctx is safe to share across goroutines only to the extent the underlying module is; initialise the module with OS locking (the default). Note that a single PKCS #11 session is a stateful state machine: concurrent operations on one SessionHandle must be serialised by the caller (the p11 layer does this for you).
func New ¶
New loads the PKCS #11 module shared object at path (e.g. a vendor driver or SoftHSM) and resolves its function list. It does not call C_Initialize; call Initialize next. The returned Ctx must be released with Destroy.
path must be absolute. Loading a module runs its initialisers immediately (it is arbitrary native code by design), and a relative path would let the dynamic linker resolve it against search directories such as LD_LIBRARY_PATH or the current directory — a library-injection risk. Resolve the path yourself (e.g. from a trusted config) before calling New.
func (*Ctx) CloseAllSessions ¶
CloseAllSessions closes every session a token in a slot has open (C_CloseAllSessions).
func (*Ctx) CloseSession ¶
func (c *Ctx) CloseSession(sh SessionHandle) error
CloseSession closes a session (C_CloseSession).
func (*Ctx) CopyObject ¶
func (c *Ctx) CopyObject(sh SessionHandle, obj ObjectHandle, tmpl []*Attribute) (ObjectHandle, error)
CopyObject creates a copy of an object on the same session, applying an optional template to override or add attributes in the copy (C_CopyObject).
func (*Ctx) CreateObject ¶
func (c *Ctx) CreateObject(sh SessionHandle, tmpl []*Attribute) (ObjectHandle, error)
CreateObject creates a new object from a template (C_CreateObject).
func (*Ctx) DecapsulateKey ¶
func (c *Ctx) DecapsulateKey(sh SessionHandle, m *Mechanism, privKey ObjectHandle, tmpl []*Attribute, ciphertext []byte) (ObjectHandle, error)
DecapsulateKey runs a KEM decapsulation (C_DecapsulateKey): it recovers the shared secret from ciphertext using the private key, materialising it as a new key object (described by tmpl) and returning its handle. Used with ML-KEM (CKM_ML_KEM).
func (*Ctx) Decrypt ¶
func (c *Ctx) Decrypt(sh SessionHandle, cipher []byte) ([]byte, error)
Decrypt decrypts ciphertext in a single part and returns the plaintext (C_Decrypt).
func (*Ctx) DecryptDigestUpdate ¶
func (c *Ctx) DecryptDigestUpdate(sh SessionHandle, cipher []byte) ([]byte, error)
DecryptDigestUpdate simultaneously decrypts and digests one part of a multi-part operation (C_DecryptDigestUpdate). The session must have been prepared with both DecryptInit and DigestInit beforehand.
func (*Ctx) DecryptFinal ¶
func (c *Ctx) DecryptFinal(sh SessionHandle) ([]byte, error)
DecryptFinal finishes a multi-part decryption and returns any remaining plaintext (C_DecryptFinal).
func (*Ctx) DecryptInit ¶
func (c *Ctx) DecryptInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
DecryptInit initialises a decryption operation with a key (C_DecryptInit).
func (*Ctx) DecryptUpdate ¶
func (c *Ctx) DecryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
DecryptUpdate decrypts another part of a multi-part operation and returns the plaintext produced so far (C_DecryptUpdate).
func (*Ctx) DecryptVerifyUpdate ¶
func (c *Ctx) DecryptVerifyUpdate(sh SessionHandle, cipher []byte) ([]byte, error)
DecryptVerifyUpdate simultaneously decrypts and feeds plaintext into a running verify operation (C_DecryptVerifyUpdate). The session must have been prepared with both DecryptInit and VerifyInit beforehand. Call DecryptFinal and VerifyFinal when all parts have been processed.
