-
Notifications
You must be signed in to change notification settings - Fork 1
/
ep11.h
3638 lines (3149 loc) · 165 KB
/
ep11.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*----------------------------------------------------------------------
* This EP11 header file is distributed under the following license
*
* Copyright 2023 IBM Corp. All Rights Reserved
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* 3. Neither the name of the copyright holder nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
* THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*----------------------------------------------------------------------
* EP11 support e-mail address: [email protected]
*
* Use this e-mail address for Bugs and Comments with the EP11 product.
*----------------------------------------------------------------------*/
#if !defined(XCP_H__)
#define XCP_H__
#if !defined(CKR_OK)
#include "pkcs11.h"
#endif
#if !defined(INT64_MIN)
#error "We need 64-bit <stdint.h> types, please include before this file."
#endif
//
// used for internal and external paths/addresses
#define MAX_FNAME_CHARS 256
// Error Values for functions that do not return CK_RV
// general errors
#define XCP_OK 0 /* function successful
*/
#define XCP_EINTERNAL -1 /* host library internal error.
* host library is in an inconsistent state
* shutdown and new init is needed
*/
#define XCP_EARG -2 /* Argument is invalid
*/
#define XCP_ETARGET -3 /* Target argument is invalid
*/
#define XCP_EMEMORY -4 /* could not allocate memory
*/
#define XCP_EMUTEX -5 /* Mutex is invalid
*/
#define XCP_EINIT -6 /* Could not initialize library
*/
#define XCP_EDEVICE -7 /* The channel that is used to communicate
* with the backend is not available or
* invalid
*/
#define XCP_EGROUP -8 /* Target group is unusable or invalid
*/
#define XCP_ESIZE -9 /* invalid size
*/
#define XCP_EINVALID -10 /* invalid content of parameter
*/
#define XCP_ERESPONSE -11 /* bad response from module. Sometimes
* it is not possible to return the CK_RV
* value directly and we can only say that
* something failed.
*/
#define XCP_EAPI -12 /* incompatible/invalid api
*/
// module specific errors
#define XCP_MOD_EOBSOLETE -101 /* past feature has been obsoleted,
* no longer available. check notes on
* future-compatibility.
*/
#define XCP_MOD_EVERSION -102 /* library predates caller, does not
* support requested API version
*/
#define XCP_MOD_EFLAGS -103 /* library does not support all requested
* flags, even if call/struct is otherwise
* API-compatible. expect this only when
* device-specific details (module
* selection, communication/channel type)
* are not supported by the backend.
*/
#define XCP_MOD_EMODULE -104 /* library does not support this module
* number (a real one, not virtual ones).
* typical error when locally attached
* modules' count has an upper bound.
*/
#define XCP_MOD_EDOMAIN -105 /* the targeted module does not support
* the requested domain.
*/
#define XCP_MOD_EINIT -106 /* the targeted module is not initialized
* typical error for socket attached
* modules, because adding this modules
* on the fly is not possible
*/
#define XCP_MOD_EPROBE -107 /* probe did fail for all defined domains.
* This is an error even when the strict
* flag is not active
*/
/*--------------------------------------------------------------------------*/
#define XCP_COMMON_PUBLIC_H__
#define XCP_API_VERSION 0x081e /* major[8] minor[8] */
#define XCP_API_ORDINAL 0x0006
/* increment this with every major/minor change */
#define XCP_HOST_API_VER 0x040100 /* major[8] minor[8] fixpack[8] */
/* HSM connection information; not for PKCS11 user consumption */
#define XCP_HSM_AGENT_ID 0x5843 /* ASCII "XC" */
#define XCP_HSM_USERDEF32 0x01234567
// protected key requires API ordinal greater or equal to 4
#define XCP_API_ALLOW_PROTKEY 0x0004
// Support for extended FIPS2021 attributes
//
// Requests for card/domain attributes (XCP_ADMQ_ATTRS/XCP_ADMQ_DOM_ATTRS)
// will contain the extended attributes (key-types, adm FIPS2021 compliance)
// only with API ordinal 5 (or higher) for compatibility reasons.
// Also, the module sub-queries CK_IBM_XCPMSQ_ATTRLIST, CK_IBM_XCPMSQ_ATTRS
// and CK_IBM_XCPMSQ_ATTRCOUNT will contain the information related to the
// extended attributes only with this API ordinal.
#define XCP_API_ALLOW_FIPS2021 0x0005
// function sub-variants
// 0 means regular request
typedef enum {
XCP_FNVAR_SIZEQUERY = 1, /* sizequery: databytes[64]->resp.bytes[64] */
XCP_FNVAR_MULTIDATA = 2, /* multi-data request */
XCP_FNVAR_MULTISIZEQ = 3 /* multi-data request, size query */
} XCP_FNVariant_t;
// XCP-specific return codes
//
#define CKR_IBM_WKID_MISMATCH (CKR_VENDOR_DEFINED +0x10001)
#define CKR_IBM_INTERNAL_ERROR (CKR_VENDOR_DEFINED +0x10002)
#define CKR_IBM_TRANSPORT_ERROR (CKR_VENDOR_DEFINED +0x10003)
#define CKR_IBM_BLOB_ERROR (CKR_VENDOR_DEFINED +0x10004)
/* WK setup changed during the execution of a single request,
* preventing return of encrypted data to the host. (i.e.,
* an administrative operation changed WKs before the
* function could re-wrap data to pass back to the host)
*/
#define CKR_IBM_BLOBKEY_CONFLICT (CKR_VENDOR_DEFINED +0x10005)
#define CKR_IBM_MODE_CONFLICT (CKR_VENDOR_DEFINED +0x10006)
/* an RSA key in non-CRT form is encountered which is not
* supported by this hardware/engine configuration, if the
* setup has non/CRT-specific size restrictions.
