Skip to content

Commit 81ae20f

Browse files
wiktor-kwiktor-k
authored
Merge pull request #259 from jacobprudhomme/add-sha-key-gen
Feat: Add SHA key generation mechanisms
2 parents 3e64198 + 236392d commit 81ae20f

File tree

2 files changed

+103
-15
lines changed

2 files changed

+103
-15
lines changed

‎cryptoki/src/mechanism/mod.rs

+58
Original file line numberDiff line numberDiff line change
@@ -264,6 +264,8 @@ impl MechanismType {
264264
pub const SHA512_RSA_PKCS_PSS: MechanismType = MechanismType {
265265
val: CKM_SHA512_RSA_PKCS_PSS,
266266
};
267+
268+
// SHAn-HMAC
267269
/// SHA1-HMAC mechanism
268270
pub const SHA1_HMAC: MechanismType = MechanismType {
269271
val: CKM_SHA_1_HMAC,
@@ -284,6 +286,29 @@ impl MechanismType {
284286
pub const SHA512_HMAC: MechanismType = MechanismType {
285287
val: CKM_SHA512_HMAC,
286288
};
289+
290+
// SHA-n key generation (for use with the corresponding HMAC mechanism)
291+
/// SHA-1 key generation mechanism
292+
pub const SHA1_KEY_GEN: MechanismType = MechanismType {
293+
val: CKM_SHA_1_KEY_GEN,
294+
};
295+
/// SHA-224 key generation mechanism
296+
pub const SHA224_KEY_GEN: MechanismType = MechanismType {
297+
val: CKM_SHA224_KEY_GEN,
298+
};
299+
/// SHA-256 key generation mechanism
300+
pub const SHA256_KEY_GEN: MechanismType = MechanismType {
301+
val: CKM_SHA256_KEY_GEN,
302+
};
303+
/// SHA-384 key generation mechanism
304+
pub const SHA384_KEY_GEN: MechanismType = MechanismType {
305+
val: CKM_SHA384_KEY_GEN,
306+
};
307+
/// SHA-512 key generation mechanism
308+
pub const SHA512_KEY_GEN: MechanismType = MechanismType {
309+
val: CKM_SHA512_KEY_GEN,
310+
};
311+
287312
/// GENERIC-SECRET-KEY-GEN mechanism
288313
pub const GENERIC_SECRET_KEY_GEN: MechanismType = MechanismType {
289314
val: CKM_GENERIC_SECRET_KEY_GEN,
@@ -420,6 +445,7 @@ impl MechanismType {
420445
CKM_SHA_1 => String::from(stringify!(CKM_SHA_1)),
421446
CKM_SHA_1_HMAC => String::from(stringify!(CKM_SHA_1_HMAC)),
422447
CKM_SHA_1_HMAC_GENERAL => String::from(stringify!(CKM_SHA_1_HMAC_GENERAL)),
448+
CKM_SHA_1_KEY_GEN => String::from(stringify!(CKM_SHA_1_KEY_GEN)),
423449
CKM_RIPEMD128 => String::from(stringify!(CKM_RIPEMD128)),
424450
CKM_RIPEMD128_HMAC => String::from(stringify!(CKM_RIPEMD128_HMAC)),
425451
CKM_RIPEMD128_HMAC_GENERAL => String::from(stringify!(CKM_RIPEMD128_HMAC_GENERAL)),
@@ -429,12 +455,15 @@ impl MechanismType {
429455
CKM_SHA256 => String::from(stringify!(CKM_SHA256)),
430456
CKM_SHA256_HMAC => String::from(stringify!(CKM_SHA256_HMAC)),
431457
CKM_SHA256_HMAC_GENERAL => String::from(stringify!(CKM_SHA256_HMAC_GENERAL)),
458+
CKM_SHA256_KEY_GEN => String::from(stringify!(CKM_SHA256_KEY_GEN)),
432459
CKM_SHA384 => String::from(stringify!(CKM_SHA384)),
433460
CKM_SHA384_HMAC => String::from(stringify!(CKM_SHA384_HMAC)),
434461
CKM_SHA384_HMAC_GENERAL => String::from(stringify!(CKM_SHA384_HMAC_GENERAL)),
462+
CKM_SHA384_KEY_GEN => String::from(stringify!(CKM_SHA384_KEY_GEN)),
435463
CKM_SHA512 => String::from(stringify!(CKM_SHA512)),
436464
CKM_SHA512_HMAC => String::from(stringify!(CKM_SHA512_HMAC)),
437465
CKM_SHA512_HMAC_GENERAL => String::from(stringify!(CKM_SHA512_HMAC_GENERAL)),
466+
CKM_SHA512_KEY_GEN => String::from(stringify!(CKM_SHA512_KEY_GEN)),
438467
CKM_SECURID_KEY_GEN => String::from(stringify!(CKM_SECURID_KEY_GEN)),
439468
CKM_SECURID => String::from(stringify!(CKM_SECURID)),
440469
CKM_HOTP_KEY_GEN => String::from(stringify!(CKM_HOTP_KEY_GEN)),
@@ -661,6 +690,7 @@ impl MechanismType {
661690
CKM_SHA224_HMAC_GENERAL => String::from(stringify!(CKM_SHA224_HMAC_GENERAL)),
662691
CKM_SHA224_RSA_PKCS => String::from(stringify!(CKM_SHA224_RSA_PKCS)),
663692
CKM_SHA224_RSA_PKCS_PSS => String::from(stringify!(CKM_SHA224_RSA_PKCS_PSS)),
693+
CKM_SHA224_KEY_GEN => String::from(stringify!(CKM_SHA224_KEY_GEN)),
664694
CKM_SHA224_KEY_DERIVATION => String::from(stringify!(CKM_SHA224_KEY_DERIVATION)),
665695
CKM_CAMELLIA_ECB => String::from(stringify!(CKM_CAMELLIA_ECB)),
666696
CKM_CAMELLIA_CBC => String::from(stringify!(CKM_CAMELLIA_CBC)),
@@ -760,6 +790,11 @@ impl TryFrom<CK_MECHANISM_TYPE> for MechanismType {
760790
CKM_SHA256_HMAC => Ok(MechanismType::SHA256_HMAC),
761791
CKM_SHA384_HMAC => Ok(MechanismType::SHA384_HMAC),
762792
CKM_SHA512_HMAC => Ok(MechanismType::SHA512_HMAC),
793+
CKM_SHA_1_KEY_GEN => Ok(MechanismType::SHA1_KEY_GEN),
794+
CKM_SHA224_KEY_GEN => Ok(MechanismType::SHA224_KEY_GEN),
795+
CKM_SHA256_KEY_GEN => Ok(MechanismType::SHA256_KEY_GEN),
796+
CKM_SHA384_KEY_GEN => Ok(MechanismType::SHA384_KEY_GEN),
797+
CKM_SHA512_KEY_GEN => Ok(MechanismType::SHA512_KEY_GEN),
763798
CKM_GENERIC_SECRET_KEY_GEN => Ok(MechanismType::GENERIC_SECRET_KEY_GEN),
764799
CKM_HKDF_KEY_GEN => Ok(MechanismType::HKDF_KEY_GEN),
765800
CKM_HKDF_DERIVE => Ok(MechanismType::HKDF_DERIVE),
@@ -963,6 +998,18 @@ pub enum Mechanism<'a> {
963998
/// SHA512-HMAC mechanism
964999
Sha512Hmac,
9651000