func (*Ctx) DeriveKey ¶
func (c *Ctx) DeriveKey(sh SessionHandle, m *Mechanism, baseKey ObjectHandle, tmpl []*Attribute) (ObjectHandle, error)
DeriveKey derives a new key from a base key per the mechanism and template, returning its handle (C_DeriveKey), e.g. an HKDF or ECDH derivation.
func (*Ctx) Destroy ¶
func (c *Ctx) Destroy()
Destroy unloads the module and closes the shared library. It does not call Finalize; call Finalize before Destroy. Destroy is idempotent.
func (*Ctx) DestroyObject ¶
func (c *Ctx) DestroyObject(sh SessionHandle, obj ObjectHandle) error
DestroyObject destroys an object (C_DestroyObject).
func (*Ctx) Digest ¶
func (c *Ctx) Digest(sh SessionHandle, data []byte) ([]byte, error)
Digest digests data in a single part and returns the message digest (C_Digest).
func (*Ctx) DigestEncryptUpdate ¶
func (c *Ctx) DigestEncryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
DigestEncryptUpdate simultaneously digests and encrypts one part of a multi-part operation (C_DigestEncryptUpdate). The session must have been prepared with both DigestInit and EncryptInit beforehand.
func (*Ctx) DigestFinal ¶
func (c *Ctx) DigestFinal(sh SessionHandle) ([]byte, error)
DigestFinal finishes a multi-part digest and returns the message digest (C_DigestFinal).
func (*Ctx) DigestInit ¶
func (c *Ctx) DigestInit(sh SessionHandle, m *Mechanism) error
DigestInit initialises a digest operation (C_DigestInit).
func (*Ctx) DigestKey ¶
func (c *Ctx) DigestKey(sh SessionHandle, key ObjectHandle) error
DigestKey continues a multi-part digest with the value of a secret key (C_DigestKey).
func (*Ctx) DigestUpdate ¶
func (c *Ctx) DigestUpdate(sh SessionHandle, data []byte) error
DigestUpdate feeds another part of the message into a multi-part digest (C_DigestUpdate).
func (*Ctx) EncapsulateKey ¶
func (c *Ctx) EncapsulateKey(sh SessionHandle, m *Mechanism, pubKey ObjectHandle, tmpl []*Attribute) ([]byte, ObjectHandle, error)
EncapsulateKey runs a KEM encapsulation (C_EncapsulateKey): it generates a fresh shared secret as a key object (described by tmpl) under the public key and returns the ciphertext to transmit alongside the new key's handle. Used with ML-KEM (CKM_ML_KEM).
func (*Ctx) Encrypt ¶
func (c *Ctx) Encrypt(sh SessionHandle, data []byte) ([]byte, error)
Encrypt encrypts data in a single part and returns the ciphertext (C_Encrypt).
func (*Ctx) EncryptFinal ¶
func (c *Ctx) EncryptFinal(sh SessionHandle) ([]byte, error)
EncryptFinal finishes a multi-part encryption and returns any remaining ciphertext (C_EncryptFinal).
func (*Ctx) EncryptInit ¶
func (c *Ctx) EncryptInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
EncryptInit initialises an encryption operation with a key (C_EncryptInit).
func (*Ctx) EncryptUpdate ¶
func (c *Ctx) EncryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
EncryptUpdate encrypts another part of a multi-part operation and returns the ciphertext produced so far (C_EncryptUpdate).
func (*Ctx) Finalize ¶
Finalize releases the module's resources (C_Finalize). Call it once when finished, before Destroy. It is safe to call after Destroy (returns errClosed rather than crashing). A write-lock is held so that Finalize cannot race a concurrent operation or Initialize on the same Ctx.
func (*Ctx) FindObjects ¶
func (c *Ctx) FindObjects(sh SessionHandle, maxObjects int) ([]ObjectHandle, error)
FindObjects returns up to maxObjects object handles from the active search (C_FindObjects). A returned slice shorter than maxObjects means the search is exhausted. Call FindObjectsFinal when done.