* in essence, a more specific sub-division of
* the standard CKR_KEY_SIZE_RANGE, and MAY be
* safely mapped to that by host libraries.
*/
#define CKR_IBM_NONCRT_KEY_SIZE (CKR_VENDOR_DEFINED +0x10008)
#define CKR_IBM_WK_NOT_INITIALIZED (CKR_VENDOR_DEFINED +0x10009)
/* unexpected/consistency error of CA operations of the
* hosting HSM, if not otherwise classified.
*/
#define CKR_IBM_OA_API_ERROR (CKR_VENDOR_DEFINED +0x1000a)
/* potentially long-running request, such as those involving
* prime generation, did not complete in a 'reasonable'
* number of iterations. supported to prevent timeout-
* triggered module resets, such as mainframe firmware
* resetting modules 'stuck in infinite loops' (as perceived
* by the host)
*/
#define CKR_IBM_REQ_TIMEOUT (CKR_VENDOR_DEFINED +0x1000b)
/* backend in read-only state, rejecting state-changing
* operations:
*/
#define CKR_IBM_READONLY (CKR_VENDOR_DEFINED +0x1000c)
/* backend/policy may not be configured to accept request.
* this is the permanent form of policy failure
* (which is mapped to standard CKR_FUNCTION_CANCELED)
*/
#define CKR_IBM_STATIC_POLICY (CKR_VENDOR_DEFINED +0x1000d)
/* backend not allowed to return requested nr of bytes: */
#define CKR_IBM_TRANSPORT_LIMIT (CKR_VENDOR_DEFINED +0x10010)
//
// use CKR_IBM_TRANSPORT_ERROR for errors introduced between ep11.h and backend
// CKR_IBM_TRANSPORT_LIMIT for errors on return path
// CKR_ARGUMENTS_BAD or specific one for bad data passed through ep11.h
#define CKR_IBM_FCV_NOT_SET (CKR_VENDOR_DEFINED +0x10011)
// Error returned by check if the performance category has not been set
#define CKR_IBM_PERF_CATEGORY_INVALID (CKR_VENDOR_DEFINED +0x10012)
// API ORDINAL number is unknown or function id is in illegal range
#define CKR_IBM_API_MISMATCH (CKR_VENDOR_DEFINED +0x10013)
// target token is invalid
#define CKR_IBM_TARGET_INVALID (CKR_VENDOR_DEFINED +0x10030)
#define CKR_IBM_PQC_PARAMS_NOT_SUPPORTED (CKR_VENDOR_DEFINED +0x10031)
#define CKR_IBM_PARAM_NOT_SUPPORTED (CKR_VENDOR_DEFINED +0x10032)
#define CKR_IBM_SESSION_IMMUTABLE (CKR_VENDOR_DEFINED +0x10033)
// Error returned if internal verification of crypto engines fail
#define CKR_IBM_ERROR_STATE (CKR_VENDOR_DEFINED +0x10101)
/*--- mechanisms ---------------------------------------------------------*/
#define CKM_IBM_SHA3_224 (CKM_VENDOR_DEFINED +0x10001)
#define CKM_IBM_SHA3_256 (CKM_VENDOR_DEFINED +0x10002)
#define CKM_IBM_SHA3_384 (CKM_VENDOR_DEFINED +0x10003)
#define CKM_IBM_SHA3_512 (CKM_VENDOR_DEFINED +0x10004)
#define CKM_IBM_CMAC (CKM_VENDOR_DEFINED +0x10007)
//
// non-SHA-1 ECDSA: no standard mechansims pre-v2.40
#define CKM_IBM_ECDSA_SHA224 (CKM_VENDOR_DEFINED +0x10008)
#define CKM_IBM_ECDSA_SHA256 (CKM_VENDOR_DEFINED +0x10009)
#define CKM_IBM_ECDSA_SHA384 (CKM_VENDOR_DEFINED +0x1000a)
#define CKM_IBM_ECDSA_SHA512 (CKM_VENDOR_DEFINED +0x1000b)
// EC point multiply
#define CKM_IBM_EC_MULTIPLY (CKM_VENDOR_DEFINED +0x1000c)
// EAC (machine-readable travel document: passport, DL, ID card PKI)
//
// derive secure messaging, a class of functions
#define CKM_IBM_EAC (CKM_VENDOR_DEFINED +0x1000d)
#define XCP_EAC_NONCE_MAX_BYTES 64 /* salt/nonce */
#define XCP_EAC_INFO_MAX_BYTES 64 /* other auxiliary data */
//
// variants within EAC
typedef enum {
EACV_IBM_KEK_V101 = 1, // secret -> secure msg KEK (EAC v1.01)
EACV_IBM_MACK_V101 = 2, // secret -> secure msg MACK (EAC v1.01)
EACV_IBM_PWD_V200 = 3, // passphrase -> secure msg KEK (EAC v2.00)
EACV_IBM_HKDF = 4, // HKDF( base-key, mechanism-attached salt )
// salt is supplied with mechanism parameter
// output bytecount specified as attribute
// of derived key
EACV_IBM_BCHAIN_TCERT0
= 5 // blockchain: derive tcert from base EC key
// and additive cleartext [potentially insecure]
} EAC_Var_t;
// test access
