Cryptographic Token Interface Standard


DES2 secret key objects

DES2 secret key objects (object class CKO_SECRET_KEY, key type CKK_DES2) hold double-length DES keys. The following table defines the DES2 secret key object attributes, in addition to the common attributes defined for this object class:

Table 103, DES2 Secret Key Object Attributes
Attribute Data type Meaning
CKA_VALUE1,4,6,7 Byte array Key value (always 16 bytes long)

- Refer to Table 15 for footnotes

DES2 keys must always have their parity bits properly set as described in FIPS PUB 46-3 (i.e., each of the DES keys comprising a DES2 key must have its parity bits properly set). Attempting to create or unwrap a DES2 key with incorrect parity will return an error.

The following is a sample template for creating a double-length DES secret key object:

CK_UTF8CHAR label[] = "A DES2 secret key object";
CK_BYTE value[16] = {... };

CK_ATTRIBUTE template[] = {
    {CKA_CLASS, &class, sizeof(class)}
    {CKA_KEY_TYPE, &keyType, sizeof(keyType)}
    {CKA_TOKEN, &true, sizeof(true)}
    {CKA_LABEL, label, sizeof(label) - 1}
    {CKA_ENCRYPT, &true, sizeof(true)}
    {CKA_VALUE, value, sizeof(value)}

CKA_CHECK_VALUE: The value of this attribute is derived from the key object by taking the first three bytes of the ECB encryption of a single block of null (0x00) bytes, using the default cipher associated with the key type of the secret key object.

RSA Security Inc. Public-Key Cryptography Standards - PKCS#11 - v220