From e470a5dafb078f4c1ab4ca9d9cf9b11e2f51ac92 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 6 Aug 2026 17:37:14 -0400 Subject: [PATCH 1/7] Modularize algorithm registration Move the algorithm registration logic from a single, large switch statement in `provider.c` to individual module files (ciphers, digests, signatures, etc.). A new `registration.c` file is introduced to map PKCS#11 mechanisms to internal table IDs, allowing each module to independently evaluate and register its supported algorithms. This significantly improves code maintainability, decouples algorithm implementations from the core provider initialization, and makes adding future algorithms much cleaner. Assisted-by: Gemini:Gemini Pro Latest Signed-off-by: Simo Sorce --- src/asymmetric_cipher.c | 29 ++ src/asymmetric_cipher.h | 10 +- src/cipher.c | 266 +++++++++- src/cipher.h | 96 +--- src/decoder.c | 141 ++++++ src/decoder.h | 43 +- src/digests.c | 140 +++++- src/digests.h | 53 +- src/encoder.c | 626 ++++++++++++++++++++++++ src/encoder.h | 60 +-- src/exchange.c | 85 +++- src/exchange.h | 19 +- src/kdf.c | 52 +- src/kdf.h | 12 +- src/kem.c | 56 ++- src/kem.h | 9 +- src/kmgmt/common.c | 154 ++++++ src/kmgmt/hkdf.c | 2 + src/kmgmt/internal.h | 34 ++ src/kmgmt/keymgmt.h | 35 +- src/kmgmt/rsa.c | 1 + src/kmgmt/skey.c | 46 +- src/kmgmt/skey.h | 8 +- src/meson.build | 1 + src/obj/internal.h | 1 + src/obj/keymgmt.c | 1 + src/provider.c | 1011 ++++++--------------------------------- src/provider.h | 264 +--------- src/random.c | 35 +- src/random.h | 9 +- src/registration.c | 665 +++++++++++++++++++++++++ src/registration.h | 459 ++++++++++++++++++ src/sig/ecdsa.c | 7 +- src/sig/eddsa.c | 13 +- src/sig/internal.h | 55 +++ src/sig/mldsa.c | 9 +- src/sig/rsasig.c | 7 +- src/sig/signature.c | 312 ++++++++++++ src/sig/signature.h | 77 +-- src/sig/slhdsa.c | 5 +- src/store.c | 23 + src/store.h | 11 +- 42 files changed, 3362 insertions(+), 1580 deletions(-) create mode 100644 src/registration.c create mode 100644 src/registration.h diff --git a/src/asymmetric_cipher.c b/src/asymmetric_cipher.c index ecb39b7e..6ab26437 100644 --- a/src/asymmetric_cipher.c +++ b/src/asymmetric_cipher.c @@ -2,11 +2,15 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "asymmetric_cipher.h" #include #include "openssl/prov_ssl.h" #include "openssl/rsa.h" #include "openssl/rand.h" +#define DISPATCH_RSAENC_FN(name) \ + DECL_DISPATCH_FUNC(asym_cipher, p11prov_rsaenc, name) + DISPATCH_RSAENC_FN(newctx); DISPATCH_RSAENC_FN(freectx); DISPATCH_RSAENC_FN(dupctx); @@ -751,6 +755,9 @@ static const OSSL_PARAM *p11prov_rsaenc_settable_ctx_params(void *ctx, return params; } +#define DISPATCH_RSAENC_ELEM(NAME, name) \ + { OSSL_FUNC_ASYM_CIPHER_##NAME, (void (*)(void))p11prov_rsaenc_##name } + const OSSL_DISPATCH p11prov_rsa_asym_cipher_functions[] = { DISPATCH_RSAENC_ELEM(NEWCTX, newctx), DISPATCH_RSAENC_ELEM(FREECTX, freectx), @@ -764,3 +771,25 @@ const OSSL_DISPATCH p11prov_rsa_asym_cipher_functions[] = { DISPATCH_RSAENC_ELEM(SET_CTX_PARAMS, set_ctx_params), DISPATCH_RSAENC_ELEM(SETTABLE_CTX_PARAMS, settable_ctx_params), }; + +const OSSL_ALGORITHM asym_cipher_algorithms[1] = { + DEFAULT_ALGORITHM(RSA, p11prov_rsa_asym_cipher_functions), +}; + +CK_RV p11prov_register_asym_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + OSSL_ALGORITHM *algs = NULL; + + if (mechs[TBID_RSA_PKCS] || mechs[TBID_RSA_PKCS_OAEP] + || mechs[TBID_RSA_X_509] || mechs[TBID_RSA_X9_31]) { + algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * 2); + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + p11prov_assign_alg(&algs[0], asym_cipher_algorithms, 0, + fips_property ? P11PROV_FIPS_PROPERTIES : NULL); + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_ASYM_CIPHER, algs); +} diff --git a/src/asymmetric_cipher.h b/src/asymmetric_cipher.h index e3825c01..54d11554 100644 --- a/src/asymmetric_cipher.h +++ b/src/asymmetric_cipher.h @@ -4,13 +4,7 @@ #ifndef _ASYM_CIPH_H #define _ASYM_CIPH_H -/* rsa encrypt/decrypt */ -#define DISPATCH_RSAENC_FN(name) \ - DECL_DISPATCH_FUNC(asym_cipher, p11prov_rsaenc, name) -#define DISPATCH_RSAENC_ELEM(NAME, name) \ - { \ - OSSL_FUNC_ASYM_CIPHER_##NAME, (void (*)(void))p11prov_rsaenc_##name \ - } -extern const OSSL_DISPATCH p11prov_rsa_asym_cipher_functions[]; +CK_RV p11prov_register_asym_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _ASYM_CIPH_H */ diff --git a/src/cipher.c b/src/cipher.c index 4ccd3ad7..357701a4 100644 --- a/src/cipher.c +++ b/src/cipher.c @@ -28,6 +28,29 @@ #define IVSIZE_ofb AESBLOCK #define IVSIZE_poly1305 12 +#define MODE_modes_mask 0x00FF +#define MODE_flags_mask 0xFF00 + +#define MODE_flag_aead 0x0100 +#define MODE_flag_custom_iv 0x0200 +#define MODE_flag_cts 0x0400 +#define MODE_flag_tls1_mb 0x0800 +#define MODE_flag_rand_key 0x1000 + +#define MODE_ecb 0x01 +#define MODE_cbc 0x02 +#define MODE_ofb 0x04 +#define MODE_cfb 0x08 +#define MODE_cfb1 MODE_cfb +#define MODE_cfb8 MODE_cfb +#define MODE_ctr 0x10 +#define MODE_cts MODE_flag_cts | MODE_cbc +#define MODE_gcm 0x20 +#define MODE_poly1305 0x21 + +#define DISPATCH_CIPHER_FN(alg, name) \ + DECL_DISPATCH_FUNC(cipher, p11prov_##alg, name) + DISPATCH_CIPHER_FN(cipher, freectx); DISPATCH_CIPHER_FN(common, dupctx); DISPATCH_CIPHER_FN(cipher, encrypt_init); @@ -190,9 +213,6 @@ static int p11prov_cipher_get_params(OSSL_PARAM params[], unsigned int mode, return RET_OSSL_OK; } -#define p11prov_aes_get_params p11prov_common_get_params -#define p11prov_chacha20_get_params p11prov_common_get_params - static int p11prov_common_get_params(OSSL_PARAM params[], int size, size_t ivsize, int mode, CK_ULONG mechanism) @@ -239,6 +259,9 @@ static int p11prov_common_get_params(OSSL_PARAM params[], int size, blocksize); }; +#define p11prov_aes_get_params p11prov_common_get_params +#define p11prov_chacha20_get_params p11prov_common_get_params + static void p11prov_cipher_free_mech(CK_MECHANISM_PTR mech) { if (!mech->pParameter) { @@ -832,7 +855,7 @@ static CK_RV tls_aead_get_data(CK_MECHANISM_PTR mech, data_buffer *explicitiv, { /* In TLS 1.2, OpenSSL provides a buffer with this layout: * [explicit IV] [plaintext] [authentication tag] - * + * * In the encryption case, it expects the provider to fill in * the explicit IV and tag, and to overwrite the plaintext with * ciphertext. Explicit IV can be either: @@ -1672,6 +1695,49 @@ static const OSSL_PARAM *p11prov_common_settable_ctx_params(void *vctx, return NULL; } +#define DISPATCH_TABLE_CIPHER_FN(cipher, size, mode, mechanism) \ + static void *p11prov_##cipher##size##mode##_newctx(void *provctx) \ + { \ + return p11prov_cipher_newctx(provctx, size, IVSIZE_##mode, mechanism); \ + } \ + static int p11prov_##cipher##size##mode##_get_params(OSSL_PARAM params[]) \ + { \ + return p11prov_##cipher##_get_params(params, size, IVSIZE_##mode, \ + MODE_##mode, mechanism); \ + } \ + const OSSL_DISPATCH p11prov_##cipher##size##mode##_functions[] = { \ + { OSSL_FUNC_CIPHER_NEWCTX, \ + (void (*)(void))p11prov_##cipher##size##mode##_newctx }, \ + { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))p11prov_cipher_freectx }, \ + { OSSL_FUNC_CIPHER_DUPCTX, \ + (void (*)(void))p11prov_##cipher##_dupctx }, \ + { OSSL_FUNC_CIPHER_ENCRYPT_INIT, \ + (void (*)(void))p11prov_cipher_encrypt_init }, \ + { OSSL_FUNC_CIPHER_DECRYPT_INIT, \ + (void (*)(void))p11prov_cipher_decrypt_init }, \ + { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))p11prov_cipher_update }, \ + { OSSL_FUNC_CIPHER_FINAL, (void (*)(void))p11prov_cipher_final }, \ + { OSSL_FUNC_CIPHER_CIPHER, \ + (void (*)(void))p11prov_##cipher##_cipher }, \ + { OSSL_FUNC_CIPHER_GET_PARAMS, \ + (void (*)(void))p11prov_##cipher##size##mode##_get_params }, \ + { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_get_ctx_params }, \ + { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_set_ctx_params }, \ + { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \ + (void (*)(void))p11prov_cipher_gettable_params }, \ + { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_gettable_ctx_params }, \ + { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \ + (void (*)(void))p11prov_##cipher##_settable_ctx_params }, \ + { OSSL_FUNC_CIPHER_ENCRYPT_SKEY_INIT, \ + (void (*)(void))p11prov_cipher_encrypt_skey_init }, \ + { OSSL_FUNC_CIPHER_DECRYPT_SKEY_INIT, \ + (void (*)(void))p11prov_cipher_decrypt_skey_init }, \ + OSSL_DISPATCH_END \ + }; + DISPATCH_TABLE_CIPHER_FN(aes, 128, ecb, CKM_AES_ECB); DISPATCH_TABLE_CIPHER_FN(aes, 192, ecb, CKM_AES_ECB); DISPATCH_TABLE_CIPHER_FN(aes, 256, ecb, CKM_AES_ECB); @@ -1701,4 +1767,196 @@ DISPATCH_TABLE_CIPHER_FN(aes, 192, gcm, CKM_AES_GCM); DISPATCH_TABLE_CIPHER_FN(aes, 256, gcm, CKM_AES_GCM); DISPATCH_TABLE_CIPHER_FN(chacha20, 256, poly1305, CKM_CHACHA20_POLY1305); +enum p11prov_cipher_algorithms { + P11PROV_CIPHER_AES_128_ECB = 0, + P11PROV_CIPHER_AES_192_ECB, + P11PROV_CIPHER_AES_256_ECB, + P11PROV_CIPHER_AES_128_CBC, + P11PROV_CIPHER_AES_192_CBC, + P11PROV_CIPHER_AES_256_CBC, + P11PROV_CIPHER_AES_128_OFB, + P11PROV_CIPHER_AES_192_OFB, + P11PROV_CIPHER_AES_256_OFB, + P11PROV_CIPHER_AES_128_CFB, + P11PROV_CIPHER_AES_192_CFB, + P11PROV_CIPHER_AES_256_CFB, + P11PROV_CIPHER_AES_128_CFB1, + P11PROV_CIPHER_AES_192_CFB1, + P11PROV_CIPHER_AES_256_CFB1, + P11PROV_CIPHER_AES_128_CFB8, + P11PROV_CIPHER_AES_192_CFB8, + P11PROV_CIPHER_AES_256_CFB8, + P11PROV_CIPHER_AES_128_CTR, + P11PROV_CIPHER_AES_192_CTR, + P11PROV_CIPHER_AES_256_CTR, + P11PROV_CIPHER_AES_128_CTS, + P11PROV_CIPHER_AES_192_CTS, + P11PROV_CIPHER_AES_256_CTS, + P11PROV_CIPHER_AES_128_GCM, + P11PROV_CIPHER_AES_192_GCM, + P11PROV_CIPHER_AES_256_GCM, + P11PROV_CIPHER_CHACHA20_256_POLY1305, + P11PROV_CIPHER_NUM_ALGS +}; + +const OSSL_ALGORITHM cipher_algorithms[P11PROV_CIPHER_NUM_ALGS] = { + [P11PROV_CIPHER_AES_128_ECB] = + DEFAULT_ALGORITHM(AES_128_ECB, p11prov_aes128ecb_functions), + [P11PROV_CIPHER_AES_192_ECB] = + DEFAULT_ALGORITHM(AES_192_ECB, p11prov_aes192ecb_functions), + [P11PROV_CIPHER_AES_256_ECB] = + DEFAULT_ALGORITHM(AES_256_ECB, p11prov_aes256ecb_functions), + [P11PROV_CIPHER_AES_128_CBC] = + DEFAULT_ALGORITHM(AES_128_CBC, p11prov_aes128cbc_functions), + [P11PROV_CIPHER_AES_192_CBC] = + DEFAULT_ALGORITHM(AES_192_CBC, p11prov_aes192cbc_functions), + [P11PROV_CIPHER_AES_256_CBC] = + DEFAULT_ALGORITHM(AES_256_CBC, p11prov_aes256cbc_functions), + [P11PROV_CIPHER_AES_128_OFB] = + DEFAULT_ALGORITHM(AES_128_OFB, p11prov_aes128ofb_functions), + [P11PROV_CIPHER_AES_192_OFB] = + DEFAULT_ALGORITHM(AES_192_OFB, p11prov_aes192ofb_functions), + [P11PROV_CIPHER_AES_256_OFB] = + DEFAULT_ALGORITHM(AES_256_OFB, p11prov_aes256ofb_functions), + [P11PROV_CIPHER_AES_128_CFB] = + DEFAULT_ALGORITHM(AES_128_CFB, p11prov_aes128cfb_functions), + [P11PROV_CIPHER_AES_192_CFB] = + DEFAULT_ALGORITHM(AES_192_CFB, p11prov_aes192cfb_functions), + [P11PROV_CIPHER_AES_256_CFB] = + DEFAULT_ALGORITHM(AES_256_CFB, p11prov_aes256cfb_functions), + [P11PROV_CIPHER_AES_128_CFB1] = + DEFAULT_ALGORITHM(AES_128_CFB1, p11prov_aes128cfb1_functions), + [P11PROV_CIPHER_AES_192_CFB1] = + DEFAULT_ALGORITHM(AES_192_CFB1, p11prov_aes192cfb1_functions), + [P11PROV_CIPHER_AES_256_CFB1] = + DEFAULT_ALGORITHM(AES_256_CFB1, p11prov_aes256cfb1_functions), + [P11PROV_CIPHER_AES_128_CFB8] = + DEFAULT_ALGORITHM(AES_128_CFB8, p11prov_aes128cfb8_functions), + [P11PROV_CIPHER_AES_192_CFB8] = + DEFAULT_ALGORITHM(AES_192_CFB8, p11prov_aes192cfb8_functions), + [P11PROV_CIPHER_AES_256_CFB8] = + DEFAULT_ALGORITHM(AES_256_CFB8, p11prov_aes256cfb8_functions), + [P11PROV_CIPHER_AES_128_CTR] = + DEFAULT_ALGORITHM(AES_128_CTR, p11prov_aes128ctr_functions), + [P11PROV_CIPHER_AES_192_CTR] = + DEFAULT_ALGORITHM(AES_192_CTR, p11prov_aes192ctr_functions), + [P11PROV_CIPHER_AES_256_CTR] = + DEFAULT_ALGORITHM(AES_256_CTR, p11prov_aes256ctr_functions), + [P11PROV_CIPHER_AES_128_CTS] = + DEFAULT_ALGORITHM(AES_128_CTS, p11prov_aes128cts_functions), + [P11PROV_CIPHER_AES_192_CTS] = + DEFAULT_ALGORITHM(AES_192_CTS, p11prov_aes192cts_functions), + [P11PROV_CIPHER_AES_256_CTS] = + DEFAULT_ALGORITHM(AES_256_CTS, p11prov_aes256cts_functions), + [P11PROV_CIPHER_AES_128_GCM] = + DEFAULT_ALGORITHM(AES_128_GCM, p11prov_aes128gcm_functions), + [P11PROV_CIPHER_AES_192_GCM] = + DEFAULT_ALGORITHM(AES_192_GCM, p11prov_aes192gcm_functions), + [P11PROV_CIPHER_AES_256_GCM] = + DEFAULT_ALGORITHM(AES_256_GCM, p11prov_aes256gcm_functions), + [P11PROV_CIPHER_CHACHA20_256_POLY1305] = DEFAULT_ALGORITHM( + CHACHA20_256_POLY1305, p11prov_chacha20256poly1305_functions), +}; + +CK_RV p11prov_register_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_CIPHER_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_AES_ECB]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_ECB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_ECB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_ECB, property); + } + if (mechs[TBID_AES_CBC] || mechs[TBID_AES_CBC_PAD]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CBC, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CBC, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CBC, property); + } + if (mechs[TBID_AES_OFB]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_OFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_OFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_OFB, property); + } + if (mechs[TBID_AES_CFB128]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CFB, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CFB, property); + } + if (mechs[TBID_AES_CFB1]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CFB1, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CFB1, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CFB1, property); + } + if (mechs[TBID_AES_CFB8]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CFB8, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CFB8, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CFB8, property); + } + if (mechs[TBID_AES_CTR]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CTR, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CTR, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CTR, property); + } + if (mechs[TBID_AES_CTS]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_CTS, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_CTS, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_CTS, property); + } + if (mechs[TBID_AES_GCM]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_256_GCM, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_192_GCM, property); + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_AES_128_GCM, property); + } + if (mechs[TBID_CHACHA20_POLY1305]) { + p11prov_assign_alg(&algs[i++], cipher_algorithms, + P11PROV_CIPHER_CHACHA20_256_POLY1305, property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_CIPHER, algs); +} + #endif diff --git a/src/cipher.h b/src/cipher.h index d5d7ef49..fd0cbbeb 100644 --- a/src/cipher.h +++ b/src/cipher.h @@ -5,99 +5,7 @@ #ifndef _CIPHER_H #define _CIPHER_H -#define MODE_modes_mask 0x00FF -#define MODE_flags_mask 0xFF00 - -#define MODE_flag_aead 0x0100 -#define MODE_flag_custom_iv 0x0200 -#define MODE_flag_cts 0x0400 -#define MODE_flag_tls1_mb 0x0800 -#define MODE_flag_rand_key 