#define CKM_IBM_TESTCODE (CKM_VENDOR_DEFINED +0x1000e)
// SHA-512 derivatives later than PKCS#11 v2.20, SHA-512/256 and SHA-512/224
// see pkcs11add.h (since v2.40 drafts)(since v2.40 drafts)(since v2.40 drafts)(since v2.40 drafts)
//
#define CKM_IBM_SHA512_256 (CKM_VENDOR_DEFINED +0x10012)
#define CKM_IBM_SHA512_224 (CKM_VENDOR_DEFINED +0x10013)
#define CKM_IBM_SHA512_256_HMAC (CKM_VENDOR_DEFINED +0x10014)
#define CKM_IBM_SHA512_224_HMAC (CKM_VENDOR_DEFINED +0x10015)
//
// curve25519, key agreement
#define CKM_IBM_EC_X25519 (CKM_VENDOR_DEFINED +0x1001b)
//
// eddsa/25519 signatures, with SHA-512, no prehashing
#define CKM_IBM_ED25519_SHA512 (CKM_VENDOR_DEFINED +0x1001c)
// curve448 ('Goldilocks'), key agreement
#define CKM_IBM_EC_X448 (CKM_VENDOR_DEFINED +0x1001e)
//
// ed448 signatures, with SHA-3/XOF, no prehashing
#define CKM_IBM_ED448_SHA3 (CKM_VENDOR_DEFINED +0x1001f)
// round counts are passed as mechanism parameters
#define CKM_IBM_SIPHASH (CKM_VENDOR_DEFINED +0x10021)
// these need a strength definition
// XCP_U32_VALUE_BITS/CKA_VALUE_BITS would be sufficient; strength->K/L mapping
//
// umbrella mech for PQC/Crystals variants
#define CKM_IBM_DILITHIUM (CKM_VENDOR_DEFINED +0x10023)
// ^^^ sign/verify plus keygen only
#define CKM_IBM_KYBER (CKM_VENDOR_DEFINED +0x10024)
// ^^^ en/decrypt, keygen, key transport, and (hybrid) key derivation
// SHA-3 HMAC variants
#define CKM_IBM_SHA3_224_HMAC (CKM_VENDOR_DEFINED +0x10025)
#define CKM_IBM_SHA3_256_HMAC (CKM_VENDOR_DEFINED +0x10026)
#define CKM_IBM_SHA3_384_HMAC (CKM_VENDOR_DEFINED +0x10027)
#define CKM_IBM_SHA3_512_HMAC (CKM_VENDOR_DEFINED +0x10028)
// curve25519, key agreement (using KEK)
#define CKM_IBM_EC_X25519_RAW (CKM_VENDOR_DEFINED +0x10029)
// curve448 ('Goldilocks'), key agreement (using KEK)
#define CKM_IBM_EC_X448_RAW (CKM_VENDOR_DEFINED +0x10030)
#define CKM_IBM_ECDSA_OTHER (CKM_VENDOR_DEFINED +0x10031)
typedef enum {
ECSG_IBM_ECSDSA_S256 = 3,
// [Randomized] Schnorr signatures
// BSI TR03111 ECSDSA
// no prehashing; SHA-256 only
ECSG_IBM_ECSDSA_COMPR_MULTI = 5,
// [Randomized] Schnorr signatures
// BSI TR-03111 @2012, working on
// compressed public key format and
// including signers public key
ECSG_IBM_BLS = 6,
// Boneh-Lynn-Shacham signatures
// RFC draft-irtf-cfrg-bls-signature-05
ECSG_IBM_MAX = ECSG_IBM_BLS,
} ECSG_Var_t;
#define CKM_IBM_EC_AGGREGATE (CKM_VENDOR_DEFINED +0x10034)
typedef enum {
EC_AGG_BLS12_381_SIGN = 1, // size of signature is sufficient indicator
EC_AGG_BLS12_381_PKEY = 2,
EC_AGG_BLS12_381_MAX = EC_AGG_BLS12_381_PKEY,
} ECAgg_Var_t;
#define CK_IBM_EC_AGG_BLS12_381_SIGN EC_AGG_BLS12_381_SIGN
#define CK_IBM_EC_AGG_BLS12_381_PKEY EC_AGG_BLS12_381_PKEY
typedef struct XCP_EC_AGGREGATE_PARAMS {
CK_ULONG version;
CK_ULONG mode;
CK_ULONG perElementSize;
CK_BYTE_PTR pElements;
CK_ULONG ulElementsLen;
} XCP_EC_AGGREGATE_PARAMS;
#define CK_IBM_ECSG_IBM_ECSDSA_S256 ECSG_IBM_ECSDSA_S256
#define CK_IBM_ECSG_IBM_ECDSA_COMPR_MULTI_S256 ECSG_IBM_ECDSA_COMPR_MULTI_S256
#define CK_IBM_ECSG_IBM_BLS ECSG_IBM_BLS
#define CK_IBM_ECSG_IBM_MAX ECSG_IBM_MAX
//--- transport additions --------------------------------------------------
#define CKM_IBM_CLEARKEY_TRANSPORT (CKM_VENDOR_DEFINED +0x20001)
// key+attributes bound format (ignores other attributes)
#define CKM_IBM_ATTRIBUTEBOUND_WRAP (CKM_VENDOR_DEFINED +0x20004)
// operations related to key cloning
#define CKM_IBM_TRANSPORTKEY (CKM_VENDOR_DEFINED +0x20005)
// EC/DH equivalents: derive key, then return encrypted under
// KEK supplied as auxiliary data
// (does not resemble regular PKCS11 mechanisms)
//
#define CKM_IBM_DH_PKCS_DERIVE_RAW (CKM_VENDOR_DEFINED +0x20006)
#define CKM_IBM_ECDH1_DERIVE_RAW (CKM_VENDOR_DEFINED +0x20007)
// none of these have PKCS11 constants (as of 2018-02)