1001+
// SHA-n key generation (for use with the corresponding HMAC mechanism)
1002+
/// SHA-1 key generation mechanism
1003+
Sha1KeyGen,
1004+
/// SHA-224 key generation mechanism
1005+
Sha224KeyGen,
1006+
/// SHA-256 key generation mechanism
1007+
Sha256KeyGen,
1008+
/// SHA-384 key generation mechanism
1009+
Sha384KeyGen,
1010+
/// SHA-512 key generation mechanism
1011+
Sha512KeyGen,
1012+
9661013
/// GENERIC-SECRET-KEY-GEN mechanism
9671014
GenericSecretKeyGen,
9681015

@@ -1043,6 +1090,12 @@ impl Mechanism<'_> {
10431090
Mechanism::Sha384Hmac => MechanismType::SHA384_HMAC,
10441091
Mechanism::Sha512Hmac => MechanismType::SHA512_HMAC,
10451092

1093+
Mechanism::Sha1KeyGen => MechanismType::SHA1_KEY_GEN,
1094+
Mechanism::Sha224KeyGen => MechanismType::SHA224_KEY_GEN,
1095+
Mechanism::Sha256KeyGen => MechanismType::SHA256_KEY_GEN,
1096+
Mechanism::Sha384KeyGen => MechanismType::SHA384_KEY_GEN,
1097+
Mechanism::Sha512KeyGen => MechanismType::SHA512_KEY_GEN,
1098+
10461099
Mechanism::GenericSecretKeyGen => MechanismType::GENERIC_SECRET_KEY_GEN,
10471100

10481101
Mechanism::HkdfKeyGen => MechanismType::HKDF_KEY_GEN,
@@ -1139,6 +1192,11 @@ impl From<&Mechanism<'_>> for CK_MECHANISM {
11391192
| Mechanism::Sha256Hmac
11401193
| Mechanism::Sha384Hmac
11411194
| Mechanism::Sha512Hmac
1195+
| Mechanism::Sha1KeyGen
1196+
| Mechanism::Sha224KeyGen
1197+
| Mechanism::Sha256KeyGen
1198+
| Mechanism::Sha384KeyGen
1199+
| Mechanism::Sha512KeyGen
11421200
| Mechanism::GenericSecretKeyGen
11431201
| Mechanism::HkdfKeyGen => CK_MECHANISM {
11441202
mechanism,

‎cryptoki/tests/basic.rs

+45-15
Original file line numberDiff line numberDiff line change
@@ -2183,12 +2183,18 @@ fn sign_verify_sha1_hmac() -> TestResult {
21832183
Attribute::Sensitive(true),
21842184
Attribute::Sign(true),
21852185
Attribute::Verify(true),
2186-
Attribute::KeyType(KeyType::GENERIC_SECRET),
2187-
Attribute::Class(ObjectClass::SECRET_KEY),
21882186
Attribute::ValueLen(256.into()),
21892187
];
21902188