func (*Ctx) FindObjectsFinal ¶
func (c *Ctx) FindObjectsFinal(sh SessionHandle) error
FindObjectsFinal ends an object search (C_FindObjectsFinal).
func (*Ctx) FindObjectsInit ¶
func (c *Ctx) FindObjectsInit(sh SessionHandle, tmpl []*Attribute) error
FindObjectsInit begins a search for objects matching a template (C_FindObjectsInit). An empty template matches all objects.
func (*Ctx) GenerateKey ¶
func (c *Ctx) GenerateKey(sh SessionHandle, m *Mechanism, tmpl []*Attribute) (ObjectHandle, error)
GenerateKey generates a secret key from a mechanism and template (C_GenerateKey), e.g. an AES key with CKM_AES_KEY_GEN.
func (*Ctx) GenerateKeyPair ¶
func (c *Ctx) GenerateKeyPair(sh SessionHandle, m *Mechanism, public, private []*Attribute) (ObjectHandle, ObjectHandle, error)
GenerateKeyPair generates a public/private key pair (C_GenerateKeyPair), e.g. an RSA pair with CKM_RSA_PKCS_KEY_PAIR_GEN. It returns the public then the private object handle.
func (*Ctx) GenerateRandom ¶
func (c *Ctx) GenerateRandom(sh SessionHandle, length int) ([]byte, error)
GenerateRandom returns length cryptographically random bytes from the token (C_GenerateRandom). length must be positive and no greater than maxOutBuf.
func (*Ctx) GetAttributeValue ¶
func (c *Ctx) GetAttributeValue(sh SessionHandle, obj ObjectHandle, tmpl []*Attribute) ([]*Attribute, error)
GetAttributeValue reads attribute values for an object (C_GetAttributeValue). Pass a template of Attributes with nil Value naming the types to read; the returned slice has the same length and order, with values filled in. Attributes the token reports as unavailable — including ones it refuses because they are sensitive — come back with a nil Value.
When some requested attributes are sensitive or type-invalid, Cryptoki still fills in the readable ones and returns CKR_ATTRIBUTE_SENSITIVE or CKR_ATTRIBUTE_TYPE_INVALID. In that case GetAttributeValue returns the (partially populated) slice together with that error, so a caller can tell "sensitive/absent" apart from a hard failure. Value buffers are scrubbed before being freed, since they may hold key material.
func (*Ctx) GetMechanismInfo ¶
func (c *Ctx) GetMechanismInfo(slot SlotID, mechanism uint) (MechanismInfo, error)
GetMechanismInfo returns the capabilities of one mechanism on a slot (C_GetMechanismInfo).
func (*Ctx) GetMechanismList ¶
GetMechanismList returns the mechanism types a slot supports (C_GetMechanismList).
func (*Ctx) GetObjectSize ¶
func (c *Ctx) GetObjectSize(sh SessionHandle, obj ObjectHandle) (uint, error)
GetObjectSize returns the size of an object in bytes (C_GetObjectSize).
func (*Ctx) GetOperationState ¶
func (c *Ctx) GetOperationState(sh SessionHandle) ([]byte, error)
GetOperationState saves the cryptographic-operation state of a session into an opaque byte blob (C_GetOperationState). The blob can later be passed to SetOperationState to restore the operation — useful for cloning an in-progress digest or encrypt across sessions.
func (*Ctx) GetSessionInfo ¶
func (c *Ctx) GetSessionInfo(sh SessionHandle) (SessionInfo, error)
GetSessionInfo returns information about a session (C_GetSessionInfo).
func (*Ctx) GetSessionValidationFlags ¶
func (c *Ctx) GetSessionValidationFlags(sh SessionHandle, flagType uint) (uint, error)
GetSessionValidationFlags returns the FIPS-style validation flags for a session (C_GetSessionValidationFlags). flagType selects which set of flags.