//
// allow direct access to mechanism's wireform
// parameter of this mechanism is used as wire form
#define CKM_IBM_WIRETEST (CKM_VENDOR_DEFINED +0x30004)
//--- separate infrastructure-related mechs --------------------------------
// to generate/refill semi-retained keys
// see also CKA_IBM_RETAINKEY
//
#define CKM_IBM_RETAINKEY (CKM_VENDOR_DEFINED +0x40001)
// IBM protkey data key import mechanism (WrapKey)
#define CKM_IBM_CPACF_WRAP (CKM_VENDOR_DEFINED +0x60001)
// bitcoin key derivation
#define CKM_IBM_BTC_DERIVE (CKM_VENDOR_DEFINED +0x70001)
// etherium key derivation
#define CKM_IBM_ETH_DERIVE (CKM_VENDOR_DEFINED +0x70002)
/*--- attributes ---------------------------------------------------------*/
// object may have rights removed, but not added (subset of modifiability)
#define CKA_IBM_RESTRICTABLE (CKA_VENDOR_DEFINED +0x10001)
// object was created non-MODIFIABLE
#define CKA_IBM_NEVER_MODIFIABLE (CKA_VENDOR_DEFINED +0x10002)
// object is HSM-resident (handle instead of full token)
// has a single parameter, usage count
#define CKA_IBM_RETAINKEY (CKA_VENDOR_DEFINED +0x10003)
// object must be transported with attributes, never separated
// note: incompatible with pure-PKCS#11 un/wrap
#define CKA_IBM_ATTRBOUND (CKA_VENDOR_DEFINED +0x10004)
// symbolic key type in other hierarchies (CK_ULONG)
// XCP stores but ignores it
#define CKA_IBM_KEYTYPE (CKA_VENDOR_DEFINED +0x10005)
// restrictions inherited from other type systems
// XCP stores and partially interprets it
#define CKA_IBM_CV (CKA_VENDOR_DEFINED +0x10006)
// attribute containing MAC key handle, or blob, for authenticated key transport
#define CKA_IBM_MACKEY (CKA_VENDOR_DEFINED +0x10007)
// object may be used as base data of other ops, i.e., hashing or key derivation
//
#define CKA_IBM_USE_AS_DATA (CKA_VENDOR_DEFINED +0x10008)
// DSA/DH parameters as ALGID structure (PKCS#3)
#define CKA_IBM_STRUCT_PARAMS (CKA_VENDOR_DEFINED +0x10009)
// compliance mode, bitfield within 32-bit (CK_ULONG) parameter
#define CKA_IBM_STD_COMPLIANCE1 (CKA_VENDOR_DEFINED +0x1000a)
// key is extractable only as protected key
#define CKA_IBM_PROTKEY_EXTRACTABLE (CKA_VENDOR_DEFINED +0x1000c)
// key is never extractable as protected key
#define CKA_IBM_PROTKEY_NEVER_EXTRACTABLE (CKA_VENDOR_DEFINED +0x1000d)
#define CKA_IBM_PQC_PARAMS (CKA_VENDOR_DEFINED +0x1000e)
// query or modify login session an object is bound to
#define CKA_IBM_LOGIN_SESSION (CKA_VENDOR_DEFINED +0x1000f)
// query or modify login session an object is bound to
#define CKA_IBM_LOGIN_SESSION (CKA_VENDOR_DEFINED +0x1000f)
// query MAC'd spki from a private key
#define CKA_IBM_MACED_PUBLIC_KEY_INFO (CKA_VENDOR_DEFINED +0x20002)
// direct access to attributes' wire form
// parameters of this attribute, if it's the only one present,
// inserted verbatim into request package
#define CKA_IBM_WIRETEST (CKA_VENDOR_DEFINED +0x20001)
// matches the key type constant for clear key Dilithium with ICSF
#define CKK_IBM_PQC_DILITHIUM (CKK_VENDOR_DEFINED +0x10023)
#define CKK_IBM_PQC_KYBER (CKK_VENDOR_DEFINED +0x10024)
#define XCP_MOD_ERROR_STATE_OFF 0x00000000
#define XCP_MOD_ERROR_STATE_MODULE_SELFTEST 0x00000001
#define XCP_MOD_ERROR_STATE_KEYPAIR_GEN_PCT 0x00000002
#define XCP_MOD_ERROR_STATE_SYSTEST_CMD 0x00000003
#define XCP_MOD_ERROR_STATE_TRNG_HEALTH 0x00000004
/*----------------------------------------------------------------------------
* sizes related to blobs and host-visible entities
*
* Cast as many to size_t/unsigned types as possible, to minimize the number
* of 'mixed un/signed types' warnings. Unfortunately, this does not work
* for those which are used by preprocessor math (XCP_WK_BYTES, for example),
* since the preprocessor can not deal with typed arithmetic.
