1.0 Introduction
This article describes the functions and mechanisms supported by the PKCS#11 library.
2.0 Assumptions for PKCS11 library
The following are some assumptions for the PKCS#11 library:
There are 32 slots in Fortanix HSM, and all have a token that is already initialized.
C_InitTokenshould fail, and the token PIN cannot be changed. You must use the Fortanix-provided authorization key as the PIN.Multiple slots can be advantageous when dealing with multiple groups or endpoints. Basically, you can specify a separate config or pin for each slot during
C_Login. Of course, you can always useC_LoginandC_Logoutwith a single slot, but multiple slots can allow you to do the same concurrently.
Nobody can log in as a Security Officer (SO). Fortanix returns
CKR_PIN_INCORRECTwhen someone tries to log in as an SO.Session objects are deleted when the session is closed, but if the session is terminated in between, session objects will persist in the backend.
All objects are created as private. Fortanix does not support the creation of public objects.
Key handles are per-session and cannot be reused across sessions.
If
C_Digestis called beforeC_Login, we use the hashing functions from the OpenSSL library to compute the digest locally.
3.0 Supported Mechanisms
The following are the supported mechanisms for the PKCS#11 library:
CKM_AES_CBCCKM_AES_CBC_ENCRYPT_DATACKM_AES_CBC_PADCKM_AES_CFB128CKM_AES_CMACCKM_AES_ECBCKM_AES_ECB_ENCRYPT_DATACKM_AES_GCMCKM_AES_KEY_GENCKM_AES_OFBCKM_DES2_KEY_GENCKM_DES3_CBCCKM_DES3_CBC_ENCRYPT_DATACKM_DES3_CBC_PADCKM_DES3_ECBCKM_DES3_ECB_ENCRYPT_DATACKM_DES3_KEY_GENCKM_DES_CBCCKM_DES_CBC_ENCRYPT_DATACKM_DES_CBC_PADCKM_DES_CFB64CKM_DES_ECBCKM_DES_ECB_ENCRYPT_DATACKM_DES_KEY_GENCKM_DES_OFB64CKM_ECDH1_DERIVECKM_ECDSACKM_ECDSA_KEY_PAIR_GENCKM_ECDSA_SHA224CKM_ECDSA_SHA256CKM_ECDSA_SHA384CKM_ECDSA_SHA512CKM_EC_EDWARDS_KEY_PAIR_GENCKM_EDDSACKM_GENERIC_SECRET_KEY_GENCKM_RSA_PKCSCKM_RSA_PKCS_KEY_PAIR_GENCKM_RSA_PKCS_OAEPCKM_RSA_PKCS_PSSCKM_RSA_X_509CKM_SHA_1CKM_SHA_1_HMACCKM_SHA1_RSA_PKCSCKM_SHA1_RSA_PKCS_PSSCKM_SHA224CKM_SHA224_HMACCKM_SHA224_RSA_PKCSCKM_SHA224_RSA_PKCS_PSSCKM_SHA256CKM_SHA256_HMACCKM_SHA256_RSA_PKCSCKM_SHA256_RSA_PKCS_PSSCKM_SHA384CKM_SHA384_HMACCKM_SHA384_RSA_PKCSCKM_SHA384_RSA_PKCS_PSSCKM_SHA512CKM_SHA512_HMACCKM_SHA512_RSA_PKCSCKM_SHA512_RSA_PKCS_PSSCKM_RSA_X9_31_KEY_PAIR_GEN
4.0 Exposed Functions
The following table describes the PKCS#11 functions and whether they are supported in a regular Fortanix-Data-Security-Manager (DSM) group:
FUNCTIONS | SUPPORT AGAINST REGULAR DSM GROUPS (non-external groups) |
|---|---|
General Purpose Functions
| All supported |
Slot and Token Management Functions
|
|
Session Management Functions
| All supported except and |
Object Management Functions
| All supported except and |
Encryption/Decryption Functions
| All supported. |
Message Digesting Functions
| All supported except |
Sign and Verify Functions
| All supported except
|
Dual Purpose Functions
| None supported |
Key Management Functions
| All supported |
RNG Functions
| All supported |
Parallel Function Management Functions
| None supported |
5.0 Functions Not Supported
The PKCS#11 library does not support the following functions:
C_AsyncCompleteC_AsyncGetIDC_AsyncJoinC_CancelFunctionC_CopyObjectC_DecapsulateKeyC_DecryptDigestUpdateC_DecryptMessageC_DecryptMessageBeginC_DecryptMessageNextC_DecryptVerifyUpdateC_DigestEncryptUpdateC_DigestKeyC_EncapsulateKeyC_EncryptMessageC_EncryptMessageBeginC_EncryptMessageNextC_GetFunctionStatusC_GetInterfaceC_GetInterfaceListC_GetObjectSizeC_GetOperationStateC_GetSessionValidationFlagsC_LoginUserC_MessageDecryptFinalC_MessageDecryptInitC_MessageEncryptFinalC_MessageEncryptInitC_MessageSignFinalC_MessageSignInitC_MessageVerifyFinalC_MessageVerifyInitC_SessionCancelC_SetOperationStateC_SignEncryptUpdateC_SignMessageC_SignMessageBeginC_SignMessageNextC_SignRecoverC_SignRecoverInitC_UnwrapKeyAuthenticatedC_VerifyMessageC_VerifyMessageBeginC_VerifyMessageNextC_VerifyRecoverC_VerifyRecoverInitC_VerifySignatureC_VerifySignatureFinalC_VerifySignatureInitC_VerifySignatureUpdateC_WaitForSlotEventC_WrapKeyAuthenticated
6.0 Supported Attributes
The following are the supported attributes for the PKCS#11 library:
CKA_IDCKA_LABELCKA_CLASSCKA_TOKENCKA_VALUECKA_VALUE_LENCKA_PRIVATECKA_EXTRACTABLECKA_NEVER_EXTRACTABLECKA_SENSITIVECKA_ALWAYS_SENSITIVECKA_KEY_TYPECKA_MODULUSCKA_MODULUS_BITSCKA_PUBLIC_EXPONENTCKA_EC_PARAMSCKA_EC_POINTCKA_ISSUERCKA_SERIAL_NUMBERCKA_SUBJECTCKA_ALWAYS_AUTHENTICATECKA_CERTIFICATE_TYPECKA_ENCRYPTCKA_DECRYPTCKA_SIGNCKA_VERIFYCKA_DERIVECKA_WRAPCKA_UNWRAPCKA_MODIFIABLECKA_DESTROYABLECKA_APPLICATIONCKA_START_DATECKA_END_DATECKA_LOCALCKA_KEY_GEN_MECHANISMCKA_OBJECT_IDCKA_PUBLIC_KEY_INFO