PKCS#11
|
| Cryptographic Token Interface Standard |
PKCS#11 |
Data Fields | |
| CK_BBOOL | isSender |
| Option for generating the key (called a TEK). More... | |
| CK_ULONG | ulRandomLen |
| size of random Ra and Rb, in bytes. More... | |
| CK_BYTE_PTR | pRandomA |
| pointer to Ra data. More... | |
| CK_BYTE_PTR | pRandomB |
| pointer to Rb data. More... | |
| CK_ULONG | ulPublicDataLen |
| other party's KEA public key size. More... | |
| CK_BYTE_PTR | pPublicData |
| pointer to other party's KEA public key value. More... | |
| isSender | Option for generating the key (called a TEK). The value is TRUE if the sender (originator) generates the TEK, FALSE if the recipient is regenerating the TEK. |
| ulRandomLen | size of random Ra and Rb, in bytes |
| pRandomA | pointer to Ra data |
| pRandomB | pointer to Rb data |
| ulPublicDataLen | other party's KEA public key size |
| pPublicData | pointer to other party's KEA public key value CK_KEA_DERIVE_PARAMS_PTR |
CK_KEA_DERIVE_PARAMS_PTR points to a CK_KEA_DERIVE_PARAMS structure. It is implementation-dependent.
KEA mechanisms
KEA key pair generation
The KEA key pair generation mechanism, denoted CKM_KEA_KEY_PAIR_GEN, is a key pair generation mechanism
It does not have a parameter.
The mechanism generates KEA public/private key pairs with a particular prime, subprime and base, as specified in the CKA_PRIME, CKA_SUBPRIME, and CKA_BASE attributes of the template for the public key. Note that this version of Cryptoki does not include a mechanism for generating these KEA parameters.
The mechanism contributes the CKA_CLASS, CKA_KEY_TYPE and CKA_VALUE attributes to the new public key and the CKA_CLASS, CKA_KEY_TYPE, CKA_PRIME, CKA_SUBPRIME, CKA_BASE, and CKA_VALUE attributes to the new private key. Other attributes supported by the KEA public and private key types (specifically, the flags indicating which functions the keys support) may also be specified in the templates for the keys, or else are assigned default initial values.
For this mechanism, the ulMinKeySize and ulMaxKeySize fields of the CK_MECHANISM_INFO structure specify the supported range of KEA prime sizes, in bits.
KEA key derivation
The KEA key derivation mechanism, denoted CKM_KEA_DERIVE, is a mechanism for key derivation based on KEA, the Key Exchange Algorithm.
It has a parameter, a CK_KEA_DERIVE_PARAMS structure.
This mechanism derives a secret value, and truncates the result according to the CKA_KEY_TYPE attribute of the template and, if it has one and the key type supports it, the CKA_VALUE_LEN attribute of the template. (The truncation removes bytes from the leading end of the secret value.) The mechanism contributes the result as the CKA_VALUE attribute of the new key; other attributes required by the key type must be specified in the template.
The derived key inherits the values of the CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE, CKA_EXTRACTABLE, and CKA_NEVER_EXTRACTABLE attributes from the base key. The values of the CKA_SENSITIVE and CKA_EXTRACTABLE attributes may be overridden in the template for the derived key, however. Of course, if the base key has the CKA_ALWAYS_SENSITIVE attribute set to TRUE, then the template may not specify that the derived key should have the CKA_SENSITIVE attribute set to FALSE; similarly, if the base key has the CKA_NEVER_EXTRACTABLE attribute set to TRUE, then the template may not specify that the derived key should have the CKA_EXTRACTABLE attribute set to TRUE.
For this mechanism, the ulMinKeySize and ulMaxKeySize fields of the CK_MECHANISM_INFO structure specify the supported range of KEA prime sizes, in bits.
MAYFLY mechanism parameters
|
|
Option for generating the key (called a TEK). The value is TRUE if the sender (originator) generates the TEK, FALSE if the recipient is regenerating the TEK. |
|
|
size of random Ra and Rb, in bytes. |
|
|
pointer to Ra data. |
|
|
pointer to Rb data. |
|
|
other party's KEA public key size. |
|
|
pointer to other party's KEA public key value. |