0x1000 - -#define MODE_ecb 0x01 -#define MODE_cbc 0x02 -#define MODE_ofb 0x04 -#define MODE_cfb 0x08 -#define MODE_cfb1 MODE_cfb -#define MODE_cfb8 MODE_cfb -#define MODE_ctr 0x10 -#define MODE_cts MODE_flag_cts | MODE_cbc -#define MODE_gcm 0x20 -#define MODE_poly1305 0x21 - -#define DISPATCH_CIPHER_FN(alg, name) \ - DECL_DISPATCH_FUNC(cipher, p11prov_##alg, name) - -#define DISPATCH_TABLE_CIPHER_FN(cipher, size, mode, mechanism) \ - static void *p11prov_##cipher##size##mode##_newctx(void *provctx) \ - { \ - return p11prov_cipher_newctx(provctx, size, IVSIZE_##mode, mechanism); \ - } \ - static int p11prov_##cipher##size##mode##_get_params(OSSL_PARAM params[]) \ - { \ - return p11prov_##cipher##_get_params(params, size, IVSIZE_##mode, \ - MODE_##mode, mechanism); \ - } \ - const OSSL_DISPATCH p11prov_##cipher##size##mode##_cipher_functions[] = { \ - { OSSL_FUNC_CIPHER_NEWCTX, \ - (void (*)(void))p11prov_##cipher##size##mode##_newctx }, \ - { OSSL_FUNC_CIPHER_FREECTX, (void (*)(void))p11prov_cipher_freectx }, \ - { OSSL_FUNC_CIPHER_DUPCTX, \ - (void (*)(void))p11prov_##cipher##_dupctx }, \ - { OSSL_FUNC_CIPHER_ENCRYPT_INIT, \ - (void (*)(void))p11prov_cipher_encrypt_init }, \ - { OSSL_FUNC_CIPHER_DECRYPT_INIT, \ - (void (*)(void))p11prov_cipher_decrypt_init }, \ - { OSSL_FUNC_CIPHER_UPDATE, (void (*)(void))p11prov_cipher_update }, \ - { OSSL_FUNC_CIPHER_FINAL, (void (*)(void))p11prov_cipher_final }, \ - { OSSL_FUNC_CIPHER_CIPHER, \ - (void (*)(void))p11prov_##cipher##_cipher }, \ - { OSSL_FUNC_CIPHER_GET_PARAMS, \ - (void (*)(void))p11prov_##cipher##size##mode##_get_params }, \ - { OSSL_FUNC_CIPHER_GET_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_get_ctx_params }, \ - { OSSL_FUNC_CIPHER_SET_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_set_ctx_params }, \ - { OSSL_FUNC_CIPHER_GETTABLE_PARAMS, \ - (void (*)(void))p11prov_cipher_gettable_params }, \ - { OSSL_FUNC_CIPHER_GETTABLE_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_gettable_ctx_params }, \ - { OSSL_FUNC_CIPHER_SETTABLE_CTX_PARAMS, \ - (void (*)(void))p11prov_##cipher##_settable_ctx_params }, \ - { OSSL_FUNC_CIPHER_ENCRYPT_SKEY_INIT, \ - (void (*)(void))p11prov_cipher_encrypt_skey_init }, \ - { OSSL_FUNC_CIPHER_DECRYPT_SKEY_INIT, \ - (void (*)(void))p11prov_cipher_decrypt_skey_init }, \ - OSSL_DISPATCH_END \ - }; - -extern const OSSL_DISPATCH p11prov_aes128ecb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192ecb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256ecb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cbc_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cbc_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cbc_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128ofb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192ofb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256ofb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cfb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cfb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cfb_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cfb1_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cfb1_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cfb1_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cfb8_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cfb8_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cfb8_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128ctr_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192ctr_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256ctr_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128cts_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192cts_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256cts_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes128gcm_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes192gcm_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_aes256gcm_cipher_functions[]; -extern const OSSL_DISPATCH p11prov_chacha20256poly1305_cipher_functions[]; +CK_RV p11prov_register_ciphers(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _CIPHER_H */ diff --git a/src/decoder.c b/src/decoder.c index 72b52630..8a34da5f 100644 --- a/src/decoder.c +++ b/src/decoder.c @@ -9,6 +9,9 @@ #include "pk11_uri.h" #include #include +#include + +#define RET_OSSL_CARRY_ON_DECODING 1 typedef struct p11prov_decoder_ctx { P11PROV_CTX *provctx; @@ -206,6 +209,17 @@ static int p11prov_pem_decoder_p11prov_der_decode( return ret; } +#define P11PROV_DER_COMMON_DECODE_FN(FORMAT_NAME, format) \ + static int p11prov_der_decoder_p11prov_##format##_decode( \ + void *inctx, OSSL_CORE_BIO *cin, int selection, \ + OSSL_CALLBACK *object_cb, void *object_cbarg, \ + OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) \ + { \ + return p11prov_der_decoder_p11prov_obj_decode( \ + FORMAT_NAME, inctx, cin, selection, object_cb, object_cbarg, \ + pw_cb, pw_cbarg); \ + } + P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_RSA, rsa) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_EC, ec) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_ED25519, ed25519) @@ -213,6 +227,21 @@ P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_ED448, ed448) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_X25519, x25519) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_X448, x448) +#define DISPATCH_BASE_DECODER_ELEM(NAME, name) \ + { OSSL_FUNC_DECODER_##NAME, (void (*)(void))p11prov_decoder_##name } +#define DISPATCH_DECODER_ELEM(NAME, type, structure, format, name) \ + { OSSL_FUNC_DECODER_##NAME, \ + (void (*)( \ + void))p11prov_##type##_decoder_##structure##_##format##_##name } +#define DISPATCH_DECODER_FN_LIST(type, structure, format) \ + const OSSL_DISPATCH \ + p11prov_##type##_decoder_##structure##_##format##_functions[] = { \ + DISPATCH_BASE_DECODER_ELEM(NEWCTX, newctx), \ + DISPATCH_BASE_DECODER_ELEM(FREECTX, freectx), \ + DISPATCH_DECODER_ELEM(DECODE, type, structure, format, decode), \ + { 0, NULL } \ + }; + DISPATCH_DECODER_FN_LIST(pem, p11prov, der); DISPATCH_DECODER_FN_LIST(der, p11prov, rsa); DISPATCH_DECODER_FN_LIST(der, p11prov, ec); @@ -220,3 +249,115 @@ DISPATCH_DECODER_FN_LIST(der, p11prov, ed25519); DISPATCH_DECODER_FN_LIST(der, p11prov, ed448); DISPATCH_DECODER_FN_LIST(der, p11prov, x25519); DISPATCH_DECODER_FN_LIST(der, p11prov, x448); + +enum p11prov_decoder_algorithms { + P11PROV_DECODER_DER, + P11PROV_DECODER_RSA, + P11PROV_DECODER_RSAPSS, + P11PROV_DECODER_EC, + P11PROV_DECODER_ED25519, + P11PROV_DECODER_ED448, + P11PROV_DECODER_X25519, + P11PROV_DECODER_X448, + P11PROV_DECODER_NUM_ALGS +}; + +#define P11PROV_NAMES_DER "DER" +#define P11PROV_DESCS_DER "DER decoder implementation in PKCS11 provider" + +#define PEM_DECODER_PROP P11PROV_DEFAULT_PROPERTIES ",input=pem" +#define DER_DECODER_PROP \ + P11PROV_DEFAULT_PROPERTIES ",input=der,structure=" P11PROV_DER_STRUCTURE + +#define PEM_DECODER_FIPS P11PROV_FIPS_PROPERTIES ",input=pem" +#define DER_DECODER_FIPS \ + P11PROV_FIPS_PROPERTIES ",input=der,structure=" P11PROV_DER_STRUCTURE + +const OSSL_ALGORITHM decoder_algorithms[P11PROV_DECODER_NUM_ALGS] = { + [P11PROV_DECODER_DER] = { + P11PROV_NAMES_DER, + PEM_DECODER_PROP, + p11prov_pem_decoder_p11prov_der_functions, + P11PROV_DESCS_DER, + }, + [P11PROV_DECODER_RSA] = { + P11PROV_NAME_RSA, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_rsa_functions, + "RSA decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_RSAPSS] = { + P11PROV_NAME_RSAPSS, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_rsa_functions, + "RSA-PSS decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_EC] = { + P11PROV_NAME_EC, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ec_functions, + "EC decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ED25519] = { + P11PROV_NAME_ED25519, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ed25519_functions, + "ED25519 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ED448] = { + P11PROV_NAME_ED448, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ed448_functions, + "ED448 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_X25519] = { + P11PROV_NAME_X25519, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_x25519_functions, + "X25519 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_X448] = { + P11PROV_NAME_X448, + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_x448_functions, + "X448 decoder implementation in PKCS11 provider", + }, +}; + +CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_DECODER_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = PEM_DECODER_FIPS; + } + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_DER, + property); + + if (fips_property) { + property = DER_DECODER_FIPS; + } + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_RSA, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_RSAPSS, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_EC, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_ED25519, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_ED448, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X25519, + property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X448, + property); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_DECODER, algs); +} diff --git a/src/decoder.h b/src/decoder.h index 57d1bf15..e8f427bb 100644 --- a/src/decoder.h +++ b/src/decoder.h @@ -4,47 +4,6 @@ #ifndef _DECODER_H #define _DECODER_H -#include - -#define RET_OSSL_CARRY_ON_DECODING 1 -#define RET_OSSL_STOP_DECODING 0 - -/* DECODERs */ -#define DISPATCH_BASE_DECODER_ELEM(NAME, name) \ - { \ - OSSL_FUNC_DECODER_##NAME, (void (*)(void))p11prov_decoder_##name \ - } -#define DISPATCH_DECODER_ELEM(NAME, type, structure, format, name) \ - { \ - OSSL_FUNC_DECODER_##NAME, \ - (void (*)( \ - void))p11prov_##type##_decoder_##structure##_##format##_##name \ - } -#define DISPATCH_DECODER_FN_LIST(type, structure, format) \ - const OSSL_DISPATCH \ - p11prov_##type##_decoder_##structure##_##format##_functions[] = { \ - DISPATCH_BASE_DECODER_ELEM(NEWCTX, newctx), \ - DISPATCH_BASE_DECODER_ELEM(FREECTX, freectx), \ - DISPATCH_DECODER_ELEM(DECODE, type, structure, format, decode), \ - { 0, NULL } \ - }; -#define P11PROV_DER_COMMON_DECODE_FN(FORMAT_NAME, format) \ - static int p11prov_der_decoder_p11prov_##format##_decode( \ - void *inctx, OSSL_CORE_BIO *cin, int selection, \ - OSSL_CALLBACK *object_cb, void *object_cbarg, \ - OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg) \ - { \ - return p11prov_der_decoder_p11prov_obj_decode( \ - FORMAT_NAME, inctx, cin, selection, object_cb, object_cbarg, \ - pw_cb, pw_cbarg); \ - } - -extern const OSSL_DISPATCH p11prov_pem_decoder_p11prov_der_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_rsa_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_ec_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_ed25519_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_ed448_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_x25519_functions[]; -extern const OSSL_DISPATCH p11prov_der_decoder_p11prov_x448_functions[]; +CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property); #endif /* _DECODER_H */ diff --git a/src/digests.c b/src/digests.c index cecca645..cb0659d0 100644 --- a/src/digests.c +++ b/src/digests.c @@ -130,6 +130,8 @@ typedef struct p11prov_digest_ctx P11PROV_DIGEST_CTX; dctx->session = CK_INVALID_HANDLE; \ return dctx; \ } +#define DISPATCH_DIGEST_COMMON_FN(name) \ + DECL_DISPATCH_FUNC(digest, p11prov_digest, name) DISPATCH_DIGEST_NEWCTX_FN(CKM_SHA_1, sha1); DISPATCH_DIGEST_NEWCTX_FN(CKM_SHA224, sha224); @@ -469,8 +471,12 @@ static const OSSL_PARAM *p11prov_digest_gettable_params(void *provctx) return digest_params; } -#define DISPATCH_FUNCTION_TABLE(digest) \ - const OSSL_DISPATCH p11prov_##digest##_digest_functions[] = { \ +#define DISPATCH_DIGEST_ELEM(digest, NAME, name) \ + { OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_##digest##_##name } +#define DISPATCH_DIGEST_COMMON(NAME, name) \ + { OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_digest_##name } +#define DISPATCH_FUNCTIONS(digest) \ + const OSSL_DISPATCH p11prov_##digest##_functions[] = { \ DISPATCH_DIGEST_ELEM(digest, NEWCTX, newctx), \ DISPATCH_DIGEST_COMMON(DUPCTX, dupctx), \ DISPATCH_DIGEST_COMMON(FREECTX, freectx), \ @@ -482,14 +488,122 @@ static const OSSL_PARAM *p11prov_digest_gettable_params(void *provctx) { 0, NULL }, \ } -DISPATCH_FUNCTION_TABLE(sha1); -DISPATCH_FUNCTION_TABLE(sha224); -DISPATCH_FUNCTION_TABLE(sha256); -DISPATCH_FUNCTION_TABLE(sha384); -DISPATCH_FUNCTION_TABLE(sha512); -DISPATCH_FUNCTION_TABLE(sha512_224); -DISPATCH_FUNCTION_TABLE(sha512_256); -DISPATCH_FUNCTION_TABLE(sha3_224); -DISPATCH_FUNCTION_TABLE(sha3_256); -DISPATCH_FUNCTION_TABLE(sha3_384); -DISPATCH_FUNCTION_TABLE(sha3_512); +DISPATCH_FUNCTIONS(sha1); +DISPATCH_FUNCTIONS(sha224); +DISPATCH_FUNCTIONS(sha256); +DISPATCH_FUNCTIONS(sha384); +DISPATCH_FUNCTIONS(sha512); +DISPATCH_FUNCTIONS(sha512_224); +DISPATCH_FUNCTIONS(sha512_256); +DISPATCH_FUNCTIONS(sha3_224); +DISPATCH_FUNCTIONS(sha3_256); +DISPATCH_FUNCTIONS(sha3_384); +DISPATCH_FUNCTIONS(sha3_512); + +enum p11prov_digest_algorithms { + P11PROV_DIGEST_SHA1 = 0, + P11PROV_DIGEST_SHA224, + P11PROV_DIGEST_SHA256, + P11PROV_DIGEST_SHA384, + P11PROV_DIGEST_SHA512, + P11PROV_DIGEST_SHA512_224, + P11PROV_DIGEST_SHA512_256, + P11PROV_DIGEST_SHA3_224, + P11PROV_DIGEST_SHA3_256, + P11PROV_DIGEST_SHA3_384, + P11PROV_DIGEST_SHA3_512, + P11PROV_DIGEST_NUM_ALGS +}; + +const OSSL_ALGORITHM digest_algorithms[P11PROV_DIGEST_NUM_ALGS] = { + [P11PROV_DIGEST_SHA1] = DEFAULT_ALGORITHM(SHA1, p11prov_sha1_functions), + [P11PROV_DIGEST_SHA224] = + DEFAULT_ALGORITHM(SHA224, p11prov_sha224_functions), + [P11PROV_DIGEST_SHA256] = + DEFAULT_ALGORITHM(SHA256, p11prov_sha256_functions), + [P11PROV_DIGEST_SHA384] = + DEFAULT_ALGORITHM(SHA384, p11prov_sha384_functions), + [P11PROV_DIGEST_SHA512] = + DEFAULT_ALGORITHM(SHA512, p11prov_sha512_functions), + [P11PROV_DIGEST_SHA512_224] = + DEFAULT_ALGORITHM(SHA512_224, p11prov_sha512_224_functions), + [P11PROV_DIGEST_SHA512_256] = + DEFAULT_ALGORITHM(SHA512_256, p11prov_sha512_256_functions), + [P11PROV_DIGEST_SHA3_224] = + DEFAULT_ALGORITHM(SHA3_224, p11prov_sha3_224_functions), + [P11PROV_DIGEST_SHA3_256] = + DEFAULT_ALGORITHM(SHA3_256, p11prov_sha3_256_functions), + [P11PROV_DIGEST_SHA3_384] = + DEFAULT_ALGORITHM(SHA3_384, p11prov_sha3_384_functions), + [P11PROV_DIGEST_SHA3_512] = + DEFAULT_ALGORITHM(SHA3_512, p11prov_sha3_512_functions), +}; + +CK_RV p11prov_register_digests(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_DIGEST_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_SHA_1]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA1, + property); + } + if (mechs[TBID_SHA224]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA224, + property); + } + if (mechs[TBID_SHA256]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA256, + property); + } + if (mechs[TBID_SHA384]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA384, + property); + } + if (mechs[TBID_SHA512]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, P11PROV_DIGEST_SHA512, + property); + } + if (mechs[TBID_SHA512_224]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA512_224, property); + } + if (mechs[TBID_SHA512_256]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA512_256, property); + } + if (mechs[TBID_SHA3_224]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_224, property); + } + if (mechs[TBID_SHA3_256]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_256, property); + } + if (mechs[TBID_SHA3_384]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_384, property); + } + if (mechs[TBID_SHA3_512]) { + p11prov_assign_alg(&algs[i++], digest_algorithms, + P11PROV_DIGEST_SHA3_512, property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_DIGEST, algs); +} diff --git a/src/digests.h b/src/digests.h index a96b7a63..47a88fbb 100644 --- a/src/digests.h +++ b/src/digests.h @@ -4,56 +4,6 @@ #ifndef _DIGESTS_H #define _DIGESTS_H -/* Digests */ -#define DISPATCH_DIGEST_COMMON_FN(name) \ - DECL_DISPATCH_FUNC(digest, p11prov_digest, name) -#define DISPATCH_DIGEST_COMMON(NAME, name) \ - { \ - OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_digest_##name \ - } -#define DISPATCH_DIGEST_FN(type, name) \ - DECL_DISPATCH_FUNC(digest, p11prov_##type, name) -#define DISPATCH_DIGEST_ELEM(digest, NAME, name) \ - { \ - OSSL_FUNC_DIGEST_##NAME, (void (*)(void))p11prov_##digest##_##name \ - } -extern const OSSL_DISPATCH p11prov_sha1_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha224_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha256_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha384_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha512_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha512_224_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha512_256_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_224_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_256_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_384_digest_functions[]; -extern const OSSL_DISPATCH p11prov_sha3_512_digest_functions[]; - -#define P11PROV_NAMES_SHA1 "SHA1:SHA-1:SSL3-SHA1:1.3.14.3.2.26" -#define P11PROV_DESCS_SHA1 "PKCS11 SHA1 Implementation" -#define P11PROV_NAMES_SHA2_224 "SHA2-224:SHA-224:SHA224:2.16.840.1.101.3.4.2.4" -#define P11PROV_DESCS_SHA2_224 "PKCS11 SHA2-224 Implementation" -#define P11PROV_NAMES_SHA2_256 "SHA2-256:SHA-256:SHA256:2.16.840.1.101.3.4.2.1" -#define P11PROV_DESCS_SHA2_256 "PKCS11 SHA2-256 Implementation" -#define P11PROV_NAMES_SHA2_384 "SHA2-384:SHA-384:SHA384:2.16.840.1.101.3.4.2.2" -#define P11PROV_DESCS_SHA2_384 "PKCS11 SHA2-384 Implementation" -#define P11PROV_NAMES_SHA2_512 "SHA2-512:SHA-512:SHA512:2.16.840.1.101.3.4.2.3" -#define P11PROV_DESCS_SHA2_512 "PKCS11 SHA2-512 Implementation" -#define P11PROV_NAMES_SHA2_512_224 \ - "SHA2-512/224:SHA-512/224:SHA512-224:2.16.840.1.101.3.4.2.5" -#define P11PROV_DESCS_SHA2_512_224 "PKCS11 SHA2-512/224 Implementation" -#define P11PROV_NAMES_SHA2_512_256 \ - "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6" -#define P11PROV_DESCS_SHA2_512_256 "PKCS11 SHA2-512/224 Implementation" -#define P11PROV_NAMES_SHA3_224 "SHA3-224:2.16.840.1.101.3.4.2.7" -#define P11PROV_DESCS_SHA3_224 "PKCS11 SHA3-224 Implementation" -#define P11PROV_NAMES_SHA3_256 "SHA3-256:2.16.840.1.101.3.4.2.8" -#define P11PROV_DESCS_SHA3_256 "PKCS11 SHA3-256 Implementation" -#define P11PROV_NAMES_SHA3_384 "SHA3-384:2.16.840.1.101.3.4.2.9" -#define P11PROV_DESCS_SHA3_384 "PKCS11 SHA3-384 Implementation" -#define P11PROV_NAMES_SHA3_512 "SHA3-512:2.16.840.1.101.3.4.2.10" -#define P11PROV_DESCS_SHA3_512 "PKCS11 SHA3-512 Implementation" - CK_RV p11prov_digest_get_block_size(CK_MECHANISM_TYPE digest, size_t *block_size); CK_RV p11prov_digest_get_digest_size(CK_MECHANISM_TYPE digest, @@ -61,4 +11,7 @@ CK_RV p11prov_digest_get_digest_size(CK_MECHANISM_TYPE digest, CK_RV p11prov_digest_get_name(CK_MECHANISM_TYPE digest, const char **name); CK_RV p11prov_digest_get_by_name(const char *name, CK_MECHANISM_TYPE *digest); +CK_RV p11prov_register_digests(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); + #endif /* _DIGESTS_H */ diff --git a/src/encoder.c b/src/encoder.c index 50999e0f..3fa9b2e5 100644 --- a/src/encoder.c +++ b/src/encoder.c @@ -2,11 +2,27 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "encoder.h" #include "pk11_uri.h" #include #include #include +#define DISPATCH_TEXT_ENCODER_ELEM(NAME, type, name) \ + { OSSL_FUNC_ENCODER_##NAME, \ + (void (*)(void))p11prov_##type##_encoder_##name } +#define DISPATCH_BASE_ENCODER_FN(name) \ + DECL_DISPATCH_FUNC(encoder, p11prov_encoder, name) +#define DISPATCH_BASE_ENCODER_ELEM(NAME, name) \ + { OSSL_FUNC_ENCODER_##NAME, (void (*)(void))p11prov_encoder_##name } +#define DISPATCH_ENCODER_FN(type, structure, format, name) \ + DECL_DISPATCH_FUNC(encoder, \ + p11prov_##type##_encoder_##structure##_##format, name) +#define DISPATCH_ENCODER_ELEM(NAME, type, structure, format, name) \ + { OSSL_FUNC_ENCODER_##NAME, \ + (void (*)( \ + void))p11prov_##type##_encoder_##structure##_##format##_##name } + static int p11prov_print_bn(BIO *out, const OSSL_PARAM *p, const char *str, int indent) { @@ -1692,3 +1708,613 @@ const OSSL_DISPATCH p11prov_mlkem_encoder_text_functions[] = { DISPATCH_TEXT_ENCODER_ELEM(ENCODE, common, encode_text), { 0, NULL }, }; + +#define OUTTEXT "output=text" +#define OUTDER "output=der" +#define OUTPEM "output=pem" +#define STRPKCS1 "structure=pkcs1" +#define STRSPKI "structure=SubjectPublicKeyInfo" +#define STRPRIV "structure=PrivateKeyInfo" + +#define TEXT_PROP P11PROV_DEFAULT_PROPERTIES "," OUTTEXT +#define DER_PKCS1_PROP P11PROV_DEFAULT_PROPERTIES "," OUTDER "," STRPKCS1 +#define PEM_PKCS1_PROP P11PROV_DEFAULT_PROPERTIES "," OUTPEM "," STRPKCS1 +#define DER_SPKI_PROP P11PROV_DEFAULT_PROPERTIES "," OUTDER "," STRSPKI +#define PEM_SPKI_PROP P11PROV_DEFAULT_PROPERTIES "," OUTPEM "," STRSPKI +#define PEM_PRIVK_PROP P11PROV_DEFAULT_PROPERTIES "," OUTPEM "," STRPRIV + +#define TEXT_FIPS P11PROV_FIPS_PROPERTIES "," OUTTEXT +#define DER_PKCS1_FIPS P11PROV_FIPS_PROPERTIES "," OUTDER "," STRPKCS1 +#define PEM_PKCS1_FIPS P11PROV_FIPS_PROPERTIES "," OUTPEM "," STRPKCS1 +#define DER_SPKI_FIPS P11PROV_FIPS_PROPERTIES "," OUTDER "," STRSPKI +#define PEM_SPKI_FIPS P11PROV_FIPS_PROPERTIES "," OUTPEM "," STRSPKI +#define PEM_PRIVK_FIPS P11PROV_FIPS_PROPERTIES "," OUTPEM "," STRPRIV + +enum p11prov_encoder_algorithms { + P11PROV_ENCODER_RSA_TEXT, + P11PROV_ENCODER_RSA_DER_PKCS1, + P11PROV_ENCODER_RSA_PEM_PKCS1, + P11PROV_ENCODER_RSA_DER_SPKI, + P11PROV_ENCODER_RSA_PEM_SPKI, + P11PROV_ENCODER_RSA_PEM_PRIVK, + + P11PROV_ENCODER_RSAPSS_TEXT, + P11PROV_ENCODER_RSAPSS_DER_PKCS1, + P11PROV_ENCODER_RSAPSS_PEM_PKCS1, + P11PROV_ENCODER_RSAPSS_DER_SPKI, + P11PROV_ENCODER_RSAPSS_PEM_SPKI, + P11PROV_ENCODER_RSAPSS_PEM_PRIVK, + + P11PROV_ENCODER_EC_TEXT, + P11PROV_ENCODER_EC_DER_PKCS1, + P11PROV_ENCODER_EC_PEM_PKCS1, + P11PROV_ENCODER_EC_DER_SPKI, + P11PROV_ENCODER_EC_PEM_PRIVK, + + P11PROV_ENCODER_ED25519_TEXT, + P11PROV_ENCODER_ED25519_PEM_PRIVK, + + P11PROV_ENCODER_ED448_TEXT, + P11PROV_ENCODER_ED448_PEM_PRIVK, + + P11PROV_ENCODER_X25519_TEXT, + P11PROV_ENCODER_X25519_PEM_PRIVK, + + P11PROV_ENCODER_X448_TEXT, + P11PROV_ENCODER_X448_PEM_PRIVK, + + P11PROV_ENCODER_ML_DSA_44_TEXT, + P11PROV_ENCODER_ML_DSA_44_DER_SPKI, + P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK, + + P11PROV_ENCODER_ML_DSA_65_TEXT, + P11PROV_ENCODER_ML_DSA_65_DER_SPKI, + P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK, + + P11PROV_ENCODER_ML_DSA_87_TEXT, + P11PROV_ENCODER_ML_DSA_87_DER_SPKI, + P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK, + + P11PROV_ENCODER_ML_KEM_512_TEXT, + P11PROV_ENCODER_ML_KEM_512_DER_SPKI, + P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK, + + P11PROV_ENCODER_ML_KEM_768_TEXT, + P11PROV_ENCODER_ML_KEM_768_DER_SPKI, + P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK, + + P11PROV_ENCODER_ML_KEM_1024_TEXT, + P11PROV_ENCODER_ML_KEM_1024_DER_SPKI, + P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK, + + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK, + + P11PROV_ENCODER_NUM_ALGS +}; + +#define TEXT_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + TEXT_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define DER_PKCS1_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + DER_PKCS1_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define PEM_PKCS1_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + PEM_PKCS1_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define DER_SPKI_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + DER_SPKI_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define PEM_SPKI_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + PEM_SPKI_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } +#define PEM_PRIVK_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + PEM_PRIVK_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + } + +const OSSL_ALGORITHM encoder_algorithms[P11PROV_ENCODER_NUM_ALGS] = { + [P11PROV_ENCODER_RSA_TEXT] = + TEXT_ALGORITHM(RSA, p11prov_rsa_encoder_text_functions), + [P11PROV_ENCODER_RSA_DER_PKCS1] = + DER_PKCS1_ALGORITHM(RSA, p11prov_rsa_encoder_pkcs1_der_functions), + [P11PROV_ENCODER_RSA_PEM_PKCS1] = + PEM_PKCS1_ALGORITHM(RSA, p11prov_rsa_encoder_pkcs1_pem_functions), + [P11PROV_ENCODER_RSA_DER_SPKI] = + DER_SPKI_ALGORITHM(RSA, p11prov_rsa_encoder_spki_der_functions), + [P11PROV_ENCODER_RSA_PEM_SPKI] = + PEM_SPKI_ALGORITHM(RSA, p11prov_rsa_encoder_spki_pem_functions), + [P11PROV_ENCODER_RSA_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + RSA, p11prov_rsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_RSAPSS_TEXT] = + TEXT_ALGORITHM(RSAPSS, p11prov_rsa_encoder_text_functions), + [P11PROV_ENCODER_RSAPSS_DER_PKCS1] = + DER_PKCS1_ALGORITHM(RSAPSS, p11prov_rsa_encoder_pkcs1_der_functions), + [P11PROV_ENCODER_RSAPSS_PEM_PKCS1] = + PEM_PKCS1_ALGORITHM(RSAPSS, p11prov_rsa_encoder_pkcs1_pem_functions), + [P11PROV_ENCODER_RSAPSS_DER_SPKI] = + DER_SPKI_ALGORITHM(RSAPSS, p11prov_rsa_encoder_spki_der_functions), + [P11PROV_ENCODER_RSAPSS_PEM_SPKI] = + PEM_SPKI_ALGORITHM(RSAPSS, p11prov_rsa_encoder_spki_pem_functions), + [P11PROV_ENCODER_RSAPSS_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + RSAPSS, p11prov_rsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_EC_TEXT] = + TEXT_ALGORITHM(EC, p11prov_ec_encoder_text_functions), + [P11PROV_ENCODER_EC_DER_PKCS1] = + DER_PKCS1_ALGORITHM(EC, p11prov_ec_encoder_pkcs1_der_functions), + [P11PROV_ENCODER_EC_PEM_PKCS1] = + PEM_PKCS1_ALGORITHM(EC, p11prov_ec_encoder_pkcs1_pem_functions), + [P11PROV_ENCODER_EC_DER_SPKI] = + DER_SPKI_ALGORITHM(EC, p11prov_ec_encoder_spki_der_functions), + [P11PROV_ENCODER_EC_PEM_PRIVK] = + PEM_PRIVK_ALGORITHM(EC, p11prov_ec_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ED25519_TEXT] = + TEXT_ALGORITHM(ED25519, p11prov_ec_edwards_encoder_text_functions), + [P11PROV_ENCODER_ED25519_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ED25519, p11prov_ec_edwards_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ED448_TEXT] = + TEXT_ALGORITHM(ED448, p11prov_ec_edwards_encoder_text_functions), + [P11PROV_ENCODER_ED448_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ED448, p11prov_ec_edwards_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_X25519_TEXT] = + TEXT_ALGORITHM(X25519, p11prov_ec_montgomery_encoder_text_functions), + [P11PROV_ENCODER_X25519_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + X25519, p11prov_ec_montgomery_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_X448_TEXT] = + TEXT_ALGORITHM(X448, p11prov_ec_montgomery_encoder_text_functions), + [P11PROV_ENCODER_X448_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + X448, p11prov_ec_montgomery_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_DSA_44_TEXT] = + TEXT_ALGORITHM(MLDSA_44, p11prov_mldsa_encoder_text_functions), + [P11PROV_ENCODER_ML_DSA_44_DER_SPKI] = + DER_SPKI_ALGORITHM(MLDSA_44, p11prov_mldsa_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + MLDSA_44, p11prov_mldsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_DSA_65_TEXT] = + TEXT_ALGORITHM(MLDSA_65, p11prov_mldsa_encoder_text_functions), + [P11PROV_ENCODER_ML_DSA_65_DER_SPKI] = + DER_SPKI_ALGORITHM(MLDSA_65, p11prov_mldsa_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + MLDSA_65, p11prov_mldsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_DSA_87_TEXT] = + TEXT_ALGORITHM(MLDSA_87, p11prov_mldsa_encoder_text_functions), + [P11PROV_ENCODER_ML_DSA_87_DER_SPKI] = + DER_SPKI_ALGORITHM(MLDSA_87, p11prov_mldsa_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + MLDSA_87, p11prov_mldsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_KEM_512_TEXT] = + TEXT_ALGORITHM(ML_KEM_512, p11prov_mlkem_encoder_text_functions), + [P11PROV_ENCODER_ML_KEM_512_DER_SPKI] = DER_SPKI_ALGORITHM( + ML_KEM_512, p11prov_mlkem_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ML_KEM_512, p11prov_mlkem_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_KEM_768_TEXT] = + TEXT_ALGORITHM(ML_KEM_768, p11prov_mlkem_encoder_text_functions), + [P11PROV_ENCODER_ML_KEM_768_DER_SPKI] = DER_SPKI_ALGORITHM( + ML_KEM_768, p11prov_mlkem_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ML_KEM_768, p11prov_mlkem_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_ML_KEM_1024_TEXT] = + TEXT_ALGORITHM(ML_KEM_1024, p11prov_mlkem_encoder_text_functions), + [P11PROV_ENCODER_ML_KEM_1024_DER_SPKI] = DER_SPKI_ALGORITHM( + ML_KEM_1024, p11prov_mlkem_encoder_spki_der_functions), + [P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + ML_KEM_1024, p11prov_mlkem_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_128S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_128S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_128S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_128F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_128F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_128F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_192S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_192S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_192S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_192F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_192F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_192F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_256S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_256S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_256S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT] = + TEXT_ALGORITHM(SLHDSA_SHA2_256F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHA2_256F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHA2_256F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_encoder_priv_key_info_pem_functions), + + [P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT] = TEXT_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_encoder_text_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI] = DER_SPKI_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_encoder_spki_der_functions), + [P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK] = PEM_PRIVK_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_encoder_priv_key_info_pem_functions), +}; + +CK_RV