func (*Ctx) GetSlotInfo ¶
GetSlotInfo returns information about a slot (C_GetSlotInfo).
func (*Ctx) GetSlotList ¶
GetSlotList returns the slot IDs in the system (C_GetSlotList). When tokenPresent is true, only slots with a token present are returned.
func (*Ctx) GetTokenInfo ¶
GetTokenInfo returns information about the token in a slot (C_GetTokenInfo).
func (*Ctx) InitPIN ¶
func (c *Ctx) InitPIN(sh SessionHandle, pin []byte) error
InitPIN sets the normal user's PIN from a security-officer session (C_InitPIN). The C copy of the PIN is scrubbed before being freed.
func (*Ctx) InitToken ¶
InitToken initialises the token in a slot with the given security-officer PIN and label (C_InitToken). The label is space-padded to 32 bytes per the spec; a label longer than 32 bytes is rejected rather than truncated (truncation could split a multi-byte UTF-8 rune and yield an invalid CK_UTF8CHAR field). The PIN is taken as []byte and the C copy is scrubbed before being freed.
func (*Ctx) Initialize ¶
Initialize prepares the loaded module for use (C_Initialize) with OS thread locking (CKF_OS_LOCKING_OK), so the module is safe to call from multiple goroutines. Call it once after New and before any other operation. For finer control (or to share a module already initialised by another library in the process) use InitializeWithFlags.
func (*Ctx) InitializeWithFlags ¶
InitializeWithFlags calls C_Initialize with the given CK_C_INITIALIZE_ARGS flags. CKR_CRYPTOKI_ALREADY_INITIALIZED is reported as a typed error rather than swallowed, so a caller sharing the module can decide whether to treat it as success. A write-lock is held so that Initialize cannot race a concurrent operation or Finalize on the same Ctx.
func (*Ctx) Login ¶
func (c *Ctx) Login(sh SessionHandle, userType uint, pin []byte) error
Login logs a user into a token on a session (C_Login). userType is typically CKU_USER or CKU_SO. The PIN is taken as a []byte so the caller can wipe it after use (see Wipe); the C-side copy is scrubbed before being freed.
func (*Ctx) Logout ¶
func (c *Ctx) Logout(sh SessionHandle) error
Logout logs the current user out of a session's token (C_Logout).
func (*Ctx) OpenSession ¶
func (c *Ctx) OpenSession(slot SlotID, flags uint) (SessionHandle, error)
OpenSession opens a session with a token in a slot (C_OpenSession). flags must include CKF_SERIAL_SESSION; add CKF_RW_SESSION for a read/write session.
func (*Ctx) SeedRandom ¶
func (c *Ctx) SeedRandom(sh SessionHandle, seed []byte) error
SeedRandom mixes additional seed material into the token's RNG (C_SeedRandom). Not all tokens support it.
func (*Ctx) SetAttributeValue ¶
func (c *Ctx) SetAttributeValue(sh SessionHandle, obj ObjectHandle, tmpl []*Attribute) error
SetAttributeValue modifies attribute values on an object (C_SetAttributeValue).
func (*Ctx) SetOperationState ¶
func (c *Ctx) SetOperationState(sh SessionHandle, state []byte, encKey, authKey ObjectHandle) error
SetOperationState restores a previously saved operation state (C_SetOperationState). Pass CK_INVALID_HANDLE (0) for either key handle when the corresponding key is embedded in the state blob or no such operation is being restored.
func (*Ctx) SetPIN ¶
func (c *Ctx) SetPIN(sh SessionHandle, oldPin, newPin []byte) error
SetPIN changes the PIN of the logged-in user (C_SetPIN). Both C copies are scrubbed before being freed.
func (*Ctx) Sign ¶
func (c *Ctx) Sign(sh SessionHandle, data []byte) ([]byte, error)
Sign signs data in a single part and returns the signature (C_Sign).
