nss tech note5
ck_mechanism_type ciphermech = ckm_des_cbc_pad <big>(for example)</big> choose a slot on which to to do the operation pk11slotinfo* slot = pk11_getbestslot(ciphermech, null); or pk11slotinfo* slot = pk11_getinternalkeyslot(); /* alwys returns internal slot, may not be optimal */ prepare the key if using a raw key /* turn the raw key into a secitem */ secitem keyitem; ...
... ck_mechanism_type digestmech = ckm_md5 <big>(for example)</big> choose a slot on which to to do the operation pk11slotinfo* slot = pk11_getbestslot(digestmech, null); or pk11slotinfo* slot = pk11_getinternalkeyslot(); /* always returns int slot, may not be optimal */ prepare the key if using a raw key /* turn the raw key into a secitem */ secitem keyitem; keyitem.da...
...you can find a list of hmac mechanisms in security/nss/lib/softoken/pkcs11.c - grep for ckf_sn_vr, and choose the mechanisms that contain hmac in the name ck_mechanism_type hmacmech = ckm_md5_hmac; <big>(for example)</big> choose a slot on which to to do the operation pk11slotinfo* slot = pk11_getbestslot(hmacmech, null); or pk11slotinfo* slot = pk11_getinternalkeyslot(); /* always returns int slot, may not be optimal */ prepare the key if using a raw key /* turn the raw key into a secitem */ secitem keyitem; keyitem.
...And 13 more matches

Encrypt Decrypt MAC Keys As Session Objects
secitem* buf) { secstatus rv = pk11_readrawattribute(pk11_typesymkey, key, cka_id, buf); if (rv != secsuccess) { pr_fprintf(pr_stderr, "pk11_readrawattribute returned (%d)\n", rv); pr_fprintf(pr_stderr, "could not read symkey cka_id attribute\n"); return rv; } return rv; } /* * generate a symmetric key */ pk11symkey * generatesymkey(pk11slotinfo *slot, ck_mechanism_type mechanism, int keysize, secitem *keyid, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); return null; ...
... strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } pr_fprintf(outfile, "%s\n", header); printashex(outfile, buf, len); pr_fprintf(outfile, "%s\n\n", trailer); return secsuccess; } /* * initialize for encryption or decryption - common code */ pk11context * cryptinit(pk11symkey *key, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type, ck_attribute_type operation) { secitem ivitem = { sibuffer, iv, ivlen }; pk11context *ctx = null; secitem *secparam = pk11_paramfromiv(ckm_aes_cbc, &ivitem); if (secparam == null) { pr_fprintf(pr_stderr, "crypt failed : secparam null\n"); return null; } ctx = pk11_createcontextbysymkey(ckm_aes_cbc, operation, key, secparam); if (ctx == null) { ...
...eturn crypt(ctx, out, outlen, maxout, in, inlen); } /* * encrypt */ secstatus encrypt(pk11context* ctx, unsigned char *out, unsigned int *outlen, unsigned int maxout, unsigned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encryptinit */ pk11context * encryptinit(pk11symkey *ek, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(ek, iv, ivlen, type, cka_encrypt); } /* * decryptinit */ pk11context * decryptinit(pk11symkey *dk, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(dk, iv, ivlen, type, cka_decrypt); } /* * read cryptographic parameters from the header file */ secstatus readfromheaderfile(const char *filename, headertype type, ...
...= secsuccess) { pr_fprintf(pr_stderr, "write pad failure\n"); goto cleanup; } rv = secsuccess; cleanup: if (ctxmac != null) { pk11_destroycontext(ctxmac, pr_true); } if (ctxenc != null) { pk11_destroycontext(ctxenc, pr_true); } return rv; } /* * find the key for the given mechanism */ pk11symkey* findkey(pk11slotinfo *slot, ck_mechanism_type mechanism, secitem *keybuf, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); if (slot) { ...