*/
#define XCP_HMAC_BYTES ((size_t) (256 /8)) /* SHA-256 */
#define XCP_FWID_BYTES ((size_t) (256 /8)) /* SHA-256 */
#define XCP_WK_BYTES ((size_t) (256 /8)) /* keypart and session sizes */
/* are identical */
#define XCP_WKID_BYTES ((size_t) (128 /8)) /* truncated hash */
#define XCP_BLOBCLRATTR_BYTES 8 /* clear blob attr's bytecount */
/* keep in sync with objattr_t */
#define XCP_BLOBCLRMODE_BYTES 8 /* clear blob modefield bytecount */
#define XCP_WRAP_BLOCKSIZE ((size_t) (128 /8)) /* blob crypt block bytecount */
#define XCP_MACKEY_BYTES (256 /8) /* derived from controlling WK */
//
#define XCP_PIN_SALT_BYTES XCP_WRAP_BLOCKSIZE
#define XCP_PINBLOB_BYTES \
(XCP_WK_BYTES +XCP_PIN_SALT_BYTES +XCP_HMAC_BYTES)
#define XCP_SESSION_SALT_BYTES ((size_t) 128 /8)
/* salt used in PIN blob rewrapping */
#define XCP_SESSION_TCTR_BYTES ((size_t) (128/8)) /* transaction counter */
#define XCP_SESSION_MAC1_BYTES ((size_t) 64 /8) /* AES/KW MAC */
//
// full v1 (FIPS/2021) PIN, AESKW/pad ciphertext size
#define XCP_PINBLOB_V1_BYTES \
(XCP_WK_BYTES +XCP_SESSION_SALT_BYTES +XCP_SESSION_MAC1_BYTES)
#define XCP_PBE_TYPE_CLEAR 0 /* clear passphrase */
#define XCP_PBE_TYPE_BLOB 1 /* passphrase as generic secretkey */
#define XCP_PBE_TYPE_MAX (XCP_PBE_TYPE_BLOB)
//
#define XCP_PBE_HDR_BYTES 16 /* fixed part of PBE wire struct */
#define XCP_PBE_PWD_MAX_BYTES 1024
#define XCP_PBE_SALT_MAX_BYTES 256
// currently, these are the largest possible param structs
#define XCP_MECH_WIRE_PRM_BYTES ((size_t) 4) /* CK_ULONG(mech) on wire */
#define XCP_MECH_PRM_MAX_BYTES \
(XCP_MECH_WIRE_PRM_BYTES +XCP_PBE_HDR_BYTES \
+XCP_PBE_PWD_MAX_BYTES +XCP_PBE_SALT_MAX_BYTES)
// wire-encoded file header: file ID, start/offset, bytecount
// return path fills in fields, plus may supply data slice
#define XCP_WIRE_FILEHDR_BYTES ((size_t) (4+4+4))
// currently, PBE iteration count limit is global
// the limit may increase, but not decrease, in the future
#define XCP_PBE_ITER_MAX (64*1024)
// SYS_TEST-only, configuration query size
#define XCP_CSP_CONFIG_BYTES 40
#define XCP_SESSIONBLOB_SALT_BYTES 16
#define XCP_SESSIONBLOB_BYTES \
(XCP_WK_BYTES +XCP_SESSIONBLOB_SALT_BYTES +XCP_HMAC_BYTES)
#define XCP_SIZEQ_WIRE_BYTES 8 /* wire size of data/response bytecounts */
#define XCP_PSS_WIRE_BYTES (4+4+4) /* hash[32] || MGF[32] || salt bytes[32] */
//
// infer value from mechanism/hash function
#define XCP_PSS_DEFAULT_VALUE 0xffffffff
#define XCP_OAEP_MIN_WIRE_BYTES (4+4+4) /* hash[32] || MGF[32] || src[32] */
#define XCP_OAEP_MAX_SOURCE_BYTES 1024
/* limit encoding parameter length to a sane number of Bytes */
#define XCP_SHAKE_WIRE_BYTES 4 /* XOF Bytes[32] */
#define XCP_ECDH1_DERIVE_MIN_WIRE_BYTES (4+4+4) /* kdf[32] ||
SharedDataLen[32] ||
PublicDataLen[32] */
#define XCP_BTC_MIN_WIRE_BYTES (4+4+4+4) /* type[32] ||
childKeyIndex[32] ||
chaincode[32]
version[32] */
#define XCP_BIP0032_CHAINCODE_BYTES 32
#define XCP_BTC_VERSION 1
#define XCP_ETH_MIN_WIRE_BYTES (4+4+4+4+4) /* type[32] ||
childKeyIndex[32] ||
KeyInfo[32] ||
version[32] ||
sigVersion[32] */
#define XCP_EIP2333_KEYINFO_BYTES 32
#define XCP_ETH_VERSION 1
#define XCP_ETH_SIG_VERSION 4
#define XCP_KYBER_KEM_VERSION 0
#define XCP_KYBER_KEM_MIN_WIRE_BYTES (4 + 4 + 4 + 4 + 4 + 4) /* version[32] ||
kdf[32] ||
mode[32] ||
cphr[32] ||
shrd[32] ||
blob [32] */
#define XCP_KYBER_RAW_BYTES 32
#define XCP_ECDH1_DERIVE_MAX_PUBLIC_BYTES 1024 /* limit public data length to
reasonable number of bytes */
//
#define XCP_ECDH1_DERIVE_MAX_SHARED_BYTES 1024 /* limit shared data length to
reasonable number of bytes */
//
// full RK ID (handle)
#define XCP_RETAINID_BYTES (XCP_HMAC_BYTES +XCP_HMAC_BYTES)
//
// RK label (name, other human-readable information)
#define XCP_RETAINLABEL_BYTES ((size_t) 64)
//
// truncated form
#define XCP_RETAINID_SHORT_BYTES 4
/*--- infrastructure -----------------------------------------------------*/
typedef enum {
CKF_IBM_HW_EXTWNG = 1, // module monitors removal from its slot.
CKF_IBM_HW_ATTEST = 2, // module has hardware-assisted attestation
CKF_IBM_HW_BATTERY = 4, // module has battery, may raise warnings
CKF_IBM_HW_SYSTEST = 8, // module supports insecure test functions
CKF_IBM_HW_RETAIN = 0x10, // module may retain hardware-internal keys
CKF_IBM_HW_AUDIT = 0x40, // module supports audit-event logging
CKF_IBM_HW_ADM_DOMIMPORT
= 0x0200, // module supports domain import
// see also related extended capability
// (CK_IBM_XCPXQ_DOMIMPORT_VER)
CKF_IBM_HW_PROTKEY_TOLERATION
= 0x0400, // module tolerates blob attributes
// related to the protected-key capability
// see also CKA_IBM_PROTKEY_* description
CKF_IBM_HW_DUAL_OA = 0x1000, // module supports dual OA certs/signatures
// see CK_IBM_XCPXQ_OA_CAP for more details
} XCP_CK_EXTFLAGS_t;
// these numbers apply to current version, subject to change
//
#define XCP_MAX_MODULES 256 /* number of targetable backends */
#define XCP_SERIALNR_CHARS 8
#define XCP_DOMAIN_INSTANCE_BYTES 4
#define XCP_DOMAIN_NUMBER_BYTES 4
#define XCP_DOMAIN_REVISION_BYTES 4
#define XCP_DOMAIN_FLAGS_BYTES 4
#define XCP_WRAPKEY_BYTES 32 /* keep integer blocks of blob cipher */
#define XCP_SPKISALT_BYTES 8 /* in MACed SPKIs (public key objs) */
#define XCP_DOMAINS 256 /* keep multiple of 8 */
#define XCP_DOMAIN_BYTES 4 /* wire-encoding bytecount */
#define XCP_MAX_ADMINS 8 /* per domain; card has +1 */
#define XCP_MAX_KEYPARTS 20 /* per export/import call */
#define XCP_MIN_PINBYTES 8
#define XCP_MAX_PINBYTES 16
//
// v1 PINs, LoginExtended(FIPS/2021), specific limits
#define XCP_MIN_ALG1_PINBYTES ((size_t) 8)
#define XCP_MAX_ALG1_PINBYTES ((size_t) 64)
#define XCP_MAX_LXTD_CONTEXT_BYTES ((size_t) 128) /* addl.context */
//
// max(...all possible PIN sizes...)