func (*Ctx) SignEncryptUpdate ¶
func (c *Ctx) SignEncryptUpdate(sh SessionHandle, part []byte) ([]byte, error)
SignEncryptUpdate simultaneously signs and encrypts one part of a multi-part operation (C_SignEncryptUpdate). The session must have been prepared with both SignInit and EncryptInit beforehand.
func (*Ctx) SignFinal ¶
func (c *Ctx) SignFinal(sh SessionHandle) ([]byte, error)
SignFinal finishes a multi-part signature and returns the signature (C_SignFinal).
func (*Ctx) SignInit ¶
func (c *Ctx) SignInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
SignInit initialises a signature operation with a private key (C_SignInit).
func (*Ctx) SignUpdate ¶
func (c *Ctx) SignUpdate(sh SessionHandle, part []byte) error
SignUpdate feeds another part of the message into a multi-part signature (C_SignUpdate).
func (*Ctx) SupportsV32 ¶
SupportsV32 reports whether the loaded module advertises the PKCS #11 v3.2 interface (via C_GetInterface). The v3.2-only methods require this.
func (*Ctx) UnwrapKey ¶
func (c *Ctx) UnwrapKey(sh SessionHandle, m *Mechanism, unwrappingKey ObjectHandle, wrapped []byte, tmpl []*Attribute) (ObjectHandle, error)
UnwrapKey unwraps (decrypts) a previously wrapped key into a new object described by the template, returning its handle (C_UnwrapKey).
func (*Ctx) UnwrapKeyAuthenticated ¶
func (c *Ctx) UnwrapKeyAuthenticated(sh SessionHandle, m *Mechanism, unwrappingKey ObjectHandle, wrapped, aad []byte, tmpl []*Attribute) (ObjectHandle, error)
UnwrapKeyAuthenticated unwraps a key produced by WrapKeyAuthenticated, verifying the associated data, into a new object described by the template (C_UnwrapKeyAuthenticated).
func (*Ctx) Verify ¶
func (c *Ctx) Verify(sh SessionHandle, data, signature []byte) error
Verify checks a signature over data in a single part (C_Verify). A nil error means the signature is valid; an invalid signature reports CKR_SIGNATURE_*.
func (*Ctx) VerifyFinal ¶
func (c *Ctx) VerifyFinal(sh SessionHandle, signature []byte) error
VerifyFinal finishes a multi-part verification against the given signature (C_VerifyFinal).
func (*Ctx) VerifyInit ¶
func (c *Ctx) VerifyInit(sh SessionHandle, m *Mechanism, key ObjectHandle) error
VerifyInit initialises a verification operation with a public key (C_VerifyInit).
func (*Ctx) VerifySignature ¶
func (c *Ctx) VerifySignature(sh SessionHandle, data []byte) error
VerifySignature checks the data against the signature given to VerifySignatureInit, in a single part (C_VerifySignature). A nil error means valid.
func (*Ctx) VerifySignatureFinal ¶
func (c *Ctx) VerifySignatureFinal(sh SessionHandle) error
VerifySignatureFinal finishes a multi-part stateless verification (C_VerifySignatureFinal). A nil error means valid.
func (*Ctx) VerifySignatureInit ¶
func (c *Ctx) VerifySignatureInit(sh SessionHandle, m *Mechanism, key ObjectHandle, signature []byte) error
VerifySignatureInit begins a stateless signature verification against a known signature value (C_VerifySignatureInit). Unlike VerifyInit, the signature is supplied up front; VerifySignature then only takes the data.
func (*Ctx) VerifySignatureUpdate ¶
func (c *Ctx) VerifySignatureUpdate(sh SessionHandle, part []byte) error
VerifySignatureUpdate feeds another part of the data into a multi-part stateless verification (C_VerifySignatureUpdate).
func (*Ctx) VerifyUpdate ¶
func (c *Ctx) VerifyUpdate(sh SessionHandle, part []byte) error
VerifyUpdate feeds another part of the message into a multi-part verification (C_VerifyUpdate).
