Cryptographic Token Interface Standard

PKCS#11


Data types for mechanisms

Cryptoki supports the following types for describing mechanisms and parameters to them:

CK_MECHANISM_TYPE; CK_MECHANISM_TYPE_PTR

CK_MECHANISM_TYPE is a value that identifies a mechanism type. It is defined as follows:

typedef CK_ULONG CK_MECHANISM_TYPE;

Mechanism types are defined with the objects and mechanism descriptions that use them.

Vendor defined values for this type may also be specified.

CKM_VENDOR_DEFINED

Mechanism types CKM_VENDOR_DEFINED and above are permanently reserved for token vendors. For interoperability, vendors should register their mechanism types through the PKCS process.

CK_MECHANISM_TYPE_PTR is a pointer to a CK_MECHANISM_TYPE.

CK_MECHANISM; CK_MECHANISM_PTR

CK_MECHANISM is a structure that specifies a particular mechanism and any parameters it requires. It is defined as follows:

typedef struct CK_MECHANISM {
CK_MECHANISM_TYPE mechanism;
CK_VOID_PTR pParameter;
CK_ULONG ulParameterLen;
} CK_MECHANISM;

mechanism the type of mechanism
pParameter pointer to the parameter if required by the mechanism
ulParameterLen length in bytes of the parameter

Note that pParameter is a "void" pointer, facilitating the passing of arbitrary values. Both the application and the Cryptoki library must ensure that the pointer can be safely cast to the expected type (i.e., without word-alignment errors).

CK_MECHANISM_PTR is a pointer to a CK_MECHANISM.

CK_MECHANISM_INFO; CK_MECHANISM_INFO_PTR

CK_MECHANISM_INFO is a structure that provides information about a particular mechanism. It is defined as follows:

typedef struct CK_MECHANISM_INFO {
CK_ULONG ulMinKeySize;
CK_ULONG ulMaxKeySize;
CK_FLAGS flags;
} CK_MECHANISM_INFO;

ulMinKeySize the minimum size of the key for the mechanism (whether this is measured in bits or in bytes is mechanism-dependent)
ulMaxKeySize the maximum size of the key for the mechanism (whether this is measured in bits or in bytes is mechanism-dependent)
flags bit flags specifying mechanism capabilities

For some mechanisms, the ulMinKeySize and ulMaxKeySize fields have meaningless values.

The following table defines the flags field:

Table 13, Mechanism Information Flags
Bit Flag Mask Meaning
CKF_HW 0x00000001 True if the mechanism is performed by the device; false if the mechanism is performed in software
CKF_ENCRYPT 0x00000100 True if the mechanism can be used with C_EncryptInit
CKF_DECRYPT 0x00000200 True if the mechanism can be used with C_DecryptInit
CKF_DIGEST 0x00000400 True if the mechanism can be used with C_DigestInit
CKF_SIGN 0x00000800 True if the mechanism can be used with C_SignInit
CKF_SIGN_RECOVER 0x00001000 True if the mechanism can be used with C_SignRecoverInit
CKF_VERIFY 0x00002000 True if the mechanism can be used with C_VerifyInit
CKF_VERIFY_RECOVER 0x00004000 True if the mechanism can be used with C_VerifyRecoverInit
CKF_GENERATE 0x00008000 True if the mechanism can be used with C_GenerateKey
CKF_GENERATE_KEY_PAIR 0x00010000 True if the mechanism can be used with C_GenerateKeyPair
CKF_WRAP 0x00020000 True if the mechanism can be used with C_WrapKey
CKF_UNWRAP 0x00040000 True if the mechanism can be used with C_UnwrapKey
CKF_DERIVE 0x00080000 True if the mechanism can be used with C_DeriveKey
CKF_EXTENSION 0x80000000 True if there is an extension to the flags; false if no extensions. Must be false for this version.

CK_MECHANISM_INFO_PTR is a pointer to a CK_MECHANISM_INFO.


RSA Security Inc. Public-Key Cryptography Standards - PKCS#11 - v220