Encrypt and decrypt MAC using token
secitem* buf) { secstatus rv = pk11_readrawattribute(pk11_typesymkey, key, cka_id, buf); if (rv != secsuccess) { pr_fprintf(pr_stderr, "pk11_readrawattribute returned (%d)\n", rv); pr_fprintf(pr_stderr, "could not read symkey cka_id attribute\n"); return rv; } return rv; } /* * generate a symmetric key */ pk11symkey * generatesymkey(pk11slotinfo *slot, ck_mechanism_type mechanism, int keysize, secitem *keyid, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); return null; ...
... strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } pr_fprintf(outfile, "%s\n", header); printashex(outfile, buf, len); pr_fprintf(outfile, "%s\n\n", trailer); return secsuccess; } /* * initialize for encryption or decryption - common code */ pk11context * cryptinit(pk11symkey *key, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type, ck_attribute_type operation) { secitem ivitem = { sibuffer, iv, ivlen }; pk11context *ctx = null; secitem *secparam = pk11_paramfromiv(ckm_aes_cbc, &ivitem); if (secparam == null) { pr_fprintf(pr_stderr, "crypt failed : secparam null\n"); return null; } ctx = pk11_createcontextbysymkey(ckm_aes_cbc, operation, key, secparam); if (ctx == null) { ...
...eturn crypt(ctx, out, outlen, maxout, in, inlen); } /* * encrypt */ secstatus encrypt(pk11context* ctx, unsigned char *out, unsigned int *outlen, unsigned int maxout, unsigned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encryptinit */ pk11context * encryptinit(pk11symkey *ek, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(ek, iv, ivlen, type, cka_encrypt); } /* * decryptinit */ pk11context * decryptinit(pk11symkey *dk, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(dk, iv, ivlen, type, cka_decrypt); } /* * read cryptographic parameters from the header file */ secstatus readfromheaderfile(const char *filename, headertype type, ...
...= secsuccess) { pr_fprintf(pr_stderr, "write pad failure\n"); goto cleanup; } rv = secsuccess; cleanup: if (ctxmac != null) { pk11_destroycontext(ctxmac, pr_true); } if (ctxenc != null) { pk11_destroycontext(ctxenc, pr_true); } return rv; } /* * find the key for the given mechanism */ pk11symkey* findkey(pk11slotinfo *slot, ck_mechanism_type mechanism, secitem *keybuf, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); if (slot) { ...

Enc Dec MAC Output Public Key as CSR
ilure; goto cleanup; } rv = pk11_pubwrapsymkey(ckm_rsa_pkcs, pubkey, key, data); if (rv != secsuccess) { rv = secfailure; } else { *wrappedkey = data; return secsuccess; } cleanup: if (data) { secitem_freeitem(data, pr_true); } return rv; } /* * generate a symmetric key */ pk11symkey * generatesymkey(pk11slotinfo *slot, ck_mechanism_type mechanism, int keysize, secitem *keyid, secupwdata *pwdata) { secstatus rv; pk11symkey *key; /* generate the symmetric key */ key = pk11_tokenkeygen(slot, mechanism, null, keysize, keyid, pr_false, pwdata); if (!key) { pr_fprintf(pr_stderr, "symmetric key generation failed \n"); } return key; } /* * macinit */ secstatus ...
... return secsuccess; break; default: return secfailure; } pr_fprintf(outfile, "%s\n", header); printasascii(outfile, buf, len); pr_fprintf(outfile, "%s\n\n", trailer); return secsuccess; } /* * initialize for encryption or decryption - common code */ pk11context * cryptinit(pk11symkey *key, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type, ck_attribute_type operation) { secitem ivitem = { sibuffer, iv, ivlen }; pk11context *ctx = null; secitem *secparam = pk11_paramfromiv(type, &ivitem); if (secparam == null) { pr_fprintf(pr_stderr, "crypt failed : secparam null\n"); return null; } ctx = pk11_createcontextbysymkey(type, operation, key, secparam); if (ctx == null) { pr_fprin...
...eturn crypt(ctx, out, outlen, maxout, in, inlen); } /* * encrypt */ secstatus encrypt(pk11context* ctx, unsigned char *out, unsigned int *outlen, unsigned int maxout, unsigned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encryptinit */ pk11context * encryptinit(pk11symkey *ek, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(ek, iv, ivlen, type, cka_encrypt); } /* * decryptinit */ pk11context * decryptinit(pk11symkey *dk, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(dk, iv, ivlen, type, cka_decrypt); } /* * read cryptographic parameters from the header file */ secstatus readfromheaderfile(const char *filename, headertype type, ...
... } cleanup: pr_close(file); atob_convertasciitoitem(item, body); return secsuccess; } /* * generate the private key */ seckeyprivatekey * generateprivatekey(keytype keytype, pk11slotinfo *slot, int size, int publicexponent, const char *noisefilename, seckeypublickey **pubkeyp, const char *pqgfile, secupwdata *pwdata) { ck_mechanism_type mechanism; secoidtag algtag; pk11rsagenparams rsaparams; void *params; seckeyprivatekey *privkey = null; secstatus rv; unsigned char randbuf[blocksize + 1]; rv = generaterandom(randbuf, blocksize); if (rv != secsuccess) { fprintf(stderr, "error while generating the random numbers : %s\n", port_erro...