func (*Ctx) WaitForSlotEvent ¶
WaitForSlotEvent blocks until a slot event (token insertion or removal) occurs, then returns the affected slot ID (C_WaitForSlotEvent). Pass CKF_DONT_BLOCK (= 1) to return immediately: when no event is pending the error will be CKR_NO_EVENT (= 0x00000008).
func (*Ctx) WrapKey ¶
func (c *Ctx) WrapKey(sh SessionHandle, m *Mechanism, wrappingKey, key ObjectHandle) ([]byte, error)
WrapKey wraps (encrypts) a key with a wrapping key and returns the wrapped bytes (C_WrapKey).
func (*Ctx) WrapKeyAuthenticated ¶
func (c *Ctx) WrapKeyAuthenticated(sh SessionHandle, m *Mechanism, wrappingKey, key ObjectHandle, aad []byte) ([]byte, error)
WrapKeyAuthenticated wraps a key with an AEAD wrapping mechanism, binding the given associated data, and returns the wrapped bytes (C_WrapKeyAuthenticated).
type Error ¶
type Error uint
Error is a PKCS #11 return value (CK_RV) other than CKR_OK. Every Cryptoki call that fails reports its CK_RV as one of these. The symbolic CKR_ names are in the generated table ckrNames (see zerror.go).
type GCMParams ¶
type GCMParams struct {
// contains filtered or unexported fields
}
GCMParams holds the CK_GCM_PARAMS block for an AES-GCM operation. Unlike the other MechanismParams implementations whose C memory is freed after the Init call, GCMParams keeps the C struct alive until Free is called explicitly. This is required for HSMs that write a token-generated IV back into pIv during C_Encrypt (UseGCMIVFromHSM / CloudHSM behaviour). Call IV after Encrypt to retrieve the written-back value; call Free once the operation is complete.
func NewGCMParams ¶
NewGCMParams returns the parameters for AES-GCM (CKM_AES_GCM): the IV/nonce, optional additional authenticated data, and the authentication tag length in bits (commonly 128). Pass a nil iv when the HSM generates the nonce itself (UseGCMIVFromHSM); the allocated pIv buffer will receive the token-written value and can be read back via IV after C_Encrypt returns.
tagBits must be a byte-aligned length in (0, 128]. A zero or out-of-range tag length is rejected with a panic: some modules would otherwise accept it and produce effectively unauthenticated ciphertext, which is a silent security failure rather than a recoverable runtime error.
func NewGCMParamsHSMIV ¶
NewGCMParamsHSMIV returns GCM parameters for operations where the HSM generates the IV itself (UseGCMIVFromHSM / CloudHSM behaviour). A zeroed pIv buffer of ivLen bytes is pre-allocated so the token has somewhere to write the nonce back. ivLen must be positive (AES-GCM typically uses 12). Call IV after C_Encrypt to retrieve the written-back value; call Free once the operation is complete.
type Info ¶
type Info struct {
CryptokiVersion Version // Cryptoki interface version
ManufacturerID string // library manufacturer
Flags uint // bit flags, reserved by the spec (currently none)
LibraryDescription string // human-readable library description
LibraryVersion Version // library implementation version
}
Info describes a Cryptoki library (CK_INFO), as returned by Ctx.GetInfo. The fixed-width character fields of the C struct are exposed here as Go strings with their trailing space padding removed.
type Mechanism ¶
Mechanism names a cryptographic mechanism (CK_MECHANISM) together with its optional parameter block.