#define XCP_MAX_ANY_PINBYTES XCP_MAX_ALG1_PINBYTES
// ~arbitrary limit on acceptable admin. certificates
// additional limits, such as transport-bytecount, may restrict further
#define XCP_CERT_MAX_BYTES ((size_t) 12288) /* fits dil certs (8k + meta) */
#define XCP_CERTHASH_BYTES (256/8)
/* hash or SKI of public key, or other hash-identified things; SHA-256 */
#define XCP_ADMCTR_BYTES ((size_t) (128/8))
/* card/domain admin transaction ctrs */
#define XCP_KEYCSUM_BYTES (256/8) /* full size of verification pattern */
/* maximum coordinate bytecount, NIST P or BP curves */
#define XCP_MAX_EC_COORD_BYTES ((size_t) 66) /* P-521-> 512+9 bits */
#define XCP_MIN_EC_CURVE_BITS 192
/* ^^^ increase this when policy moves beyond shorter curves */
#define XCP_MAX_EC_CURVE_BITS 521
#define XCP_MAX_DIL_SIGNATURE_BYTES 4668 /* max. length of dil. 8-7 sigs */
#define XCP_MAX_SINFO_META_BYTES 100 /* signer info framework bytes */
/* bytecount of raw (generic) keys, not key schedules */
#define MOD_MAX_SYMMKEY_BYTES 256
#define XCP_FCV_PUBLIC_BYTES ((size_t) 76) /* raw struct without signature */
/**/
/* note: entire signed packet, w/o key info, before Sentry */
/* Sentry and beyond, key info is no longer passed to card */
/**/
typedef enum {
XCP_FCV_RSA_BYTES = (76+ 4096/8), /* RSA/4096 signature */
XCP_FCV_EC_BYTES = (76+ 2*66), /* ECDSA/P-521 */
XCP_FCV_MAX_BYTES = XCP_FCV_RSA_BYTES
} XCP_FCV_Bytes_t;
#define PKCS11_CHECKSUM_BYTES ((size_t) 3)
#define XCP_KEYBITS_FIELD_BYTES ((size_t) 4)
/* trailing big-endian bitcount field after UnwrapKey() checksum */
/* card(OA) signature bytecount: SKI-identified SignerInfo,
* Non quantum safe: Must contain space for either:
* - 4096-bit RSA signature, hash OID, encr. OID and SKI
* - EC-P521 signature, hash OID, encr. OID and SKI
*/
#define XCP_RSPSIG_RSA (4096 / 8)
#define XCP_RSPSIG_MAX_BYTES (XCP_MAX_SINFO_META_BYTES + \
XCP_RSPSIG_RSA)
/* card(OA) signature bytecount: SKI-identified SignerInfo,
* Quantum safe: Must contain space for:
* - DIL signature, hash OID, encr. OID and SKI
*/
#define XCP_RSPSIG_QS_MAX_BYTES (XCP_MAX_SINFO_META_BYTES + \
XCP_MAX_DIL_SIGNATURE_BYTES)
/* minimal padding for raw RSA enc/dec/sign/ver/wr/unwr
* Used for example in CKM_RSA_PKCS. See RFC 2313 chapter 8 for a complete
* description */
#define XCP_RSA_PKCS_MIN_PAD 11
/*=== audit events =======================================================*/
#define XCP_LOG_STATE_BYTES (256 /8) /* SHA-256-based hash chain */
#define XCP_LOG_HEADER_BYTE 0x42 /* event-record header, v0 */
#define XCP_LOGEV_SPEC (0xffff0000)
/* indicates particular events, not generic event types/categories, */
/* if bits in this region are non-zero */
/* functionality categories: keep within uint16_t range */
#define XCP_LOGEV_QUERY 0
#define XCP_LOGEV_FUNCTION 1
#define XCP_LOGEV_ADMFUNCTION 2
#define XCP_LOGEV_STARTUP 3
#define XCP_LOGEV_SHUTDOWN 4
#define XCP_LOGEV_SELFTEST 5
#define XCP_LOGEV_DOM_IMPORT 6 /* import sec-relevant data to */
/* domain */
#define XCP_LOGEV_DOM_EXPORT 7 /* export sec-relevant data from */
/* domain */
#define XCP_LOGEV_FAILURE 8
#define XCP_LOGEV_GENERATE 9
#define XCP_LOGEV_REMOVE 10
#define XCP_LOGEV_SPECIFIC 11 /* obtain meaning elsewhere */
#define XCP_LOGEV_STATE_IMPORT 12 /* import to card/multiple domains */
#define XCP_LOGEV_STATE_EXPORT 13 /* export from card/multiple */
/* domains */
/* [after successful export] */
#define XCP_LOGEV_IMPORT 14 /* key/state import (UnwrapKey) */
/* fields provide more context */
#define XCP_LOGEV_EXPORT 15 /* key/state import (WrapKey) */
/* fields provide more context */
/*--- specific events (any including XCP_LOGEV_SPEC) ---------*/
#define XCP_LOGSPEV_TRANSACT_ZEROIZE (XCP_LOGEV_SPEC +1)
/* zeroize card by transaction */
#define XCP_LOGSPEV_KAT_FAILED (XCP_LOGEV_SPEC +2)
/* algorithm selftest failed */
#define XCP_LOGSPEV_KAT_COMPLETED (XCP_LOGEV_SPEC +3)