Encrypt Decrypt_MAC_Using Token
*/ pk11symkey * generatesymkey(pk11slotinfo *slot, ck_mechanism_type mechanism, int keysize, secitem *keyid, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); return null; ...
... */ pk11context * cryptinit(pk11symkey *key, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type, ck_attribute_type operation) { secitem ivitem = { sibuffer, iv, ivlen }; pk11context *ctx = null; secitem *secparam = pk11_paramfromiv(ckm_aes_cbc, &ivitem); if (secparam == null) { pr_fprintf(pr_stderr, "crypt failed : secparam null\n"); return null; } ctx = pk11_createcontextbysymkey(ckm_aes_cbc, operation, key, secparam); if (ctx == null) { ...
...eturn crypt(ctx, out, outlen, maxout, in, inlen); } /* * encrypt */ secstatus encrypt(pk11context* ctx, unsigned char *out, unsigned int *outlen, unsigned int maxout, unsigned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encryptinit */ pk11context * encryptinit(pk11symkey *ek, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(ek, iv, ivlen, type, cka_encrypt); } /* * decryptinit */ pk11context * decryptinit(pk11symkey *dk, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(dk, iv, ivlen, type, cka_decrypt); } /* * read cryptographic parameters from the header file.
... */ pk11symkey* findkey(pk11slotinfo *slot, ck_mechanism_type mechanism, secitem *keybuf, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); if (slot) { ...

NSS Sample Code Sample_3_Basic Encryption and MACing
secitem* buf) { secstatus rv = pk11_readrawattribute(pk11_typesymkey, key, cka_id, buf); if (rv != secsuccess) { pr_fprintf(pr_stderr, "pk11_readrawattribute returned (%d)\n", rv); pr_fprintf(pr_stderr, "could not read symkey cka_id attribute\n"); return rv; } return rv; } /* * generate a symmetric key */ pk11symkey * generatesymkey(pk11slotinfo *slot, ck_mechanism_type mechanism, int keysize, secitem *keyid, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); return null; ...
... strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } pr_fprintf(outfile, "%s\n", header); printashex(outfile, buf, len); pr_fprintf(outfile, "%s\n\n", trailer); return secsuccess; } /* * initialize for encryption or decryption - common code */ pk11context * cryptinit(pk11symkey *key, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type, ck_attribute_type operation) { secitem ivitem = { sibuffer, iv, ivlen }; pk11context *ctx = null; secitem *secparam = pk11_paramfromiv(ckm_aes_cbc, &ivitem); if (secparam == null) { pr_fprintf(pr_stderr, "crypt failed : secparam null\n"); return null; } ctx = pk11_createcontextbysymkey(ckm_aes_cbc, operation, key, secparam); if (ctx == null) { ...
...eturn crypt(ctx, out, outlen, maxout, in, inlen); } /* * encrypt */ secstatus encrypt(pk11context* ctx, unsigned char *out, unsigned int *outlen, unsigned int maxout, unsigned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encryptinit */ pk11context * encryptinit(pk11symkey *ek, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(ek, iv, ivlen, type, cka_encrypt); } /* * decryptinit */ pk11context * decryptinit(pk11symkey *dk, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(dk, iv, ivlen, type, cka_decrypt); } /* * read cryptographic parameters from the header file */ secstatus readfromheaderfile(const char *filename, headertype type, ...
...= secsuccess) { pr_fprintf(pr_stderr, "write pad failure\n"); goto cleanup; } rv = secsuccess; cleanup: if (ctxmac != null) { pk11_destroycontext(ctxmac, pr_true); } if (ctxenc != null) { pk11_destroycontext(ctxenc, pr_true); } return rv; } /* * find the key for the given mechanism */ pk11symkey* findkey(pk11slotinfo *slot, ck_mechanism_type mechanism, secitem *keybuf, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); if (slot) { ...