For mechanisms whose parameter is plain bytes (an IV, or an all-CK_ULONG struct), set Parameter via NewMechanism. For mechanisms whose CK_*_PARAMS struct contains pointers (GCM, OAEP, ECDH1, …), use NewMechanismWithParams with one of the MechanismParams constructors, which marshal the nested C memory correctly.
func NewMechanism ¶
NewMechanism returns a Mechanism for the given CKM_ identifier. Pass a nil parameter for mechanisms that take none; otherwise pass the raw parameter bytes (e.g. a CBC IV).
func NewMechanismWithParams ¶
func NewMechanismWithParams(mechanism uint, params MechanismParams) *Mechanism
NewMechanismWithParams returns a Mechanism whose parameter is a structured CK_*_PARAMS value built by one of the NewGCMParams / NewOAEPParams / NewECDH1DeriveParams / NewPSSParams constructors.
type MechanismInfo ¶
MechanismInfo describes a mechanism's capabilities (CK_MECHANISM_INFO).
type MechanismParams ¶
type MechanismParams interface {
// contains filtered or unexported methods
}
MechanismParams is a structured mechanism parameter whose CK_*_PARAMS C struct contains pointers and therefore cannot be expressed as a flat byte slice. Build one with the New*Params constructors and pass it to NewMechanismWithParams.
The interface is sealed (build is unexported): only this package provides implementations. build allocates the parameter, and any buffers it points at, in C memory and returns a free that releases all of them. It is called once per operation by cMechanism, so callers never manage the C memory.
func NewECDH1DeriveParams ¶
func NewECDH1DeriveParams(kdf uint, sharedData, publicData []byte) MechanismParams
NewECDH1DeriveParams returns the parameters for ECDH1 key derivation (CKM_ECDH1_DERIVE): the key-derivation function (e.g. CKD_NULL), optional shared data, and the other party's public EC point (publicData).
func NewOAEPParams ¶
func NewOAEPParams(hashAlg, mgf, source uint, sourceData []byte) MechanismParams
NewOAEPParams returns the parameters for RSA-OAEP (CKM_RSA_PKCS_OAEP): the hash mechanism (e.g. CKM_SHA256), the MGF (e.g. CKG_MGF1_SHA256), the source type (CKZ_DATA_SPECIFIED, or 0 with nil sourceData for none) and any label/source bytes.
func NewPSSParams ¶
func NewPSSParams(hashAlg, mgf uint, saltLen int) MechanismParams
NewPSSParams returns the parameters for RSA-PSS signatures (e.g. CKM_SHA256_RSA_PKCS_PSS): the hash mechanism, the MGF, and the salt length in bytes. The underlying C struct has no pointers, but a typed constructor keeps usage consistent with the other parameter kinds.
type ObjectHandle ¶
type ObjectHandle uint
ObjectHandle identifies an object within a session (CK_OBJECT_HANDLE).
type SessionHandle ¶
type SessionHandle uint
SessionHandle identifies an open session on a token (CK_SESSION_HANDLE).
type SessionInfo ¶
type SessionInfo struct {
SlotID SlotID
State uint // one of the CKS_ session states
Flags uint // CKF_SERIAL_SESSION, CKF_RW_SESSION, …
DeviceError uint // device-dependent error code
}
SessionInfo describes an open session (CK_SESSION_INFO), from GetSessionInfo.
type SlotInfo ¶
type SlotInfo struct {
SlotDescription string
ManufacturerID string
Flags uint
HardwareVersion Version
FirmwareVersion Version
}
SlotInfo describes a slot (CK_SLOT_INFO), as returned by GetSlotInfo.
type TokenInfo ¶
type TokenInfo struct {
Label string
ManufacturerID string
Model string
SerialNumber string
Flags uint
MaxSessionCount uint
SessionCount uint
MaxRwSessionCount uint
RwSessionCount uint
MaxPinLen uint
MinPinLen uint
TotalPublicMemory uint
FreePublicMemory uint
TotalPrivateMemory uint
FreePrivateMemory uint
HardwareVersion Version
FirmwareVersion Version
UTCTime string
}
TokenInfo describes the token in a slot (CK_TOKEN_INFO), from GetTokenInfo.
Source Files