/* algorithm selftests completed */
/* redundant; logged only to */
/* provide specific event */
#define XCP_LOGSPEV_EARLY_Q_START (XCP_LOGEV_SPEC +4)
/* subsequent events were found */
/* in the early-event queue. */
/* their timestamps are only */
/* approximate; order is correct */
#define XCP_LOGSPEV_EARLY_Q_END (XCP_LOGEV_SPEC +5)
/* early-even queue processing ends. */
/* subsequent events are through */
/* regular auditing, with valid */
/* timestamps and ordering. */
#define XCP_LOGSPEV_AUDIT_NEWCHAIN (XCP_LOGEV_SPEC +6)
/* audit state is corrupted; removed. */
/* generating new instance and start */
/* new chain as a replacement */
#define XCP_LOGSPEV_TIMECHG_BEFORE (XCP_LOGEV_SPEC +7)
/* time change: original time */
#define XCP_LOGSPEV_TIMECHG_AFTER (XCP_LOGEV_SPEC +8)
/* time change: updated time */
#define XCP_LOGSPEV_MODSTIMPORT_START (XCP_LOGEV_SPEC +9)
/* accepted full-state import */
/* data structure */
/* starting update procedure */
#define XCP_LOGSPEV_MODSTIMPORT_FAIL (XCP_LOGEV_SPEC +10)
/* rejected import structure */
/* issued after initial verify; */
/* indicates some inconsistency */
/* of import data structures */
#define XCP_LOGSPEV_MODSTIMPORT_END (XCP_LOGEV_SPEC +11)
/* completed full-state import */
#define XCP_LOGSPEV_MODSTEXPORT_START (XCP_LOGEV_SPEC +12)
/* started full-state export */
/* see also: XCP_LOGEV_STATE_EXPORT */
#define XCP_LOGSPEV_MODSTEXPORT_FAIL (XCP_LOGEV_SPEC +13)
typedef enum {
XCP_LOGSYS_AUDIT = 1, /* audit infrastructure itself */
XCP_LOGSYS_CRYPTTEST = 2, /* cryptographic test operations */
/* such as known-answer tests */
XCP_LOGSYS_SELFTEST = 3, /* non-crypto tests */
XCP_LOGSYS_FULL = 4, /* full module functionality */
XCP_LOGSYS_WK = 5, /* one wrapping key (WK) */
XCP_LOGSYS_STATE = 6 /* all transportable module state */
} XCP_LogSystem_t;
/* bitmask of audit-event flags (mainly optional fields) */
#define XCP_LOGFL_WK_PRESENT 0x80000000
#define XCP_LOGFL_COMPLIANCE_PRESENT 0x40000000 /* ...of hosting domain */
#define XCP_LOGFL_FINALWK_PRESENT 0x20000000
#define XCP_LOGFL_KEYREC0_PRESENT 0x10000000
#define XCP_LOGFL_KEYREC0_COMPL 0x08000000 /* key0 compliance */
#define XCP_LOGFL_KEYREC1_PRESENT 0x04000000
#define XCP_LOGFL_KEYREC2_PRESENT 0x02000000
#define XCP_LOGFL_FINTIME_PRESENT 0x01000000
#define XCP_LOGFL_SALT0_PRESENT 0x00800000
#define XCP_LOGFL_SALT1_PRESENT 0x00400000
#define XCP_LOGFL_SALT2_PRESENT 0x00200000
#define XCP_LOGFL_REASON_PRESENT 0x00100000
#define XCP_LOGFL_SEQPRF_PRESENT 0x00080000
//--- importer PK types ----------------------------------------------------
typedef enum {
XCP_IMPRKEY_RSA_2048 = 0,
XCP_IMPRKEY_RSA_4096 = 1,
XCP_IMPRKEY_EC_P256 = 2, /* EC, NIST P-256 */
XCP_IMPRKEY_EC_P521 = 3, /* EC, NIST P-521 */
XCP_IMPRKEY_EC_BP256r = 4, /* EC, Brainpool BP-256r */
XCP_IMPRKEY_EC_BP320r = 5, /* EC, Brainpool BP-320r */
XCP_IMPRKEY_EC_BP512r = 6, /* EC, Brainpool BP-512r */
XCP_IMPRKEY_RSA_3072 = 7,
XCP_IMPRKEY_EC_P521_TKE = 8, /* EC, NIST P-521 (TKE propr. sign.) */
XCP_IMPRKEY_MAX = XCP_IMPRKEY_EC_P521_TKE
} XCP_IMPRKEY_t;
//--- OA key types ----------------------------------------------------
typedef enum {
XCP_OAKEY_RSA_4096 = 1, /* RSA 4096 bit */
XCP_OAKEY_ECC_P521 = 2, /* ECC NIST P-521 */
XCP_OAKEY_DIL_87R2 = 3, /* DIL 8-7 R2 */
XCP_OAKEY_MAX = XCP_OAKEY_DIL_87R2
} XCP_OAKEY_t;
//--- retained key structures ---------------------------
// initial loading:
// NULL rkData means no refills; invalid with 0 credits
//
// serialized as:
// nothing if structure is missing (i.e., no restrictions)
//
// credits [be32] if structure is present
// rkdata [var ]
//
typedef struct CK_RETAINEDKEY_PARAMS {
CK_ULONG credits;
CK_VOID_PTR rkData;
CK_ULONG rkdLen;
} CK_RETAINEDKEY_PARAMS;
//--- operation categories (perf. measurement) -----------------------------
typedef enum {
XCP_OPCAT_ASYMM_SLOW = 1,