p11prov_register_encoders(P11PROV_CTX *ctx, bool fips_property, + bool encode_pkey_as_pk11_uri) +{ + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_ENCODER_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + p11prov_assign_alg(&algs[i++], encoder_algorithms, P11PROV_ENCODER_RSA_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_DER_PKCS1, + fips_property ? DER_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_PEM_PKCS1, + fips_property ? PEM_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_PEM_SPKI, + fips_property ? PEM_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_DER_PKCS1, + fips_property ? DER_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_PEM_PKCS1, + fips_property ? PEM_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_PEM_SPKI, + fips_property ? PEM_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, P11PROV_ENCODER_EC_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_DER_PKCS1, + fips_property ? DER_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_PEM_PKCS1, + fips_property ? PEM_PKCS1_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED25519_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED448_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X25519_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X448_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_44_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_44_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_65_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_65_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_87_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_87_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_512_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_512_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_768_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_768_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_1024_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_1024_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT, + fips_property ? TEXT_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI, + fips_property ? DER_SPKI_FIPS : NULL); + + if (encode_pkey_as_pk11_uri) { + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSA_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_RSAPSS_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_EC_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED25519_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ED448_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X25519_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_X448_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + p11prov_assign_alg(&algs[i++], encoder_algorithms, + P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK, + fips_property ? PEM_PRIVK_FIPS : NULL); + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_ENCODER, algs); +} diff --git a/src/encoder.h b/src/encoder.h index 5f8ee2c8..d4a952f3 100644 --- a/src/encoder.h +++ b/src/encoder.h @@ -4,65 +4,9 @@ #ifndef _ENCODER_H #define _ENCODER_H -/* Encoders */ -#define DISPATCH_TEXT_ENCODER_FN(type, name) \ - static OSSL_FUNC_encoder_##name##_fn p11prov_##type##_encoder_##name##_text -#define DISPATCH_TEXT_ENCODER_ELEM(NAME, type, name) \ - { \ - OSSL_FUNC_ENCODER_##NAME, \ - (void (*)(void))p11prov_##type##_encoder_##name \ - } -#define DISPATCH_BASE_ENCODER_FN(name) \ - DECL_DISPATCH_FUNC(encoder, p11prov_encoder, name) -#define DISPATCH_BASE_ENCODER_ELEM(NAME, name) \ - { \ - OSSL_FUNC_ENCODER_##NAME, (void (*)(void))p11prov_encoder_##name \ - } -#define DISPATCH_ENCODER_FN(type, structure, format, name) \ - DECL_DISPATCH_FUNC(encoder, \ - p11prov_##type##_encoder_##structure##_##format, name) -#define DISPATCH_ENCODER_ELEM(NAME, type, structure, format, name) \ - { \ - OSSL_FUNC_ENCODER_##NAME, \ - (void (*)( \ - void))p11prov_##type##_encoder_##structure##_##format##_##name \ - } -extern const OSSL_DISPATCH p11prov_rsa_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_ec_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH - p11prov_ec_edwards_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_edwards_encoder_text_functions[]; -extern const OSSL_DISPATCH - p11prov_ec_montgomery_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_ec_montgomery_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem_encoder_text_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_pkcs1_der_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_pkcs1_pem_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_spki_der_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_spki_pem_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_priv_key_info_pem_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_encoder_text_functions[]; CK_RV rsa_pkeyinfo_to_attrs(CK_ATTRIBUTE *pkeyinfo, CK_ATTRIBUTE *attrs); +CK_RV p11prov_register_encoders(P11PROV_CTX *ctx, bool fips_property, + bool encode_pkey_as_pk11_uri); #endif /* _ENCODER_H */ diff --git a/src/exchange.c b/src/exchange.c index 4d4c5588..6ae30306 100644 --- a/src/exchange.c +++ b/src/exchange.c @@ -2,9 +2,10 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "exchange.h" +#include "kdf.h" #include #include -#include "kdf.h" struct p11prov_exch_ctx { P11PROV_CTX *provctx; @@ -59,6 +60,9 @@ static CK_ULONG p11prov_ecdh_digest_to_kdf(CK_MECHANISM_TYPE digest) return CK_UNAVAILABLE_INFORMATION; } +#define DISPATCH_KEYEXCH_FN(prefix, name) \ + DECL_DISPATCH_FUNC(keyexch, p11prov_##prefix, name) + DISPATCH_KEYEXCH_FN(ecdh, newctx); DISPATCH_KEYEXCH_FN(ecdh, dupctx); DISPATCH_KEYEXCH_FN(ecdh, freectx); @@ -573,7 +577,10 @@ static const OSSL_PARAM *p11prov_ecdh_gettable_ctx_params(void *ctx, void *prov) return params; } -const OSSL_DISPATCH p11prov_ecdh_exchange_functions[] = { +#define DISPATCH_KEYEXCH_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_ecdh_functions[] = { DISPATCH_KEYEXCH_ELEM(ecdh, NEWCTX, newctx), DISPATCH_KEYEXCH_ELEM(ecdh, DUPCTX, dupctx), DISPATCH_KEYEXCH_ELEM(ecdh, FREECTX, freectx), @@ -590,7 +597,7 @@ const OSSL_DISPATCH p11prov_ecdh_exchange_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_x25519_exchange_functions[] = { +const OSSL_DISPATCH p11prov_x25519_functions[] = { DISPATCH_KEYEXCH_ELEM(ecdh, NEWCTX, newctx), DISPATCH_KEYEXCH_ELEM(ecdh, DUPCTX, dupctx), DISPATCH_KEYEXCH_ELEM(ecdh, FREECTX, freectx), @@ -603,7 +610,7 @@ const OSSL_DISPATCH p11prov_x25519_exchange_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_x448_exchange_functions[] = { +const OSSL_DISPATCH p11prov_x448_functions[] = { DISPATCH_KEYEXCH_ELEM(ecdh, NEWCTX, newctx), DISPATCH_KEYEXCH_ELEM(ecdh, DUPCTX, dupctx), DISPATCH_KEYEXCH_ELEM(ecdh, FREECTX, freectx), @@ -621,6 +628,9 @@ const OSSL_DISPATCH p11prov_x448_exchange_functions[] = { * because for some reason they want the command line -derive command * to be able to handle both key exchanges like ECDH and symmetric key * derivation done by KDFs via the -kdf selector */ +#define DISPATCH_EXCHHKDF_FN(name) \ + DECL_DISPATCH_FUNC(keyexch, p11prov_exch_hkdf, name) + DISPATCH_EXCHHKDF_FN(newctx); DISPATCH_EXCHHKDF_FN(freectx); DISPATCH_EXCHHKDF_FN(init); @@ -633,9 +643,9 @@ DISPATCH_EXCHHKDF_FN(settable_ctx_params); static void *fetch_hkdf_function(int func_id) { - for (int i = 0; p11prov_hkdf_kdf_functions[i].function_id != 0; i++) { - if (p11prov_hkdf_kdf_functions[i].function_id == func_id) { - return p11prov_hkdf_kdf_functions[i].function; + for (int i = 0; p11prov_hkdf_functions[i].function_id != 0; i++) { + if (p11prov_hkdf_functions[i].function_id == func_id) { + return p11prov_hkdf_functions[i].function; } } return NULL; @@ -802,7 +812,10 @@ static const OSSL_PARAM *p11prov_exch_hkdf_settable_ctx_params(void *ctx, return hkdf_settable_ctx_params(NULL, provctx); } -const OSSL_DISPATCH p11prov_hkdf_exchange_functions[] = { +#define DISPATCH_EXCHHKDF_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_exch_hkdf_functions[] = { DISPATCH_EXCHHKDF_ELEM(exch_hkdf, NEWCTX, newctx), DISPATCH_EXCHHKDF_ELEM(exch_hkdf, FREECTX, freectx), DISPATCH_EXCHHKDF_ELEM(exch_hkdf, INIT, init), @@ -814,3 +827,59 @@ const OSSL_DISPATCH p11prov_hkdf_exchange_functions[] = { DISPATCH_EXCHHKDF_ELEM(exch_hkdf, SETTABLE_CTX_PARAMS, settable_ctx_params), { 0, NULL }, }; + +enum p11prov_keyexch_algorithms { + P11PROV_KEYEXCH_ECDH = 0, + P11PROV_KEYEXCH_X25519, + P11PROV_KEYEXCH_X448, + P11PROV_KEYEXCH_HKDF, + P11PROV_KEYEXCH_NUM_ALGS +}; + +const OSSL_ALGORITHM keyexch_algorithms[P11PROV_KEYEXCH_NUM_ALGS] = { + [P11PROV_KEYEXCH_ECDH] = DEFAULT_ALGORITHM(ECDH, p11prov_ecdh_functions), + [P11PROV_KEYEXCH_X25519] = + DEFAULT_ALGORITHM(X25519, p11prov_x25519_functions), + [P11PROV_KEYEXCH_X448] = DEFAULT_ALGORITHM(X448, p11prov_x448_functions), + [P11PROV_KEYEXCH_HKDF] = + DEFAULT_ALGORITHM(HKDF, p11prov_exch_hkdf_functions), +}; + +CK_RV p11prov_register_keyexch(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KEYEXCH_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_ECDH1_DERIVE] || mechs[TBID_ECDH1_COFACTOR_DERIVE]) { + p11prov_assign_alg(&algs[i++], keyexch_algorithms, P11PROV_KEYEXCH_ECDH, + property); + } + if (mechs[TBID_EC_MONTGOMERY_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], keyexch_algorithms, + P11PROV_KEYEXCH_X25519, property); + p11prov_assign_alg(&algs[i++], keyexch_algorithms, P11PROV_KEYEXCH_X448, + property); + } + if (mechs[TBID_HKDF_DERIVE]) { + p11prov_assign_alg(&algs[i++], keyexch_algorithms, P11PROV_KEYEXCH_HKDF, + property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KEYEXCH, algs); +} diff --git a/src/exchange.h b/src/exchange.h index dd4d1901..8bbb33c9 100644 --- a/src/exchange.h +++ b/src/exchange.h @@ -4,22 +4,7 @@ #ifndef _EXCHANGE_H #define _EXCHANGE_H -/* ecdh derivation */ -#define DISPATCH_KEYEXCH_FN(prefix, name) \ - DECL_DISPATCH_FUNC(keyexch, p11prov_##prefix, name) -#define DISPATCH_KEYEXCH_ELEM(prefix, NAME, name) \ - { OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name } -extern const OSSL_DISPATCH p11prov_ecdh_exchange_functions[]; -extern const OSSL_DISPATCH p11prov_x25519_exchange_functions[]; -extern const OSSL_DISPATCH p11prov_x448_exchange_functions[]; - -/* HKDF exchange fns */ -#define DISPATCH_EXCHHKDF_FN(name) \ - DECL_DISPATCH_FUNC(keyexch, p11prov_exch_hkdf, name) -#define DISPATCH_EXCHHKDF_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_KEYEXCH_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } -extern const OSSL_DISPATCH p11prov_hkdf_exchange_functions[]; +CK_RV p11prov_register_keyexch(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _EXCHANGE_H */ diff --git a/src/kdf.c b/src/kdf.c index 0cc54422..e6ef3439 100644 --- a/src/kdf.c +++ b/src/kdf.c @@ -2,6 +2,7 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "kdf.h" #include "platform/endian.h" #include #include @@ -31,6 +32,8 @@ struct p11prov_kdf_ctx { }; typedef struct p11prov_kdf_ctx P11PROV_KDF_CTX; +#define DISPATCH_HKDF_FN(name) DECL_DISPATCH_FUNC(kdf, p11prov_hkdf, name) + DISPATCH_HKDF_FN(newctx); DISPATCH_HKDF_FN(freectx); DISPATCH_HKDF_FN(reset); @@ -939,7 +942,10 @@ static const OSSL_PARAM *p11prov_hkdf_gettable_ctx_params(void *ctx, void *prov) return params; } -const OSSL_DISPATCH p11prov_hkdf_kdf_functions[] = { +#define DISPATCH_HKDF_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KDF_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_hkdf_functions[] = { DISPATCH_HKDF_ELEM(hkdf, NEWCTX, newctx), DISPATCH_HKDF_ELEM(hkdf, FREECTX, freectx), DISPATCH_HKDF_ELEM(hkdf, RESET, reset), @@ -995,3 +1001,47 @@ const OSSL_DISPATCH p11prov_tls13_kdf_functions[] = { #endif { 0, NULL }, }; + +enum p11prov_kdf_algorithms { + P11PROV_KDF_HKDF = 0, + P11PROV_KDF_TLS13_KDF, + P11PROV_KDF_NUM_ALGS +}; + +const OSSL_ALGORITHM kdf_algorithms[P11PROV_KDF_NUM_ALGS] = { + [P11PROV_KDF_HKDF] = DEFAULT_ALGORITHM(HKDF, p11prov_hkdf_functions), + [P11PROV_KDF_TLS13_KDF] = + DEFAULT_ALGORITHM(TLS13_KDF, p11prov_tls13_kdf_functions), +}; + +CK_RV p11prov_register_kdfs(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KDF_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_HKDF_DERIVE]) { + p11prov_assign_alg(&algs[i++], kdf_algorithms, P11PROV_KDF_HKDF, + property); + p11prov_assign_alg(&algs[i++], kdf_algorithms, P11PROV_KDF_TLS13_KDF, + property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KDF, algs); +} diff --git a/src/kdf.h b/src/kdf.h index dfd3cb20..4b0c17c2 100644 --- a/src/kdf.h +++ b/src/kdf.h @@ -4,14 +4,10 @@ #ifndef _KDF_H #define _KDF_H -/* HKDF kdf fns */ -#define DISPATCH_HKDF_FN(name) DECL_DISPATCH_FUNC(kdf, p11prov_hkdf, name) -#define DISPATCH_HKDF_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_KDF_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } extern const void *p11prov_hkdf_static_ctx; -extern const OSSL_DISPATCH p11prov_hkdf_kdf_functions[]; -extern const OSSL_DISPATCH p11prov_tls13_kdf_functions[]; +extern const OSSL_DISPATCH p11prov_hkdf_functions[]; + +CK_RV p11prov_register_kdfs(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _KDF_H */ diff --git a/src/kem.c b/src/kem.c index 13060e3c..cbb3f82c 100644 --- a/src/kem.c +++ b/src/kem.c @@ -18,6 +18,8 @@ struct p11prov_kem_ctx { }; typedef struct p11prov_kem_ctx P11PROV_KEM_CTX; +#define DISPATCH_MLKEM_FN(name) DECL_DISPATCH_FUNC(kem, p11prov_mlkem, name) + DISPATCH_MLKEM_FN(newctx); DISPATCH_MLKEM_FN(freectx); DISPATCH_MLKEM_FN(encapsulate_init); @@ -379,7 +381,10 @@ p11prov_mlkem_settable_ctx_params(ossl_unused void *vctx, return settable; } -const OSSL_DISPATCH p11prov_mlkem_kem_functions[] = { +#define DISPATCH_MLKEM_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_KEM_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +const OSSL_DISPATCH p11prov_mlkem_functions[] = { DISPATCH_MLKEM_ELEM(mlkem, NEWCTX, newctx), DISPATCH_MLKEM_ELEM(mlkem, FREECTX, freectx), DISPATCH_MLKEM_ELEM(mlkem, ENCAPSULATE_INIT, encapsulate_init), @@ -390,3 +395,52 @@ const OSSL_DISPATCH p11prov_mlkem_kem_functions[] = { DISPATCH_MLKEM_ELEM(mlkem, SETTABLE_CTX_PARAMS, settable_ctx_params), { 0, NULL }, }; + +enum p11prov_kem_algorithms { + P11PROV_KEM_ML_KEM_512, + P11PROV_KEM_ML_KEM_768, + P11PROV_KEM_ML_KEM_1024, + P11PROV_KEM_NUM_ALGS +}; + +const OSSL_ALGORITHM kem_algorithms[P11PROV_KEM_NUM_ALGS] = { + [P11PROV_KEM_ML_KEM_512] = + DEFAULT_ALGORITHM(ML_KEM_512, p11prov_mlkem_functions), + [P11PROV_KEM_ML_KEM_768] = + DEFAULT_ALGORITHM(ML_KEM_768, p11prov_mlkem_functions), + [P11PROV_KEM_ML_KEM_1024] = + DEFAULT_ALGORITHM(ML_KEM_1024, p11prov_mlkem_functions), +}; + +CK_RV p11prov_register_kems(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KEM_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_ML_KEM]) { + p11prov_assign_alg(&algs[i++], kem_algorithms, P11PROV_KEM_ML_KEM_512, + property); + p11prov_assign_alg(&algs[i++], kem_algorithms, P11PROV_KEM_ML_KEM_768, + property); + p11prov_assign_alg(&algs[i++], kem_algorithms, P11PROV_KEM_ML_KEM_1024, + property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KEM, algs); +} diff --git a/src/kem.h b/src/kem.h index 43cee05d..09650142 100644 --- a/src/kem.h +++ b/src/kem.h @@ -4,12 +4,7 @@ #ifndef _KEM_H #define _KEM_H -#include "provider.h" - -/* ml-kem kem */ -#define DISPATCH_MLKEM_FN(name) DECL_DISPATCH_FUNC(kem, p11prov_mlkem, name) -#define DISPATCH_MLKEM_ELEM(prefix, NAME, name) \ - { OSSL_FUNC_KEM_##NAME, (void (*)(void))p11prov_##prefix##_##name } -extern const OSSL_DISPATCH p11prov_mlkem_kem_functions[]; +CK_RV p11prov_register_kems(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _KEM_H */ diff --git a/src/kmgmt/common.c b/src/kmgmt/common.c index 4d9c5798..b94444ef 100644 --- a/src/kmgmt/common.c +++ b/src/kmgmt/common.c @@ -504,3 +504,157 @@ int p11prov_kmgmt_export(void *keydata, int selection, OSSL_CALLBACK *cb_fn, /* nothing to export, just return OK */ return RET_OSSL_OK; } + +enum p11prov_kmgmt_algorithms { + P11PROV_KMGMT_RSA = 0, + P11PROV_KMGMT_RSAPSS, + P11PROV_KMGMT_EC, + P11PROV_KMGMT_HKDF, + P11PROV_KMGMT_ED25519, + P11PROV_KMGMT_ED448, + P11PROV_KMGMT_X25519, + P11PROV_KMGMT_X448, + P11PROV_KMGMT_MLDSA_44, + P11PROV_KMGMT_MLDSA_65, + P11PROV_KMGMT_MLDSA_87, + P11PROV_KMGMT_ML_KEM_512, + P11PROV_KMGMT_ML_KEM_768, + P11PROV_KMGMT_ML_KEM_1024, + P11PROV_KMGMT_SLHDSA_SHA2_128S, + P11PROV_KMGMT_SLHDSA_SHA2_128F, + P11PROV_KMGMT_SLHDSA_SHA2_192S, + P11PROV_KMGMT_SLHDSA_SHA2_192F, + P11PROV_KMGMT_SLHDSA_SHA2_256S, + P11PROV_KMGMT_SLHDSA_SHA2_256F, + P11PROV_KMGMT_SLHDSA_SHAKE_128S, + P11PROV_KMGMT_SLHDSA_SHAKE_128F, + P11PROV_KMGMT_SLHDSA_SHAKE_192S, + P11PROV_KMGMT_SLHDSA_SHAKE_192F, + P11PROV_KMGMT_SLHDSA_SHAKE_256S, + P11PROV_KMGMT_SLHDSA_SHAKE_256F, + P11PROV_KMGMT_NUM_ALGS +}; + +const OSSL_ALGORITHM kmgmt_algorithms[P11PROV_KMGMT_NUM_ALGS] = { + [P11PROV_KMGMT_RSA] = DEFAULT_ALGORITHM(RSA, p11prov_rsa_keymgmt_functions), + [P11PROV_KMGMT_RSAPSS] = + DEFAULT_ALGORITHM(RSAPSS, p11prov_rsapss_keymgmt_functions), + [P11PROV_KMGMT_EC] = DEFAULT_ALGORITHM(EC, p11prov_ec_keymgmt_functions), + [P11PROV_KMGMT_HKDF] = + DEFAULT_ALGORITHM(HKDF, p11prov_hkdf_keymgmt_functions), + [P11PROV_KMGMT_ED25519] = + DEFAULT_ALGORITHM(ED25519, p11prov_ed25519_keymgmt_functions), + [P11PROV_KMGMT_ED448] = + DEFAULT_ALGORITHM(ED448, p11prov_ed448_keymgmt_functions), + [P11PROV_KMGMT_X25519] = + DEFAULT_ALGORITHM(X25519, p11prov_x25519_keymgmt_functions), + [P11PROV_KMGMT_X448] = + DEFAULT_ALGORITHM(X448, p11prov_x448_keymgmt_functions), + [P11PROV_KMGMT_MLDSA_44] = + DEFAULT_ALGORITHM(MLDSA_44, p11prov_mldsa44_keymgmt_functions), + [P11PROV_KMGMT_MLDSA_65] = + DEFAULT_ALGORITHM(MLDSA_65, p11prov_mldsa65_keymgmt_functions), + [P11PROV_KMGMT_MLDSA_87] = + DEFAULT_ALGORITHM(MLDSA_87, p11prov_mldsa87_keymgmt_functions), + [P11PROV_KMGMT_ML_KEM_512] = + DEFAULT_ALGORITHM(ML_KEM_512, p11prov_mlkem512_keymgmt_functions), + [P11PROV_KMGMT_ML_KEM_768] = + DEFAULT_ALGORITHM(ML_KEM_768, p11prov_mlkem768_keymgmt_functions), + [P11PROV_KMGMT_ML_KEM_1024] = + DEFAULT_ALGORITHM(ML_KEM_1024, p11prov_mlkem1024_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_128S] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_128S, p11prov_slhdsa_sha2_128s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_128F] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_128F, p11prov_slhdsa_sha2_128f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_192S] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_192S, p11prov_slhdsa_sha2_192s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_192F] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_192F, p11prov_slhdsa_sha2_192f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_256S] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_256S, p11prov_slhdsa_sha2_256s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHA2_256F] = DEFAULT_ALGORITHM( + SLHDSA_SHA2_256F, p11prov_slhdsa_sha2_256f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_128S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_shake_128s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_128F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_shake_128f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_192S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_shake_192s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_192F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_shake_192f_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_256S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_shake_256s_keymgmt_functions), + [P11PROV_KMGMT_SLHDSA_SHAKE_256F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_shake_256f_keymgmt_functions), +}; + +CK_RV p11prov_register_kmgmt(P11PROV_CTX *ctx, bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KMGMT_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_RSA, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_RSAPSS, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_EC, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_HKDF, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ED25519, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ED448, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_X25519, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_X448, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_44, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_65, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_87, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_512, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_768, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_1024, + property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_128S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_128F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_192S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_192F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_256S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHA2_256F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_128S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_128F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_192S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_192F, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_256S, property); + p11prov_assign_alg(&algs[i++], kmgmt_algorithms, + P11PROV_KMGMT_SLHDSA_SHAKE_256F, property); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_KEYMGMT, algs); +} diff --git a/src/kmgmt/hkdf.c b/src/kmgmt/hkdf.c index 806fb5b7..e4aeabb0 100644 --- a/src/kmgmt/hkdf.c +++ b/src/kmgmt/hkdf.c @@ -2,6 +2,8 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "exchange.h" +#include "kmgmt/internal.h" DISPATCH_KEYMGMT_FN(hkdf, new); DISPATCH_KEYMGMT_FN(hkdf, free); diff --git a/src/kmgmt/internal.h b/src/kmgmt/internal.h index bb6593c1..8b38f445 100644 --- a/src/kmgmt/internal.h +++ b/src/kmgmt/internal.h @@ -1,6 +1,8 @@ /* Copyright (C) 2022-2025 Simo Sorce SPDX-License-Identifier: Apache-2.0 */ +#include "kmgmt/keymgmt.h" + struct key_generator { P11PROV_CTX *provctx; @@ -72,3 +74,35 @@ int p11prov_kmgmt_import(CK_KEY_TYPE type, CK_ULONG param_set, int selection, const OSSL_PARAM params[]); int p11prov_kmgmt_export(void *keydata, int selection, OSSL_CALLBACK *cb_fn, void *cb_arg); + +#define DISPATCH_KEYMGMT_FN(type, name) \ + DECL_DISPATCH_FUNC(keymgmt, p11prov_##type, name) +#define DISPATCH_KEYMGMT_ELEM(type, NAME, name) \ + { OSSL_FUNC_KEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name } + +extern const OSSL_DISPATCH p11prov_rsa_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_rsapss_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_ec_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_hkdf_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_ed25519_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_ed448_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_x25519_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_x448_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa44_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa65_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa87_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mlkem512_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mlkem768_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_mlkem1024_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_keymgmt_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_keymgmt_functions[]; diff --git a/src/kmgmt/keymgmt.h b/src/kmgmt/keymgmt.h index 4d5fed28..4e41df05 100644 --- a/src/kmgmt/keymgmt.h +++ b/src/kmgmt/keymgmt.h @@ -4,42 +4,9 @@ #ifndef _KEYMGMT_H #define _KEYMGMT_H -/* keymgmt */ - #define P11PROV_N_RSAPSS_MECHS 10 extern const CK_MECHANISM_TYPE p11prov_rsapss_mechs[P11PROV_N_RSAPSS_MECHS]; -#define DISPATCH_KEYMGMT_FN(type, name) \ - DECL_DISPATCH_FUNC(keymgmt, p11prov_##type, name) -#define DISPATCH_KEYMGMT_ELEM(type, NAME, name) \ - { \ - OSSL_FUNC_KEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name \ - } -extern const OSSL_DISPATCH p11prov_rsa_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_rsapss_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_ec_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_hkdf_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_ed25519_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_ed448_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_x25519_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_x448_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa44_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa65_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa87_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem512_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem768_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_mlkem1024_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_keymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_keymgmt_functions[]; +CK_RV p11prov_register_kmgmt(P11PROV_CTX *ctx, bool fips_property); #endif /* _KEYMGMT_H */ diff --git a/src/kmgmt/rsa.c b/src/kmgmt/rsa.c index feb344b9..e92d8c55 100644 --- a/src/kmgmt/rsa.c +++ b/src/kmgmt/rsa.c @@ -4,6 +4,7 @@ #include "provider.h" #include "platform/endian.h" #include "kmgmt/internal.h" +#include "sig/signature.h" DISPATCH_KEYMGMT_FN(rsa, new); DISPATCH_KEYMGMT_FN(rsa, gen_cleanup); diff --git a/src/kmgmt/skey.c b/src/kmgmt/skey.c index 7eb21181..35845002 100644 --- a/src/kmgmt/skey.c +++ b/src/kmgmt/skey.c @@ -2,12 +2,16 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "kmgmt/skey.h" #if SKEY_SUPPORT == 1 #include "platform/endian.h" #include +#define DISPATCH_SKEYMGMT_FN(type, name) \ + DECL_DISPATCH_FUNC(skeymgmt, p11prov_##type, name) + DISPATCH_SKEYMGMT_FN(aes, free); DISPATCH_SKEYMGMT_FN(aes, import); DISPATCH_SKEYMGMT_FN(aes, export); @@ -291,7 +295,10 @@ static const OSSL_PARAM *p11prov_aes_gen_settable_params(void *provctx) return aes_generate_params; } -const OSSL_DISPATCH p11prov_aes_skeymgmt_functions[] = { +#define DISPATCH_SKEYMGMT_ELEM(type, NAME, name) \ + { OSSL_FUNC_SKEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name } + +const OSSL_DISPATCH p11prov_aes_functions[] = { DISPATCH_SKEYMGMT_ELEM(aes, FREE, free), DISPATCH_SKEYMGMT_ELEM(aes, IMPORT, import), DISPATCH_SKEYMGMT_ELEM(aes, EXPORT, export), @@ -651,7 +658,7 @@ p11prov_generic_secret_gen_settable_params(void *provctx) return generic_secret_generate_params; } -const OSSL_DISPATCH p11prov_generic_secret_skeymgmt_functions[] = { +const OSSL_DISPATCH p11prov_generic_secret_functions[] = { DISPATCH_SKEYMGMT_ELEM(generic_secret, FREE, free), DISPATCH_SKEYMGMT_ELEM(generic_secret, IMPORT, import), DISPATCH_SKEYMGMT_ELEM(generic_secret, EXPORT, export), @@ -664,4 +671,39 @@ const OSSL_DISPATCH p11prov_generic_secret_skeymgmt_functions[] = { { 0, NULL }, }; +enum p11prov_skmgmt_algorithms { + P11PROV_SKMGMT_AES = 0, + P11PROV_SKMGMT_GENERIC_SECRET, + P11PROV_SKMGMT_NUM_ALGS +}; + +const OSSL_ALGORITHM skmgmt_algorithms[P11PROV_SKMGMT_NUM_ALGS] = { + [P11PROV_SKMGMT_AES] = DEFAULT_ALGORITHM(AES, p11prov_aes_functions), + [P11PROV_SKMGMT_GENERIC_SECRET] = + DEFAULT_ALGORITHM(GENERIC_SECRET, p11prov_generic_secret_functions), +}; + +CK_RV p11prov_register_skmgmt(P11PROV_CTX *ctx, bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_SKMGMT_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + p11prov_assign_alg(&algs[i++], skmgmt_algorithms, P11PROV_SKMGMT_AES, + property); + p11prov_assign_alg(&algs[i++], skmgmt_algorithms, + P11PROV_SKMGMT_GENERIC_SECRET, property); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_SKEYMGMT, algs); +} + #endif diff --git a/src/kmgmt/skey.h b/src/kmgmt/skey.h index da851e54..1accdece 100644 --- a/src/kmgmt/skey.h +++ b/src/kmgmt/skey.h @@ -4,12 +4,6 @@ #ifndef _SKEYMGMT_H #define _SKEYMGMT_H -/* keymgmt */ -#define DISPATCH_SKEYMGMT_FN(type, name) \ - DECL_DISPATCH_FUNC(skeymgmt, p11prov_##type, name) -#define DISPATCH_SKEYMGMT_ELEM(type, NAME, name) \ - { OSSL_FUNC_SKEYMGMT_##NAME, (void (*)(void))p11prov_##type##_##name } -extern const OSSL_DISPATCH p11prov_aes_skeymgmt_functions[]; -extern const OSSL_DISPATCH p11prov_generic_secret_skeymgmt_functions[]; +CK_RV p11prov_register_skmgmt(P11PROV_CTX *ctx, bool fips_property); #endif /* _SKEYMGMT_H */ diff --git a/src/meson.build b/src/meson.build index aaf6d51b..40d9b3ef 100644 --- a/src/meson.build +++ b/src/meson.build @@ -17,6 +17,7 @@ pkcs11_provider_sources = [ 'kmgmt/slhdsa.c', 'pk11_uri.c', 'interface.c', + 'registration.c', 'obj/create.c', 'obj/export.c', 'obj/keymgmt.c', diff --git a/src/obj/internal.h b/src/obj/internal.h index 909661a6..be5d50d3 100644 --- a/src/obj/internal.h +++ b/src/obj/internal.h @@ -5,6 +5,7 @@ #define _OBJ_INTERNAL_H_ #include "provider.h" +#include "encoder.h" struct p11prov_key { CK_KEY_TYPE type; diff --git a/src/obj/keymgmt.c b/src/obj/keymgmt.c index da741630..8a9ec992 100644 --- a/src/obj/keymgmt.c +++ b/src/obj/keymgmt.c @@ -2,6 +2,7 @@ SPDX-License-Identifier: Apache-2.0 */ #include "obj/internal.h" +#include "kmgmt/keymgmt.h" bool p11prov_obj_is_rsa_pss(P11PROV_OBJ *obj) { diff --git a/src/provider.c b/src/provider.c index 1090b597..250ee313 100644 --- a/src/provider.c +++ b/src/provider.c @@ -3,10 +3,25 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" -#include "decoder.h" #include #include +#include "asymmetric_cipher.h" +#include "decoder.h" +#include "encoder.h" +#include "exchange.h" +#include "kdf.h" +#include "kem.h" +#include "kmgmt/keymgmt.h" +#include "random.h" +#include "sig/signature.h" +#include "store.h" + +#if SKEY_SUPPORT == 1 +#include "cipher.h" +#include "kmgmt/skey.h" +#endif + struct p11prov_interface; struct quirk; @@ -53,11 +68,10 @@ struct p11prov_ctx { OSSL_ALGORITHM *op_digest; OSSL_ALGORITHM *op_kdf; OSSL_ALGORITHM *op_random; - OSSL_ALGORITHM *op_exchange; + OSSL_ALGORITHM *op_keyexch; OSSL_ALGORITHM *op_signature; OSSL_ALGORITHM *op_asym_cipher; OSSL_ALGORITHM *op_kem; - OSSL_ALGORITHM *op_encoder; OSSL_ALGORITHM *op_decoder; OSSL_ALGORITHM *op_keymgmt; @@ -555,7 +569,7 @@ static void p11prov_ctx_free(P11PROV_CTX *ctx) OPENSSL_free(ctx->op_digest); OPENSSL_free(ctx->op_kdf); OPENSSL_free(ctx->op_random); - OPENSSL_free(ctx->op_exchange); + OPENSSL_free(ctx->op_keyexch); OPENSSL_free(ctx->op_signature); OPENSSL_free(ctx->op_asym_cipher); OPENSSL_free(ctx->op_kem); @@ -800,897 +814,174 @@ static int p11prov_get_params(void *provctx, OSSL_PARAM params[]) return RET_OSSL_OK; } -/* TODO: this needs to be made dynamic, - * based on what the pkcs11 module supports */ -#define ALGOS_ALLOC 4 -static CK_RV alg_set_op(OSSL_ALGORITHM **op, int idx, OSSL_ALGORITHM *alg) +CK_RV p11prov_ctx_add_algs(P11PROV_CTX *ctx, int operation_id, + OSSL_ALGORITHM *algs) { - if (idx % ALGOS_ALLOC == 0) { - OSSL_ALGORITHM *tmp = - OPENSSL_realloc(*op, sizeof(OSSL_ALGORITHM) * (idx + ALGOS_ALLOC)); - if (!tmp) { - return CKR_HOST_MEMORY; - } - *op = tmp; - } - (*op)[idx] = *alg; - return CKR_OK; -} - -#define ADD_ALGO_EXT(NAME, operation, prop, func) \ - do { \ - CK_RV alg_ret; \ - OSSL_ALGORITHM alg = { P11PROV_NAMES_##NAME, prop, func, \ - P11PROV_DESCS_##NAME }; \ - alg_ret = alg_set_op(&ctx->op_##operation, operation##_idx, &alg); \ - if (alg_ret != CKR_OK) { \ - P11PROV_raise(ctx, alg_ret, "Failed to store mech algo"); \ - return RET_OSSL_ERR; \ - } \ - operation##_idx++; \ - } while (0) - -#define ADD_ALGO(NAME, name, operation, prop) \ - ADD_ALGO_EXT(NAME, operation, prop, \ - p11prov_##name##_##operation##_functions) - -#define TERM_ALGO(operation) \ - if (operation##_idx > 0) { \ - CK_RV alg_ret; \ - OSSL_ALGORITHM alg = { NULL, NULL, NULL, NULL }; \ - alg_ret = alg_set_op(&ctx->op_##operation, operation##_idx, &alg); \ - if (alg_ret != CKR_OK) { \ - P11PROV_raise(ctx, alg_ret, "Failed to terminate mech algo"); \ - return RET_OSSL_ERR; \ - } \ - } \ - operation##_idx = 0 - -#define DIGEST_MECHS \ - CKM_SHA_1, CKM_SHA224, CKM_SHA256, CKM_SHA384, CKM_SHA512, CKM_SHA512_224, \ - CKM_SHA512_256, CKM_SHA3_224, CKM_SHA3_256, CKM_SHA3_384, CKM_SHA3_512 - -#define RSA_SIG_MECHS \ - CKM_RSA_PKCS, CKM_SHA1_RSA_PKCS, CKM_SHA224_RSA_PKCS, CKM_SHA256_RSA_PKCS, \ - CKM_SHA384_RSA_PKCS, CKM_SHA512_RSA_PKCS, CKM_SHA3_224_RSA_PKCS, \ - CKM_SHA3_256_RSA_PKCS, CKM_SHA3_384_RSA_PKCS, CKM_SHA3_512_RSA_PKCS - -#define RSAPSS_SIG_MECHS \ - CKM_RSA_PKCS_PSS, CKM_SHA1_RSA_PKCS_PSS, CKM_SHA224_RSA_PKCS_PSS, \ - CKM_SHA256_RSA_PKCS_PSS, CKM_SHA384_RSA_PKCS_PSS, \ - CKM_SHA512_RSA_PKCS_PSS, CKM_SHA3_224_RSA_PKCS_PSS, \ - CKM_SHA3_256_RSA_PKCS_PSS, CKM_SHA3_384_RSA_PKCS_PSS, \ - CKM_SHA3_512_RSA_PKCS_PSS - -#define RSA_ENC_MECHS \ - CKM_RSA_PKCS, CKM_RSA_PKCS_OAEP, CKM_RSA_X_509, CKM_RSA_X9_31 - -#define ECDSA_SIG_MECHS \ - CKM_ECDSA, CKM_ECDSA_SHA1, CKM_ECDSA_SHA224, CKM_ECDSA_SHA256, \ - CKM_ECDSA_SHA384, CKM_ECDSA_SHA512, CKM_ECDSA_SHA3_224, \ - CKM_ECDSA_SHA3_256, CKM_ECDSA_SHA3_384, CKM_ECDSA_SHA3_512 - -#define PQC_MECHS \ - CKM_ML_DSA, CKM_ML_DSA_KEY_PAIR_GEN, CKM_ML_KEM, CKM_ML_KEM_KEY_PAIR_GEN, \ - CKM_SLH_DSA, CKM_SLH_DSA_KEY_PAIR_GEN - + switch (operation_id) { + case OSSL_OP_DIGEST: + OPENSSL_free(ctx->op_digest); + ctx->op_digest = algs; + break; #if SKEY_SUPPORT == 1 -#define AES_MECHS \ - CKM_AES_ECB, CKM_AES_CBC, CKM_AES_CBC_PAD, CKM_AES_CTR, CKM_AES_CTS, \ - CKM_AES_OFB, CKM_AES_CFB8, CKM_AES_CFB128, CKM_AES_CFB1, CKM_AES_GCM, \ - CKM_CHACHA20_POLY1305 + case OSSL_OP_CIPHER: + OPENSSL_free(ctx->op_cipher); + ctx->op_cipher = algs; + break; #endif - -static void alg_rm_mechs(CK_ULONG *checklist, CK_ULONG *rmlist, int *clsize, - int rmsize) -{ - CK_ULONG tmplist[*clsize]; - int t = 0; - - for (int i = 0; i < *clsize; i++) { - tmplist[t] = checklist[i]; - for (int j = 0; j < rmsize; j++) { - if (tmplist[t] == rmlist[j]) { - tmplist[t] = CK_UNAVAILABLE_INFORMATION; - break; - } - } - if (tmplist[t] != CK_UNAVAILABLE_INFORMATION) { - t++; - } + /* MAC */ + case OSSL_OP_KDF: + OPENSSL_free(ctx->op_kdf); + ctx->op_kdf = algs; + break; + case OSSL_OP_RAND: + OPENSSL_free(ctx->op_random); + ctx->op_random = algs; + break; + case OSSL_OP_KEYMGMT: + OPENSSL_free(ctx->op_keymgmt); + ctx->op_keymgmt = algs; + break; + case OSSL_OP_KEYEXCH: + OPENSSL_free(ctx->op_keyexch); + ctx->op_keyexch = algs; + break; + case OSSL_OP_SIGNATURE: + OPENSSL_free(ctx->op_signature); + ctx->op_signature = algs; + break; + case OSSL_OP_ASYM_CIPHER: + OPENSSL_free(ctx->op_asym_cipher); + ctx->op_asym_cipher = algs; + break; + case OSSL_OP_KEM: + OPENSSL_free(ctx->op_kem); + ctx->op_kem = algs; + break; +#if SKEY_SUPPORT == 1 + case OSSL_OP_SKEYMGMT: + OPENSSL_free(ctx->op_skeymgmt); + ctx->op_skeymgmt = algs; + break; +#endif + case OSSL_OP_ENCODER: + OPENSSL_free(ctx->op_encoder); + ctx->op_encoder = algs; + break; + case OSSL_OP_DECODER: + OPENSSL_free(ctx->op_decoder); + ctx->op_decoder = algs; + break; + case OSSL_OP_STORE: + OPENSSL_free(ctx->op_store); + ctx->op_store = algs; + break; + default: + OPENSSL_free(algs); + return CKR_GENERAL_ERROR; } - memcpy(checklist, tmplist, t * sizeof(CK_ULONG)); - *clsize = t; -} - -#define UNCHECK_MECHS(...) \ - do { \ - CK_ULONG rmlist[] = { __VA_ARGS__ }; \ - int rmsize = sizeof(rmlist) / sizeof(CK_ULONG); \ - alg_rm_mechs(checklist, rmlist, &cl_size, rmsize); \ - } while (0); -static const char *get_default_properties(P11PROV_CTX *ctx) -{ - if (ctx->assume_fips) { - return P11PROV_FIPS_PROPERTIES; - } - return P11PROV_DEFAULT_PROPERTIES; + return CKR_OK; } static CK_RV operations_init(P11PROV_CTX *ctx) { - P11PROV_SLOTS_CTX *slots; - P11PROV_SLOT *slot; - CK_ULONG checklist[] = { CKM_RSA_PKCS_KEY_PAIR_GEN, - RSA_SIG_MECHS, - RSAPSS_SIG_MECHS, - RSA_ENC_MECHS, - CKM_EC_KEY_PAIR_GEN, - CKM_EC_EDWARDS_KEY_PAIR_GEN, - ECDSA_SIG_MECHS, - CKM_ECDH1_DERIVE, - CKM_ECDH1_COFACTOR_DERIVE, - CKM_EC_MONTGOMERY_KEY_PAIR_GEN, - CKM_HKDF_DERIVE, - DIGEST_MECHS, - CKM_EDDSA, - PQC_MECHS, -#if SKEY_SUPPORT == 1 - AES_MECHS -#endif - }; - bool add_rsasig = false; - bool add_rsaenc = false; - bool add_ecdsasig = false; - int cl_size = sizeof(checklist) / sizeof(CK_ULONG); - int digest_idx = 0; - int kdf_idx = 0; - int random_idx = 0; - int exchange_idx = 0; - int signature_idx = 0; - int asym_cipher_idx = 0; - int kem_idx = 0; -#if SKEY_SUPPORT == 1 - int cipher_idx = 0; -#endif - int slot_idx = 0; - const char *prop = get_default_properties(ctx); + bool available_mechs[TBID_SIZE] = { 0 }; CK_RV ret; - ret = p11prov_take_slots(ctx, &slots); + ret = p11prov_get_mech_state_table(ctx, available_mechs); if (ret != CKR_OK) { return ret; } - for (slot = p11prov_fetch_slot(slots, &slot_idx); slot != NULL; - slot = p11prov_fetch_slot(slots, &slot_idx)) { + ret = p11prov_register_digests(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } - CK_MECHANISM_TYPE *mechs; - int nmechs; - nmechs = p11prov_slot_get_mechanisms(slot, &mechs); - for (int ms = 0; ms < nmechs; ms++) { - CK_ULONG mech = CK_UNAVAILABLE_INFORMATION; - if (cl_size == 0) { - /* we are done*/ - break; - } - for (int cl = 0; cl < cl_size; cl++) { - if (mechs[ms] == checklist[cl]) { - mech = mechs[ms]; - /* found */ - break; - } - } - switch (mech) { - case CK_UNAVAILABLE_INFORMATION: - continue; - case CKM_RSA_PKCS_KEY_PAIR_GEN: - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_RSA_PKCS: - add_rsasig = true; - add_rsaenc = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN); - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSA_ENC_MECHS); - break; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) - case CKM_SHA1_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA1, signature, prop, - p11prov_rsa_sha1_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA1_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA224_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA224, signature, prop, - p11prov_rsa_sha224_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA224_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA256_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA256, signature, prop, - p11prov_rsa_sha256_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA256_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA384_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA384, signature, prop, - p11prov_rsa_sha384_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA384_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA512_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA512, signature, prop, - p11prov_rsa_sha512_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA512_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_224_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_224, signature, prop, - p11prov_rsa_sha3_224_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_224_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_256_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_256, signature, prop, - p11prov_rsa_sha3_256_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_256_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_384_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_384, signature, prop, - p11prov_rsa_sha3_384_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_384_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; - case CKM_SHA3_512_RSA_PKCS: - ADD_ALGO_EXT(RSA_SHA3_512, signature, prop, - p11prov_rsa_sha3_512_signature_functions); - add_rsasig = true; - UNCHECK_MECHS(CKM_SHA3_512_RSA_PKCS, CKM_RSA_PKCS_KEY_PAIR_GEN); - break; -#else - case CKM_SHA1_RSA_PKCS: - case CKM_SHA224_RSA_PKCS: - case CKM_SHA256_RSA_PKCS: - case CKM_SHA384_RSA_PKCS: - case CKM_SHA512_RSA_PKCS: - case CKM_SHA3_224_RSA_PKCS: - case CKM_SHA3_256_RSA_PKCS: - case CKM_SHA3_384_RSA_PKCS: - case CKM_SHA3_512_RSA_PKCS: - add_rsasig = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSA_SIG_MECHS); - break; -#endif - case CKM_RSA_PKCS_PSS: - case CKM_SHA1_RSA_PKCS_PSS: - case CKM_SHA224_RSA_PKCS_PSS: - case CKM_SHA256_RSA_PKCS_PSS: - case CKM_SHA384_RSA_PKCS_PSS: - case CKM_SHA512_RSA_PKCS_PSS: - case CKM_SHA3_224_RSA_PKCS_PSS: - case CKM_SHA3_256_RSA_PKCS_PSS: - case CKM_SHA3_384_RSA_PKCS_PSS: - case CKM_SHA3_512_RSA_PKCS_PSS: - add_rsasig = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSAPSS_SIG_MECHS); - break; - case CKM_RSA_PKCS_OAEP: - case CKM_RSA_X_509: - case CKM_RSA_X9_31: - add_rsaenc = true; - UNCHECK_MECHS(CKM_RSA_PKCS_KEY_PAIR_GEN, RSA_ENC_MECHS); - break; - case CKM_EC_KEY_PAIR_GEN: - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN); - break; - case CKM_ECDSA: - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA); - break; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) - case CKM_ECDSA_SHA1: - ADD_ALGO_EXT(ECDSA_SHA1, signature, prop, - p11prov_ecdsa_sha1_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA1); - break; - case CKM_ECDSA_SHA224: - ADD_ALGO_EXT(ECDSA_SHA224, signature, prop, - p11prov_ecdsa_sha224_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA224); - break; - case CKM_ECDSA_SHA256: - ADD_ALGO_EXT(ECDSA_SHA256, signature, prop, - p11prov_ecdsa_sha256_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA256); - break; - case CKM_ECDSA_SHA384: - ADD_ALGO_EXT(ECDSA_SHA384, signature, prop, - p11prov_ecdsa_sha384_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA384); - break; - case CKM_ECDSA_SHA512: - ADD_ALGO_EXT(ECDSA_SHA512, signature, prop, - p11prov_ecdsa_sha512_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA512); - break; - case CKM_ECDSA_SHA3_224: - ADD_ALGO_EXT(ECDSA_SHA3_224, signature, prop, - p11prov_ecdsa_sha3_224_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_224); - break; - case CKM_ECDSA_SHA3_256: - ADD_ALGO_EXT(ECDSA_SHA3_256, signature, prop, - p11prov_ecdsa_sha3_256_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_256); - break; - case CKM_ECDSA_SHA3_384: - ADD_ALGO_EXT(ECDSA_SHA3_384, signature, prop, - p11prov_ecdsa_sha3_384_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_384); - break; - case CKM_ECDSA_SHA3_512: - ADD_ALGO_EXT(ECDSA_SHA3_512, signature, prop, - p11prov_ecdsa_sha3_512_signature_functions); - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA3_512); - break; -#else - case CKM_ECDSA_SHA1: - case CKM_ECDSA_SHA224: - case CKM_ECDSA_SHA256: - case CKM_ECDSA_SHA384: - case CKM_ECDSA_SHA512: - case CKM_ECDSA_SHA3_224: - case CKM_ECDSA_SHA3_256: - case CKM_ECDSA_SHA3_384: - case CKM_ECDSA_SHA3_512: - add_ecdsasig = true; - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDSA_SHA1, - CKM_ECDSA_SHA224, CKM_ECDSA_SHA256, - CKM_ECDSA_SHA384, CKM_ECDSA_SHA512, - CKM_ECDSA_SHA3_224, CKM_ECDSA_SHA3_256, - CKM_ECDSA_SHA3_384, CKM_ECDSA_SHA3_512); - break; -#endif - case CKM_ECDH1_DERIVE: - case CKM_ECDH1_COFACTOR_DERIVE: - ADD_ALGO(ECDH, ecdh, exchange, prop); - UNCHECK_MECHS(CKM_EC_KEY_PAIR_GEN, CKM_ECDH1_DERIVE, - CKM_ECDH1_COFACTOR_DERIVE); - break; - case CKM_HKDF_DERIVE: - ADD_ALGO(HKDF, hkdf, kdf, prop); - ADD_ALGO(TLS13_KDF, tls13, kdf, prop); - ADD_ALGO(HKDF, hkdf, exchange, prop); - UNCHECK_MECHS(CKM_HKDF_DERIVE); - break; - case CKM_SHA_1: - ADD_ALGO(SHA1, sha1, digest, prop); - UNCHECK_MECHS(CKM_SHA_1); - break; - case CKM_SHA224: - ADD_ALGO(SHA2_224, sha224, digest, prop); - UNCHECK_MECHS(CKM_SHA224); - break; - case CKM_SHA256: - ADD_ALGO(SHA2_256, sha256, digest, prop); - UNCHECK_MECHS(CKM_SHA256); - break; - case CKM_SHA384: - ADD_ALGO(SHA2_384, sha384, digest, prop); - UNCHECK_MECHS(CKM_SHA384); - break; - case CKM_SHA512: - ADD_ALGO(SHA2_512, sha512, digest, prop); - UNCHECK_MECHS(CKM_SHA512); - break; - case CKM_SHA512_224: - ADD_ALGO(SHA2_512_224, sha512_224, digest, prop); - UNCHECK_MECHS(CKM_SHA512_224); - break; - case CKM_SHA512_256: - ADD_ALGO(SHA2_512_256, sha512_256, digest, prop); - UNCHECK_MECHS(CKM_SHA512_256); - break; - case CKM_SHA3_224: - ADD_ALGO(SHA3_224, sha3_224, digest, prop); - UNCHECK_MECHS(CKM_SHA3_224); - break; - case CKM_SHA3_256: - ADD_ALGO(SHA3_256, sha3_256, digest, prop); - UNCHECK_MECHS(CKM_SHA3_256); - break; - case CKM_SHA3_384: - ADD_ALGO(SHA3_384, sha3_384, digest, prop); - UNCHECK_MECHS(CKM_SHA3_384); - break; - case CKM_SHA3_512: - ADD_ALGO(SHA3_512, sha3_512, digest, prop); - UNCHECK_MECHS(CKM_SHA3_512); - break; - case CKM_EDDSA: - case CKM_EC_EDWARDS_KEY_PAIR_GEN: - ADD_ALGO_EXT(ED25519, signature, prop, - p11prov_ed25519_signature_functions); - ADD_ALGO_EXT(ED448, signature, prop, - p11prov_ed448_signature_functions); - UNCHECK_MECHS(CKM_EC_EDWARDS_KEY_PAIR_GEN, CKM_EDDSA); -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) - ADD_ALGO_EXT(ED25519ph, signature, prop, - p11prov_ed25519ph_signature_functions); - ADD_ALGO_EXT(ED25519ctx, signature, prop, - p11prov_ed25519ctx_signature_functions); - ADD_ALGO_EXT(ED448ph, signature, prop, - p11prov_ed448ph_signature_functions); -#endif - break; - case CKM_EC_MONTGOMERY_KEY_PAIR_GEN: - ADD_ALGO(X25519, x25519, exchange, prop); - ADD_ALGO(X448, x448, exchange, prop); - break; - case CKM_ML_DSA: - case CKM_ML_DSA_KEY_PAIR_GEN: - ADD_ALGO_EXT(ML_DSA_44, signature, prop, - p11prov_mldsa_44_signature_functions); - ADD_ALGO_EXT(ML_DSA_65, signature, prop, - p11prov_mldsa_65_signature_functions); - ADD_ALGO_EXT(ML_DSA_87, signature, prop, - p11prov_mldsa_87_signature_functions); - UNCHECK_MECHS(CKM_ML_DSA_KEY_PAIR_GEN, CKM_ML_DSA); - break; - case CKM_ML_KEM: - case CKM_ML_KEM_KEY_PAIR_GEN: - ADD_ALGO_EXT(ML_KEM_512, kem, prop, - p11prov_mlkem_kem_functions); - ADD_ALGO_EXT(ML_KEM_768, kem, prop, - p11prov_mlkem_kem_functions); - ADD_ALGO_EXT(ML_KEM_1024, kem, prop, - p11prov_mlkem_kem_functions); - UNCHECK_MECHS(CKM_ML_KEM_KEY_PAIR_GEN, CKM_ML_KEM); - break; - case