2191-
let private = session.generate_key(&Mechanism::GenericSecretKeyGen, &priv_key_template)?;
2189+
let private = session.generate_key(
2190+
/* FIXME: SoftHSM does not yet support SHA-n key gen mechanisms (see https://github.com/softhsm/SoftHSMv2/issues/604) */
2191+
if is_softhsm() {
2192+
&Mechanism::GenericSecretKeyGen
2193+
} else {
2194+
&Mechanism::Sha1KeyGen
2195+
},
2196+
&priv_key_template,
2197+
)?;
21922198

21932199
let data = vec![0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
21942200

@@ -2213,12 +2219,18 @@ fn sign_verify_sha224_hmac() -> TestResult {
22132219
Attribute::Sensitive(true),
22142220
Attribute::Sign(true),
22152221
Attribute::Verify(true),
2216-
Attribute::KeyType(KeyType::GENERIC_SECRET),
2217-
Attribute::Class(ObjectClass::SECRET_KEY),
22182222
Attribute::ValueLen(256.into()),
22192223
];
22202224

2221-
let private = session.generate_key(&Mechanism::GenericSecretKeyGen, &priv_key_template)?;
2225+
let private = session.generate_key(
2226+
/* FIXME: SoftHSM does not yet support SHA-n key gen mechanisms (see https://github.com/softhsm/SoftHSMv2/issues/604) */
2227+
if is_softhsm() {
2228+
&Mechanism::GenericSecretKeyGen
2229+
} else {
2230+
&Mechanism::Sha224KeyGen
2231+
},
2232+
&priv_key_template,
2233+
)?;
22222234

22232235
let data = vec![0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
22242236

@@ -2243,12 +2255,18 @@ fn sign_verify_sha256_hmac() -> TestResult {
22432255
Attribute::Sensitive(true),
22442256
Attribute::Sign(true),
22452257
Attribute::Verify(true),
2246-
Attribute::KeyType(KeyType::GENERIC_SECRET),
2247-
Attribute::Class(ObjectClass::SECRET_KEY),
22482258
Attribute::ValueLen(256.into()),
22492259
];
22502260

2251-
let private = session.generate_key(&Mechanism::GenericSecretKeyGen, &priv_key_template)?;
2261+
let private = session.generate_key(
2262+
/* FIXME: SoftHSM does not yet support SHA-n key gen mechanisms (see https://github.com/softhsm/SoftHSMv2/issues/604) */
2263+
if is_softhsm() {
2264+
&Mechanism::GenericSecretKeyGen
2265+
} else {
2266+
&Mechanism::Sha256KeyGen
2267+
},
2268+
&priv_key_template,
2269+
)?;
22522270

22532271
let data = vec![0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
22542272

@@ -2273,12 +2291,18 @@ fn sign_verify_sha384_hmac() -> TestResult {
22732291
Attribute::Sensitive(true),
22742292
Attribute::Sign(true),
22752293
Attribute::Verify(true),
2276-
Attribute::KeyType(KeyType::GENERIC_SECRET),
2277-
Attribute::Class(ObjectClass::SECRET_KEY),
22782294
Attribute::ValueLen(256.into()),
22792295
];
22802296

2281-
let private = session.generate_key(&Mechanism::GenericSecretKeyGen, &priv_key_template)?;
2297+
let private = session.generate_key(
2298+
/* FIXME: SoftHSM does not yet support SHA-n key gen mechanisms (see https://github.com/softhsm/SoftHSMv2/issues/604) */
2299+
if is_softhsm() {
2300+
&Mechanism::GenericSecretKeyGen
2301+
} else {
2302+
&Mechanism::Sha384KeyGen
2303+
},
2304+
&priv_key_template,
2305+
)?;
22822306

22832307
let data = vec![0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
22842308

@@ -2303,12 +2327,18 @@ fn sign_verify_sha512_hmac() -> TestResult {
23032327
Attribute::Sensitive(true),
23042328
Attribute::Sign(true),
23052329
Attribute::Verify(true),
2306-
Attribute::KeyType(KeyType::GENERIC_SECRET),
2307-
Attribute::Class(ObjectClass::SECRET_KEY),
23082330
Attribute::ValueLen(256.into()),
23092331
];
23102332

2311-
let private = session.generate_key(&Mechanism::GenericSecretKeyGen, &priv_key_template)?;
2333+
let private = session.generate_key(
2334+
/* FIXME: SoftHSM does not yet support SHA-n key gen mechanisms (see https://github.com/softhsm/SoftHSMv2/issues/604) */
2335+
if is_softhsm() {
2336+
&Mechanism::GenericSecretKeyGen
2337+
} else {
2338+
&Mechanism::Sha512KeyGen
2339+
},
2340+
&priv_key_template,
2341+
)?;
23122342

23132343
let data = vec![0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF];
23142344

0 commit comments

Comments
 (0)