XCP_OPCAT_ASYMM_FAST = 2,
XCP_OPCAT_SYMM_PARTIAL = 3, /* including hashing */
XCP_OPCAT_SYMM_FULL = 4, /* including key generation/derivation */
XCP_OPCAT_ASYMM_GEN = 5,
XCP_OPCAT_ASYMM_MAX = XCP_OPCAT_ASYMM_GEN
} XCP_OPCAT_t;
//
//--- query sub-types ------------------------------------------------------
typedef enum {
CK_IBM_XCPQ_API = 0, /* API and build identifier */
CK_IBM_XCPQ_MODULE = 1, /* module-level information */
CK_IBM_XCPQ_DOMAINS = 2, /* list active domains & WK IDs */
CK_IBM_XCPQ_DOMAIN = 3,
CK_IBM_XCPQ_SELFTEST = 4, /* integrity & algorithm tests */
CK_IBM_XCPQ_EXT_CAPS = 5, /* extended capabilities, count */
CK_IBM_XCPQ_EXT_CAPLIST = 6, /* extended capabilities, list */
CK_IBM_XCPQ_AUDITLOG = 8, /* audit record or records */
/* 9 not used ----------------- */
CK_IBM_XCPQ_EC_CURVES = 10, /* supported elliptic curves, */
/* individual curves, bitmask */
/* see: XCP_ECcurve_t */
CK_IBM_XCPQ_COMPAT = 11, /* domains' compatibility modes */
CK_IBM_XCPQ_EC_CURVEGRPS
= 12, /* supported elliptic curves, */
/* groups/categories, bitmask */
/* see: CK_IBM_ECCURVEQ_t */
CK_IBM_XCPQ_CP_BLACKLIST
= 13, /* control point blacklist: */
/* control points which may */
/* never be enabled due to */
/* policy-minimum restrictions. */
CK_IBM_XCPQ_PQC_STRENGTHS
= 14, /* supported quantum safe levels*/
/* of strength */
/* see: XCP_PQCStrength_t */
CK_IBM_XCPQ_LOGIN_IMPORTER
= 15, /* current session importer key */
/* and it's transaction counter */
/* for given curve type */
/* see: XCP_ECCurve_t and */
/* CK_IBM_XCPXQ_LOGIN_KEYTYPES */
CK_IBM_XCPQ_COMPAT_ADM = 16, /* domains' administrative */
/* compatibility modes */
CK_IBM_XCPQ_MAX = CK_IBM_XCPQ_COMPAT_ADM
} CK_IBM_XCPQUERY_t;
//--- module sub-query sub-types --------------------------------------------
typedef enum {
CK_IBM_XCPMSQ_DEFAULT = 0, /* zero indicates no sub-query */
CK_IBM_XCPMSQ_DESCRTEXT = 1, /* human-readable text/tokens */
CK_IBM_XCPMSQ_FNLIST = 2, /* supported function id bitmask*/
CK_IBM_XCPMSQ_FNS = 3, /* count of fn ids */
CK_IBM_XCPMSQ_MOD_V1 = 4, /* add version one fields to */
/* module query */
CK_IBM_XCPMSQ_ATTRLIST = 5, /* supported administrative */
/* attributes bitmask */
CK_IBM_XCPMSQ_ATTRS = 6, /* list of supported attribute */
/* bits (1 byte / attribute) */
/* administrative attributes */
CK_IBM_XCPMSQ_MOD_V2 = 7, /* add version two fields to */
/* module query */
CK_IBM_XCPMSQ_ATTRCOUNT = 8, /* number of supported */
/* administrative attributes */
CK_IBM_XCPMSQ_MAX = CK_IBM_XCPMSQ_ATTRCOUNT
} CK_IBM_XCPMSUBQUERY_t;
//--- selftest sub-query sub-types ------------------------------------------
typedef enum {
CK_IBM_XCPSSQ_DEFAULT = 0, /* run non-failing POST tests */
CK_IBM_XCPSSQ_POST_F = 1, /* run failing POST tests */
} CK_IBM_XCPSSUBQUERY_t;
// byte sizes of queries which are not represented as structures
#define XCP_MSQ_FNLIST_SIZE 16
#define XCP_XCPMSQ_FNS_SIZE 1
#define XCP_XCPMSQ_ATTRCOUNT_SIZE 4
#define CK_IBM_XCP_HOSTQ_IDX 0xff000000 /* host-only queries index, min. */
#define CK_IBM_XCPHQ_COUNT 0xff000000 /* number of host-query indexes */
/* including this type itself */
#define CK_IBM_XCPHQ_VERSION 0xff000001 /* host-specific package version */
/* such as packaging library ID */
#define CK_IBM_XCPHQ_VERSION_HASH 0xff000002
/* assumed-unique identifier of */
/* host code, such as version- */
/* identifying cryptographic hash*/
/* (library signature field...) */
#define CK_IBM_XCPHQ_DIAGS 0xff000003 /* host code diagnostic level */
/* 0 if non-diagnostics host code*/
#define CK_IBM_XCPHQ_HVERSION 0xff000004 /* human-readable host version */
/* identification (recommended: */
/* UTF-8 string) */
#define CK_IBM_XCPHQ_TGT_MODE 0xff000005 /* host targeting modes */
/* returns supported target modes*/
/* as bitmask */
/* if not available only compat */
/* target mode is in use */
/* See CK_IBM_XCPHQ_TGT_MODES_t */