CKM_SLH_DSA: - case CKM_SLH_DSA_KEY_PAIR_GEN: - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, signature, prop, - p11prov_slhdsa_sha2_128s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, signature, prop, - p11prov_slhdsa_sha2_128f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, signature, prop, - p11prov_slhdsa_sha2_192s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, signature, prop, - p11prov_slhdsa_sha2_192f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, signature, prop, - p11prov_slhdsa_sha2_256s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, signature, prop, - p11prov_slhdsa_sha2_256f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, signature, prop, - p11prov_slhdsa_shake_128s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, signature, prop, - p11prov_slhdsa_shake_128f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, signature, prop, - p11prov_slhdsa_shake_192s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, signature, prop, - p11prov_slhdsa_shake_192f_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, signature, prop, - p11prov_slhdsa_shake_256s_signature_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, signature, prop, - p11prov_slhdsa_shake_256f_signature_functions); - UNCHECK_MECHS(CKM_SLH_DSA_KEY_PAIR_GEN, CKM_SLH_DSA); - break; #if SKEY_SUPPORT == 1 - case CKM_AES_ECB: - ADD_ALGO(AES_256_ECB, aes256ecb, cipher, prop); - ADD_ALGO(AES_192_ECB, aes192ecb, cipher, prop); - ADD_ALGO(AES_128_ECB, aes128ecb, cipher, prop); - UNCHECK_MECHS(CKM_AES_ECB); - break; - case CKM_AES_CBC: - case CKM_AES_CBC_PAD: - ADD_ALGO(AES_256_CBC, aes256cbc, cipher, prop); - ADD_ALGO(AES_192_CBC, aes192cbc, cipher, prop); - ADD_ALGO(AES_128_CBC, aes128cbc, cipher, prop); - UNCHECK_MECHS(CKM_AES_CBC); - UNCHECK_MECHS(CKM_AES_CBC_PAD); - break; - case CKM_AES_OFB: - ADD_ALGO(AES_256_OFB, aes256ofb, cipher, prop); - ADD_ALGO(AES_192_OFB, aes192ofb, cipher, prop); - ADD_ALGO(AES_128_OFB, aes128ofb, cipher, prop); - UNCHECK_MECHS(CKM_AES_OFB); - break; - case CKM_AES_CFB128: - ADD_ALGO(AES_256_CFB, aes256cfb, cipher, prop); - ADD_ALGO(AES_192_CFB, aes192cfb, cipher, prop); - ADD_ALGO(AES_128_CFB, aes128cfb, cipher, prop); - UNCHECK_MECHS(CKM_AES_CFB128); - break; - case CKM_AES_CFB1: - ADD_ALGO(AES_256_CFB1, aes256cfb1, cipher, prop); - ADD_ALGO(AES_192_CFB1, aes192cfb1, cipher, prop); - ADD_ALGO(AES_128_CFB1, aes128cfb1, cipher, prop); - UNCHECK_MECHS(CKM_AES_CFB1); - break; - case CKM_AES_CFB8: - ADD_ALGO(AES_256_CFB8, aes256cfb8, cipher, prop); - ADD_ALGO(AES_192_CFB8, aes192cfb8, cipher, prop); - ADD_ALGO(AES_128_CFB8, aes128cfb8, cipher, prop); - UNCHECK_MECHS(CKM_AES_CFB8); - break; - case CKM_AES_CTR: - ADD_ALGO(AES_256_CTR, aes256ctr, cipher, prop); - ADD_ALGO(AES_192_CTR, aes192ctr, cipher, prop); - ADD_ALGO(AES_128_CTR, aes128ctr, cipher, prop); - UNCHECK_MECHS(CKM_AES_CTR); - break; - case CKM_AES_CTS: - ADD_ALGO(AES_256_CTS, aes256cts, cipher, prop); - ADD_ALGO(AES_192_CTS, aes192cts, cipher, prop); - ADD_ALGO(AES_128_CTS, aes128cts, cipher, prop); - UNCHECK_MECHS(CKM_AES_CTS); - break; - case CKM_AES_GCM: - ADD_ALGO(AES_256_GCM, aes256gcm, cipher, prop); - ADD_ALGO(AES_192_GCM, aes192gcm, cipher, prop); - ADD_ALGO(AES_128_GCM, aes128gcm, cipher, prop); - UNCHECK_MECHS(CKM_AES_GCM); - break; - case CKM_CHACHA20_POLY1305: - ADD_ALGO(CHACHA20_POLY1305, chacha20256poly1305, cipher, prop); - UNCHECK_MECHS(CKM_CHACHA20_POLY1305); - break; + ret = p11prov_register_ciphers(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } #endif - default: - P11PROV_raise(ctx, CKR_GENERAL_ERROR, "Unhandled mechanism %lu", - mech); - break; - } - } + + /* mac - none supported yet */ + + ret = p11prov_register_kdfs(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } + + ret = p11prov_register_random(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; } - p11prov_return_slots(slots); + /* keymgmt -> static */ - if (add_rsasig) { - ADD_ALGO(RSA, rsa, signature, prop); + ret = p11prov_register_keyexch(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; } - if (add_ecdsasig) { - ADD_ALGO(ECDSA, ecdsa, signature, prop); + + ret = p11prov_register_signatures(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; } - if (add_rsaenc) { - ADD_ALGO(RSA, rsa, asym_cipher, prop); + + ret = p11prov_register_asym_ciphers(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; } - /* terminations */ - TERM_ALGO(digest); - TERM_ALGO(kdf); - TERM_ALGO(exchange); - TERM_ALGO(signature); - TERM_ALGO(asym_cipher); - TERM_ALGO(kem); -#if SKEY_SUPPORT == 1 - TERM_ALGO(cipher); -#endif - /* handle random */ - ret = p11prov_check_random(ctx); - if (ret == CKR_OK) { - ADD_ALGO_EXT(RAND, random, prop, p11prov_rand_functions); - TERM_ALGO(random); + ret = p11prov_register_kems(ctx, available_mechs, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; } + /* skeymgmt -> static */ + + /* encoder -> static */ + + /* decoder -> static */ + + /* store -> static */ + return CKR_OK; } static CK_RV static_operations_init(P11PROV_CTX *ctx) { - int encoder_idx = 0; - int decoder_idx = 0; - int store_idx = 0; - int keymgmt_idx = 0; -#if SKEY_SUPPORT == 1 - int skeymgmt_idx = 0; -#endif - const char *prop = get_default_properties(ctx); - -/* encoder */ -#define DEFAULT_PROPERTY(prop) \ - (ctx->assume_fips ? P11PROV_FIPS_PROPERTIES prop \ - : P11PROV_DEFAULT_PROPERTIES prop) - - ADD_ALGO_EXT(RSA, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_rsa_encoder_text_functions); - ADD_ALGO_EXT(RSA, encoder, DEFAULT_PROPERTY(",output=der,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_der_functions); - ADD_ALGO_EXT(RSA, encoder, DEFAULT_PROPERTY(",output=pem,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_pem_functions); - ADD_ALGO_EXT(RSA, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_der_functions); - ADD_ALGO_EXT(RSA, encoder, - DEFAULT_PROPERTY(",output=pem,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_pem_functions); - ADD_ALGO_EXT(RSAPSS, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_rsa_encoder_text_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=der,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_der_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=pem,structure=pkcs1"), - p11prov_rsa_encoder_pkcs1_pem_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_der_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=pem,structure=SubjectPublicKeyInfo"), - p11prov_rsa_encoder_spki_pem_functions); - ADD_ALGO_EXT(EC, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_encoder_text_functions); - ADD_ALGO_EXT(EC, encoder, DEFAULT_PROPERTY(",output=der,structure=pkcs1"), - p11prov_ec_encoder_pkcs1_der_functions); - ADD_ALGO_EXT(EC, encoder, DEFAULT_PROPERTY(",output=pem,structure=pkcs1"), - p11prov_ec_encoder_pkcs1_pem_functions); - ADD_ALGO_EXT(EC, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_ec_encoder_spki_der_functions); - ADD_ALGO_EXT(ED25519, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_edwards_encoder_text_functions); - ADD_ALGO_EXT(ED448, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_edwards_encoder_text_functions); - ADD_ALGO_EXT(X25519, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_montgomery_encoder_text_functions); - ADD_ALGO_EXT(X448, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_ec_montgomery_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_44, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mldsa_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_44, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mldsa_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_DSA_65, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mldsa_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_65, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mldsa_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_DSA_87, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mldsa_encoder_text_functions); - ADD_ALGO_EXT(ML_DSA_87, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mldsa_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_KEM_512, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mlkem_encoder_text_functions); - ADD_ALGO_EXT(ML_KEM_512, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mlkem_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_KEM_768, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mlkem_encoder_text_functions); - ADD_ALGO_EXT(ML_KEM_768, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mlkem_encoder_spki_der_functions); - ADD_ALGO_EXT(ML_KEM_1024, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_mlkem_encoder_text_functions); - ADD_ALGO_EXT(ML_KEM_1024, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_mlkem_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, encoder, DEFAULT_PROPERTY(",output=text"), - p11prov_slhdsa_encoder_text_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, encoder, - DEFAULT_PROPERTY(",output=der,structure=SubjectPublicKeyInfo"), - p11prov_slhdsa_encoder_spki_der_functions); - if (ctx->encode_pkey_as_pk11_uri) { - ADD_ALGO_EXT(RSA, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_rsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(RSAPSS, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_rsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(EC, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ED25519, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_edwards_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ED448, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_edwards_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(X25519, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_montgomery_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(X448, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_ec_montgomery_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_DSA_44, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mldsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_DSA_65, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mldsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_DSA_87, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mldsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_KEM_512, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mlkem_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_KEM_768, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mlkem_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(ML_KEM_1024, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_mlkem_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, encoder, - DEFAULT_PROPERTY(",output=pem,structure=PrivateKeyInfo"), - p11prov_slhdsa_encoder_priv_key_info_pem_functions); - } - - TERM_ALGO(encoder); - -#define DER_DECODER_PROP ",input=der,structure=" P11PROV_DER_STRUCTURE - /* decoder */ - ADD_ALGO_EXT(DER, decoder, DEFAULT_PROPERTY(",input=pem"), - p11prov_pem_decoder_p11prov_der_functions); - ADD_ALGO_EXT(RSA, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_rsa_functions); - ADD_ALGO_EXT(RSAPSS, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_rsa_functions); - ADD_ALGO_EXT(EC, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_ec_functions); - ADD_ALGO_EXT(ED25519, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_ed25519_functions); - ADD_ALGO_EXT(ED448, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_ed448_functions); - ADD_ALGO_EXT(X25519, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_x25519_functions); - ADD_ALGO_EXT(X448, decoder, DEFAULT_PROPERTY(DER_DECODER_PROP), - p11prov_der_decoder_p11prov_x448_functions); - TERM_ALGO(decoder); -#undef DEFAULT_PROPERTY - - /* store */ - ADD_ALGO_EXT(URI, store, prop, p11prov_store_functions); - TERM_ALGO(store); - - /* keymgmt */ - ADD_ALGO(RSA, rsa, keymgmt, prop); - ADD_ALGO(RSAPSS, rsapss, keymgmt, prop); - ADD_ALGO(EC, ec, keymgmt, prop); - ADD_ALGO(HKDF, hkdf, keymgmt, prop); - ADD_ALGO_EXT(ED25519, keymgmt, prop, p11prov_ed25519_keymgmt_functions); - ADD_ALGO_EXT(ED448, keymgmt, prop, p11prov_ed448_keymgmt_functions); - ADD_ALGO_EXT(X25519, keymgmt, prop, p11prov_x25519_keymgmt_functions); - ADD_ALGO_EXT(X448, keymgmt, prop, p11prov_x448_keymgmt_functions); - ADD_ALGO_EXT(ML_DSA_44, keymgmt, prop, p11prov_mldsa44_keymgmt_functions); - ADD_ALGO_EXT(ML_DSA_65, keymgmt, prop, p11prov_mldsa65_keymgmt_functions); - ADD_ALGO_EXT(ML_DSA_87, keymgmt, prop, p11prov_mldsa87_keymgmt_functions); - ADD_ALGO_EXT(ML_KEM_512, keymgmt, prop, p11prov_mlkem512_keymgmt_functions); - ADD_ALGO_EXT(ML_KEM_768, keymgmt, prop, p11prov_mlkem768_keymgmt_functions); - ADD_ALGO_EXT(ML_KEM_1024, keymgmt, prop, - p11prov_mlkem1024_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128S, keymgmt, prop, - p11prov_slhdsa_sha2_128s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_128F, keymgmt, prop, - p11prov_slhdsa_sha2_128f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192S, keymgmt, prop, - p11prov_slhdsa_sha2_192s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_192F, keymgmt, prop, - p11prov_slhdsa_sha2_192f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256S, keymgmt, prop, - p11prov_slhdsa_sha2_256s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHA2_256F, keymgmt, prop, - p11prov_slhdsa_sha2_256f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128S, keymgmt, prop, - p11prov_slhdsa_shake_128s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_128F, keymgmt, prop, - p11prov_slhdsa_shake_128f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192S, keymgmt, prop, - p11prov_slhdsa_shake_192s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_192F, keymgmt, prop, - p11prov_slhdsa_shake_192f_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256S, keymgmt, prop, - p11prov_slhdsa_shake_256s_keymgmt_functions); - ADD_ALGO_EXT(SLH_DSA_SHAKE_256F, keymgmt, prop, - p11prov_slhdsa_shake_256f_keymgmt_functions); - TERM_ALGO(keymgmt); + CK_RV ret; + + ret = p11prov_register_kmgmt(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } #if SKEY_SUPPORT == 1 - /* skeymgmt */ - ADD_ALGO(AES, aes, skeymgmt, prop); - ADD_ALGO(GENERIC_SECRET, generic_secret, skeymgmt, prop); - TERM_ALGO(skeymgmt); + ret = p11prov_register_skmgmt(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } #endif + ret = p11prov_register_encoders(ctx, ctx->assume_fips, + ctx->encode_pkey_as_pk11_uri); + if (ret != CKR_OK) { + return ret; + } + + ret = p11prov_register_decoders(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } + + ret = p11prov_register_store(ctx, ctx->assume_fips); + if (ret != CKR_OK) { + return ret; + } + return CKR_OK; } @@ -1747,7 +1038,7 @@ p11prov_query_operation(void *provctx, int operation_id, int *no_cache) return ctx->op_keymgmt; case OSSL_OP_KEYEXCH: *no_cache = ctx->status == P11PROV_UNINITIALIZED ? 1 : 0; - return ctx->op_exchange; + return ctx->op_keyexch; case OSSL_OP_SIGNATURE: *no_cache = ctx->status == P11PROV_UNINITIALIZED ? 