EncDecMAC using token object - sample 3
d */ secstatus gathercka_id(pk11symkey* key, secitem* buf) { secstatus rv = pk11_readrawattribute(pk11_typesymkey, key, cka_id, buf); if (rv != secsuccess) { pr_fprintf(pr_stderr, "pk11_readrawattribute returned (%d)\n", rv); pr_fprintf(pr_stderr, "could not read symkey cka_id attribute\n"); return rv; } return rv; } /* * generate a symmetric key */ pk11symkey * generatesymkey(pk11slotinfo *slot, ck_mechanism_type mechanism, int keysize, secitem *keyid, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); return null; } } /* generate the symmetric key */ key = pk11_tokenkeygen(slot, mechanism, null, keysize, keyid, pr_tru...
..., mac_header); strcpy(trailer, mac_trailer); break; case pad: strcpy(header, pad_header); strcpy(trailer, pad_trailer); break; } pr_fprintf(outfile, "%s\n", header); printashex(outfile, buf, len); pr_fprintf(outfile, "%s\n\n", trailer); return secsuccess; } /* * initialize for encryption or decryption - common code */ pk11context * cryptinit(pk11symkey *key, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type, ck_attribute_type operation) { secitem ivitem = { sibuffer, iv, ivlen }; pk11context *ctx = null; secitem *secparam = pk11_paramfromiv(ckm_aes_cbc, &ivitem); if (secparam == null) { pr_fprintf(pr_stderr, "crypt failed : secparam null\n"); return null; } ctx = pk11_createcontextbysymkey(ckm_aes_cbc, operation, key, secparam); if (ctx == null) { pr_fprintf(pr_stderr, "crypt failed : can't cre...
...gned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encrypt */ secstatus encrypt(pk11context* ctx, unsigned char *out, unsigned int *outlen, unsigned int maxout, unsigned char *in, unsigned int inlen) { return crypt(ctx, out, outlen, maxout, in, inlen); } /* * encryptinit */ pk11context * encryptinit(pk11symkey *ek, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(ek, iv, ivlen, type, cka_encrypt); } /* * decryptinit */ pk11context * decryptinit(pk11symkey *dk, unsigned char *iv, unsigned int ivlen, ck_mechanism_type type) { return cryptinit(dk, iv, ivlen, type, cka_decrypt); } /* * read cryptographic parameters from the header file */ secstatus readfromheaderfile(const char *filename, headertype type, secitem *item, prbool ishexda...
...); writetoheaderfile(paditem.data, paditem.len, pad, headerfile); if (rv != secsuccess) { pr_fprintf(pr_stderr, "write pad failure\n"); goto cleanup; } rv = secsuccess; cleanup: if (ctxmac != null) { pk11_destroycontext(ctxmac, pr_true); } if (ctxenc != null) { pk11_destroycontext(ctxenc, pr_true); } return rv; } /* * find the key for the given mechanism */ pk11symkey* findkey(pk11slotinfo *slot, ck_mechanism_type mechanism, secitem *keybuf, secupwdata *pwdata) { secstatus rv; pk11symkey *key; if (pk11_needlogin(slot)) { rv = pk11_authenticate(slot, pr_true, pwdata); if (rv != secsuccess) { pr_fprintf(pr_stderr, "could not authenticate to token %s.\n", pk11_gettokenname(slot)); if (slot) { pk11_freeslot(slot); } return null; } } key = pk11_findfixedkey(slot, mechanism, keybuf, 0); if (!key) { pr_fprintf(pr...

NSS 3.16.2 release notes
the algorithm is specified with a ck_mechanism_type.
...the algorithm is specified with a ck_mechanism_type.

Enc Dec MAC Using Key Wrap CertReq PKCS10 CSR
item, ishexdata); cleanup: if (file) { pr_close(file); } return rv; } /* * generate the private key */ seckeyprivatekey * generateprivatekey(keytype keytype, pk11slotinfo *slot, int size, int publicexponent, const char *noise, seckeypublickey **pubkeyp, const char *pqgfile, secupwdata *pwdata) { ck_mechanism_type mechanism; secoidtag algtag; pk11rsagenparams rsaparams; void *params; seckeyprivatekey *privkey = null; secstatus rv; unsigned char randbuf[blocksize + 1]; rv = generaterandom(randbuf, blocksize); if (rv != secsuccess) { fprintf(stderr, "error while generating the random numbers : %s\n", ...

NSS Sample Code sample2
*/ #include "nss.h" #include "pk11pub.h" /* example key & iv */ unsigned char gkey[] = {0xe8, 0xa7, 0x7c, 0xe2, 0x05, 0x63, 0x6a, 0x31}; unsigned char giv[] = {0xe4, 0xbb, 0x3b, 0xd3, 0xc3, 0x71, 0x2e, 0x58}; int main(int argc, char **argv) { ck_mechanism_type ciphermech; pk11slotinfo* slot = null; pk11symkey* symkey = null; secitem* secparam = null; pk11context* enccontext = null; secitem keyitem, ivitem; secstatus rv, rv1, rv2; unsigned char data[1024], buf1[1024], buf2[1024]; int i, result_len, tmp1_outlen, tmp2_outlen; /* initialize nss * if your application ...

NSS Sample Code sample6
should succeed on first run on a fresh db, * should fail on successive runs because key with that id already exists */ genkey(2); /* generate a key with id 1 - this will fail because key with that id * already exists */ genkey(1); } void genkey(int id) { pk11slotinfo* slot = null; pk11symkey* key = null; secitem keyiditem; int keyid[1]; ck_mechanism_type ciphermech; /* using ckm_aes_cbc_pad mechanism for example */ ciphermech = ckm_aes_cbc_pad; slot = pk11_getinternalkeyslot(); /* slot = pk11_getbestslot(ciphermech, null); didn't work.

sample2
der but has trailer\n"); port_free(filedata.data); rv = secfailure; goto cleanup; } } } hextobuf(body, item, ishexdata); cleanup: if (file) { pr_close(file); } return rv; } /* * generate the private key */ seckeyprivatekey * generateprivatekey(keytype keytype, pk11slotinfo *slot, int size, int publicexponent, const char *noise, seckeypublickey **pubkeyp, const char *pqgfile, secupwdata *pwdata) { ck_mechanism_type mechanism; secoidtag algtag; pk11rsagenparams rsaparams; void *params; seckeyprivatekey *privkey = null; secstatus rv; unsigned char randbuf[blocksize + 1]; rv = generaterandom(randbuf, blocksize); if (rv != secsuccess) { fprintf(stderr, "error while generating the random numbers : %s\n", port_errortostring(rv)); goto cleanup; } pk11_randomupdate(randbuf, blocksize); switch (keytype) { case rsake...

FC_GetMechanismInfo
syntax ck_rv fc_getmechanisminfo( ck_slot_id slotid, ck_mechanism_type type, ck_mechanism_info_ptr pinfo ); parameters fc_getmechanisminfo takes three parameters: slotid [input] type [input] .

FC_GetMechanismList
syntax ck_rv fc_getmechanismlist( ck_slot_id slotid, ck_mechanism_type_ptr pmechanismlist, ck_ulong_ptr puscount ); parameters fc_getmechanismlist takes three parameters: slotid [input] pinfo [output] the address of a variable that will receive a pointer to the list of function pointers.