1 : 0; return ctx->op_signature; diff --git a/src/provider.h b/src/provider.h index d0cf4a26..1b7f6d4c 100644 --- a/src/provider.h +++ b/src/provider.h @@ -36,260 +36,14 @@ #define RET_OSSL_ERR 0 #define RET_OSSL_BAD -1 -#define P11PROV_DEFAULT_PROPERTIES "provider=pkcs11" -#define P11PROV_FIPS_PROPERTIES "provider=pkcs11,fips=yes" -#define P11PROV_DEFAULT_PROVIDER "provider=default" - -#define P11PROV_NAME_RSA "RSA" -#define P11PROV_NAMES_RSA "RSA:rsaEncryption:1.2.840.113549.1.1.1" -#define P11PROV_DESCS_RSA "PKCS11 RSA Implementation" -#define P11PROV_NAME_RSAPSS "RSA-PSS" -#define P11PROV_NAMES_RSAPSS "RSA-PSS:RSASSA-PSS:1.2.840.113549.1.1.10" -#define P11PROV_DESCS_RSAPSS "PKCS11 RSA PSS Implementation" -#define P11PROV_NAMES_RSA_SHA1 \ - "RSA-SHA1:RSA-SHA-1:sha1WithRSAEncryption:1.2.840.113549.1.1.5" -#define P11PROV_DESCS_RSA_SHA1 "PKCS11 RSA-SHA1 Implementation" -#define P11PROV_NAMES_RSA_SHA256 \ - "RSA-SHA2-256:RSA-SHA256:sha256WithRSAEncryption:1.2.840.113549.1.1.11" -#define P11PROV_DESCS_RSA_SHA256 "PKCS11 RSA-SHA256 Implementation" -#define P11PROV_NAMES_RSA_SHA384 \ - "RSA-SHA2-384:RSA-SHA384:sha384WithRSAEncryption:1.2.840.113549.1.1.12" -#define P11PROV_DESCS_RSA_SHA384 "PKCS11 RSA-SHA384 Implementation" -#define P11PROV_NAMES_RSA_SHA512 \ - "RSA-SHA2-512:RSA-SHA512:sha512WithRSAEncryption:1.2.840.113549.1.1.13" -#define P11PROV_DESCS_RSA_SHA512 "PKCS11 RSA-SHA512 Implementation" -#define P11PROV_NAMES_RSA_SHA224 \ - "RSA-SHA2-224:RSA-SHA224:sha224WithRSAEncryption:1.2.840.113549.1.1.14" -#define P11PROV_DESCS_RSA_SHA224 "PKCS11 RSA-SHA224 Implementation" -#define P11PROV_NAMES_RSA_SHA3_224 \ - "RSA-SHA3-224:id-rsassa-pkcs1-v1_5-with-sha3-224:2.16.840.1.101.3.4.3.13" -#define P11PROV_DESCS_RSA_SHA3_224 "PKCS11 RSA-SHA3_224 Implementation" -#define P11PROV_NAMES_RSA_SHA3_256 \ - "RSA-SHA3-256:id-rsassa-pkcs1-v1_5-with-sha3-256:2.16.840.1.101.3.4.3.14" -#define P11PROV_DESCS_RSA_SHA3_256 "PKCS11 RSA-SHA3_256 Implementation" -#define P11PROV_NAMES_RSA_SHA3_384 \ - "RSA-SHA3-384:id-rsassa-pkcs1-v1_5-with-sha3-384:2.16.840.1.101.3.4.3.15" -#define P11PROV_DESCS_RSA_SHA3_384 "PKCS11 RSA-SHA3_384 Implementation" -#define P11PROV_NAMES_RSA_SHA3_512 \ - "RSA-SHA3-512:id-rsassa-pkcs1-v1_5-with-sha3-512:2.16.840.1.101.3.4.3.16" -#define P11PROV_DESCS_RSA_SHA3_512 "PKCS11 RSA-SHA3_512 Implementation" -#define P11PROV_NAME_EC "EC" -#define P11PROV_NAMES_EC "EC:id-ecPublicKey:1.2.840.10045.2.1" -#define P11PROV_DESCS_EC "PKCS11 EC Implementation" -#define P11PROV_NAME_ECDSA "ECDSA" -#define P11PROV_NAMES_ECDSA P11PROV_NAME_ECDSA -#define P11PROV_DESCS_ECDSA "PKCS11 ECDSA Implementation" -#define P11PROV_NAMES_ECDSA_SHA1 \ - "ECDSA-SHA1:ECDSA-SHA-1:ecdsa-with-SHA1:1.2.840.10045.4.1" -#define P11PROV_DESCS_ECDSA_SHA1 "PKCS11 ECDSA-SHA1 Implementation" -#define P11PROV_NAMES_ECDSA_SHA224 \ - "ECDSA-SHA2-224:ECDSA-SHA224:ecdsa-with-SHA224:1.2.840.10045.4.3.1" -#define P11PROV_DESCS_ECDSA_SHA224 "PKCS11 ECDSA-SHA224 Implementation" -#define P11PROV_NAMES_ECDSA_SHA256 \ - "ECDSA-SHA2-256:ECDSA-SHA256:ecdsa-with-SHA256:1.2.840.10045.4.3.2" -#define P11PROV_DESCS_ECDSA_SHA256 "PKCS11 ECDSA-SHA256 Implementation" -#define P11PROV_NAMES_ECDSA_SHA384 \ - "ECDSA-SHA2-384:ECDSA-SHA384:ecdsa-with-SHA384:1.2.840.10045.4.3.3" -#define P11PROV_DESCS_ECDSA_SHA384 "PKCS11 ECDSA-SHA384 Implementation" -#define P11PROV_NAMES_ECDSA_SHA512 \ - "ECDSA-SHA2-512:ECDSA-SHA512:ecdsa-with-SHA512:1.2.840.10045.4.3.4" -#define P11PROV_DESCS_ECDSA_SHA512 "PKCS11 ECDSA-SHA512 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_224 \ - "ECDSA-SHA3-224:ecdsa_with_SHA3-224:id-ecdsa-with-sha3-224:2.16.840.1." \ - "101.3.4.3.9" -#define P11PROV_DESCS_ECDSA_SHA3_224 "PKCS11 ECDSA-SHA3_224 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_256 \ - "ECDSA-SHA3-256:ecdsa_with_SHA3-256:id-ecdsa-with-sha3-256:2.16.840.1." \ - "101.3.4.3.10" -#define P11PROV_DESCS_ECDSA_SHA3_256 "PKCS11 ECDSA-SHA3_256 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_384 \ - "ECDSA-SHA3-384:ecdsa_with_SHA3-384:id-ecdsa-with-sha3-384:2.16.840.1." \ - "101.3.4.3.11" -#define P11PROV_DESCS_ECDSA_SHA3_384 "PKCS11 ECDSA-SHA3_384 Implementation" -#define P11PROV_NAMES_ECDSA_SHA3_512 \ - "ECDSA-SHA3-512:ecdsa_with_SHA3-512:id-ecdsa-with-sha3-512:2.16.840.1." \ - "101.3.4.3.12" -#define P11PROV_DESCS_ECDSA_SHA3_512 "PKCS11 ECDSA-SHA3_512 Implementation" -#define P11PROV_NAME_ECDH "ECDH" -#define P11PROV_NAMES_ECDH P11PROV_NAME_ECDH -#define P11PROV_DESCS_ECDH "PKCS11 ECDH Implementation" -#define P11PROV_NAME_HKDF "HKDF" -#define P11PROV_NAMES_HKDF P11PROV_NAME_HKDF -#define P11PROV_DESCS_HKDF "PKCS11 HKDF Implementation" -#define P11PROV_NAMES_ED25519 "ED25519:1.3.101.112" -#define P11PROV_NAME_ED25519 "ED25519" -#define P11PROV_DESCS_ED25519 "PKCS11 ED25519 Implementation" -#define P11PROV_NAMES_ED25519ph "ED25519ph" -#define P11PROV_DESCS_ED25519ph "PKCS11 ED25519ph implementation" -#define P11PROV_NAMES_ED25519ctx "ED25519ctx" -#define P11PROV_DESCS_ED25519ctx "PKCS11 ED25519ctx implementation" -#define P11PROV_NAMES_ED448 "ED448:1.3.101.113" -#define P11PROV_NAME_ED448 "ED448" -#define P11PROV_DESCS_ED448 "PKCS11 ED448 Implementation" -#define P11PROV_NAMES_ED448ph "ED448ph" -#define P11PROV_DESCS_ED448ph "PKCS11 ED448ph implementation" -#define P11PROV_NAMES_X25519 "X25519:1.3.101.110" -#define P11PROV_NAME_X25519 "X25519" -#define P11PROV_DESCS_X25519 "PKCS11 X25519 Implementation" -#define P11PROV_NAMES_X448 "X448:1.3.101.111" -#define P11PROV_NAME_X448 "X448" -#define P11PROV_DESCS_X448 "PKCS11 X448 Implementation" -#define P11PROV_NAMES_ML_DSA_44 \ - "ML-DSA-44:MLDSA44:2.16.840.1.101.3.4.3.17:id-ml-dsa-44" -#define P11PROV_DESCS_ML_DSA_44 "PKCS11 ML-DSA-44 implementation" -#define P11PROV_NAMES_ML_DSA_65 \ - "ML-DSA-65:MLDSA65:2.16.840.1.101.3.4.3.18:id-ml-dsa-65" -#define P11PROV_DESCS_ML_DSA_65 "PKCS11 ML-DSA-65 implementation" -#define P11PROV_NAMES_ML_DSA_87 \ - "ML-DSA-87:MLDSA87:2.16.840.1.101.3.4.3.19:id-ml-dsa-87" -#define P11PROV_DESCS_ML_DSA_87 "PKCS11 ML-DSA-87 implementation" -#define P11PROV_NAMES_ML_KEM_512 \ - "ML-KEM-512:MLKEM512:id-alg-ml-kem-512:2.16.840.1.101.3.4.4.1" -#define P11PROV_DESCS_ML_KEM_512 "PKCS11 ML-KEM-512 implementation" -#define P11PROV_NAMES_ML_KEM_768 \ - "ML-KEM-768:MLKEM768:id-alg-ml-kem-768:2.16.840.1.101.3.4.4.2" -#define P11PROV_DESCS_ML_KEM_768 "PKCS11 ML-KEM-768 implementation" -#define P11PROV_NAMES_ML_KEM_1024 \ - "ML-KEM-1024:MLKEM1024:id-alg-ml-kem-1024:2.16.840.1.101.3.4.4.3" -#define P11PROV_DESCS_ML_KEM_1024 "PKCS11 ML-KEM-1024 implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_128S \ - "SLH-DSA-SHA2-128s:2.16.840.1.101.3.4.3.20" -#define P11PROV_DESCS_SLH_DSA_SHA2_128S \ - "PKCS11 SLH-DSA-SHA2-128s implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_128F \ - "SLH-DSA-SHA2-128f:2.16.840.1.101.3.4.3.21" -#define P11PROV_DESCS_SLH_DSA_SHA2_128F \ - "PKCS11 SLH-DSA-SHA2-128f implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_192S \ - "SLH-DSA-SHA2-192s:2.16.840.1.101.3.4.3.22" -#define P11PROV_DESCS_SLH_DSA_SHA2_192S \ - "PKCS11 SLH-DSA-SHA2-192s implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_192F \ - "SLH-DSA-SHA2-192f:2.16.840.1.101.3.4.3.23" -#define P11PROV_DESCS_SLH_DSA_SHA2_192F \ - "PKCS11 SLH-DSA-SHA2-192f implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_256S \ - "SLH-DSA-SHA2-256s:2.16.840.1.101.3.4.3.24" -#define P11PROV_DESCS_SLH_DSA_SHA2_256S \ - "PKCS11 SLH-DSA-SHA2-256s implementation" -#define P11PROV_NAMES_SLH_DSA_SHA2_256F \ - "SLH-DSA-SHA2-256f:2.16.840.1.101.3.4.3.25" -#define P11PROV_DESCS_SLH_DSA_SHA2_256F \ - "PKCS11 SLH-DSA-SHA2-256f implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_128S \ - "SLH-DSA-SHAKE-128s:2.16.840.1.101.3.4.3.26" -#define P11PROV_DESCS_SLH_DSA_SHAKE_128S \ - "PKCS11 SLH-DSA-SHAKE-128s implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_128F \ - "SLH-DSA-SHAKE-128f:2.16.840.1.101.3.4.3.27" -#define P11PROV_DESCS_SLH_DSA_SHAKE_128F \ - "PKCS11 SLH-DSA-SHAKE-128f implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_192S \ - "SLH-DSA-SHAKE-192s:2.16.840.1.101.3.4.3.28" -#define P11PROV_DESCS_SLH_DSA_SHAKE_192S \ - "PKCS11 SLH-DSA-SHAKE-192s implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_192F \ - "SLH-DSA-SHAKE-192f:2.16.840.1.101.3.4.3.29" -#define P11PROV_DESCS_SLH_DSA_SHAKE_192F \ - "PKCS11 SLH-DSA-SHAKE-192f implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_256S \ - "SLH-DSA-SHAKE-256s:2.16.840.1.101.3.4.3.30" -#define P11PROV_DESCS_SLH_DSA_SHAKE_256S \ - "PKCS11 SLH-DSA-SHAKE-256s implementation" -#define P11PROV_NAMES_SLH_DSA_SHAKE_256F \ - "SLH-DSA-SHAKE-256f:2.16.840.1.101.3.4.3.31" -#define P11PROV_DESCS_SLH_DSA_SHAKE_256F \ - "PKCS11 SLH-DSA-SHAKE-256f implementation" -#define P11PROV_NAMES_RAND "PKCS11-RAND" -#define P11PROV_DESCS_RAND "PKCS11 Random Generator" -#define P11PROV_NAME_CERTIFICATE "CERTIFICATE" -#define P11PROV_NAME_TLS13_KDF "TLS13-KDF" -#define P11PROV_NAMES_TLS13_KDF P11PROV_NAME_TLS13_KDF -#define P11PROV_DESCS_TLS13_KDF "PKCS11 TLS 1.3 HKDF Implementation" -#define P11PROV_NAMES_DER "DER" -#define P11PROV_DESCS_DER "DER decoder implementation in PKCS11 provider" -#define P11PROV_NAMES_URI "pkcs11" -#define P11PROV_DESCS_URI "PKCS11 URI Store" - #define P11PROV_PARAM_URI "pkcs11_uri" #define P11PROV_PARAM_EPHEMERAL "pkcs11_ephemeral" #define P11PROV_PARAM_KEY_USAGE "pkcs11_key_usage" #define P11PROV_PARAM_SLOT_ID "pkcs11_slot_id" #if SKEY_SUPPORT == 1 - -#define P11PROV_NAME_GENERIC_SECRET "GENERIC-SECRET" - #define P11PROV_NAME_AES "AES" -#define P11PROV_NAMES_AES "AES:2.16.840.1.101.3.4.1" -#define P11PROV_DESCS_AES "PKCS11 AES Implementation" -#define P11PROV_NAMES_AES_256_ECB "AES-256-ECB:2.16.840.1.101.3.4.1.41" -#define P11PROV_DESCS_AES_256_ECB "AES-256 ECB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_ECB "AES-192-ECB:2.16.840.1.101.3.4.1.21" -#define P11PROV_DESCS_AES_192_ECB "AES-192 ECB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_ECB "AES-128-ECB:2.16.840.1.101.3.4.1.1" -#define P11PROV_DESCS_AES_128_ECB "AES-128 ECB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CBC \ - "AES-256-CBC:AES256:aes256:2.16.840.1.101.3.4.1.42" -#define P11PROV_DESCS_AES_256_CBC "AES-256 CBC PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CBC \ - "AES-192-CBC:AES192:aes192:2.16.840.1.101.3.4.1.22" -#define P11PROV_DESCS_AES_192_CBC "AES-192 CBC PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CBC \ - "AES-128-CBC:AES128:aes128:2.16.840.1.101.3.4.1.2" -#define P11PROV_DESCS_AES_128_CBC "AES-128 CBC PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_OFB "AES-256-OFB:2.16.840.1.101.3.4.1.43" -#define P11PROV_DESCS_AES_256_OFB "AES-256 OFB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_OFB "AES-192-OFB:2.16.840.1.101.3.4.1.23" -#define P11PROV_DESCS_AES_192_OFB "AES-192 OFB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_OFB "AES-128-OFB:2.16.840.1.101.3.4.1.3" -#define P11PROV_DESCS_AES_128_OFB "AES-128 OFB PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CFB "AES-256-CFB:2.16.840.1.101.3.4.1.44" -#define P11PROV_DESCS_AES_256_CFB \ - "AES-256 CFB128 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CFB "AES-192-CFB:2.16.840.1.101.3.4.1.24" -#define P11PROV_DESCS_AES_192_CFB \ - "AES-192 CFB128 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CFB "AES-128-CFB:2.16.840.1.101.3.4.1.4" -#define P11PROV_DESCS_AES_128_CFB \ - "AES-128 CFB128 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CFB1 "AES-256-CFB1" -#define P11PROV_DESCS_AES_256_CFB1 "AES-256 CFB1 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CFB1 "AES-192-CFB1" -#define P11PROV_DESCS_AES_192_CFB1 "AES-192 CFB1 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CFB1 "AES-128-CFB1" -#define P11PROV_DESCS_AES_128_CFB1 "AES-128 CFB1 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CFB8 "AES-256-CFB8" -#define P11PROV_DESCS_AES_256_CFB8 "AES-256 CFB8 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CFB8 "AES-192-CFB8" -#define P11PROV_DESCS_AES_192_CFB8 "AES-192 CFB8 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CFB8 "AES-128-CFB8" -#define P11PROV_DESCS_AES_128_CFB8 "AES-128 CFB8 PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CTR "AES-256-CTR" -#define P11PROV_DESCS_AES_256_CTR "AES-256 CTR PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CTR "AES-192-CTR" -#define P11PROV_DESCS_AES_192_CTR "AES-192 CTR PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CTR "AES-128-CTR" -#define P11PROV_DESCS_AES_128_CTR "AES-128 CTR PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_CTS "AES-256-CBC-CTS" -#define P11PROV_DESCS_AES_256_CTS "AES-256 CTS PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_CTS "AES-192-CBC-CTS" -#define P11PROV_DESCS_AES_192_CTS "AES-192 CTS PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_CTS "AES-128-CBC-CTS" -#define P11PROV_DESCS_AES_128_CTS "AES-128 CTS PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_256_GCM "AES-256-GCM" -#define P11PROV_DESCS_AES_256_GCM "AES-256 GCM PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_192_GCM "AES-192-GCM" -#define P11PROV_DESCS_AES_192_GCM "AES-192 GCM PKCS11 Provider Implementation" -#define P11PROV_NAMES_AES_128_GCM "AES-128-GCM" -#define P11PROV_DESCS_AES_128_GCM "AES-128 GCM PKCS11 Provider Implementation" -#define P11PROV_NAMES_CHACHA20_POLY1305 "ChaCha20-Poly1305" -#define P11PROV_DESCS_CHACHA20_POLY1305 \ - "CHACHA20-POLY1305 PKCS11 Provider Implementation" #define P11PROV_NAME_GENERIC_SECRET "GENERIC-SECRET" -#define P11PROV_NAMES_GENERIC_SECRET P11PROV_NAME_GENERIC_SECRET -#define P11PROV_DESCS_GENERIC_SECRET "PKCS11 Generic Secret Implementation" - #endif typedef struct p11prov_ctx P11PROV_CTX; @@ -353,6 +107,8 @@ bool p11prov_ctx_is_call_blocked(P11PROV_CTX *ctx, uint64_t mask); bool p11prov_ctx_no_session_callbacks(P11PROV_CTX *ctx); CK_INFO p11prov_ctx_get_ck_info(P11PROV_CTX *ctx); +CK_RV p11prov_ctx_add_algs(P11PROV_CTX *ctx, int operation_id, + OSSL_ALGORITHM *algs); #include "debug.h" @@ -378,25 +134,13 @@ int p11prov_pop_error_to_mark(P11PROV_CTX *ctx); #include "interface.h" #include "obj/object.h" -#include "kmgmt/keymgmt.h" -#include "store.h" -#include "sig/signature.h" -#include "asymmetric_cipher.h" -#include "exchange.h" -#include "kdf.h" -#include "encoder.h" -#include "digests.h" #include "util.h" #include "session.h" #include "slot.h" -#include "random.h" #include "pk11_uri.h" -#include "kem.h" -#if SKEY_SUPPORT == 1 -#include "cipher.h" -#include "kmgmt/skey.h" -#endif +#include "registration.h" +#include "digests.h" /* TLS */ int tls_group_capabilities(OSSL_CALLBACK *cb, void *arg); diff --git a/src/random.c b/src/random.c index e2fc6e07..72edd8b8 100644 --- a/src/random.c +++ b/src/random.c @@ -2,6 +2,9 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include "random.h" + +#define DISPATCH_RAND_FN(name) DECL_DISPATCH_FUNC(rand, p11prov_rand, name) DISPATCH_RAND_FN(newctx); /* required */ DISPATCH_RAND_FN(freectx); /* required */ @@ -177,6 +180,9 @@ static void p11prov_rand_unlock(void *pctx) /* nothing to do */ } +#define DISPATCH_RAND_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_RAND_##NAME, (void (*)(void))p11prov_##prefix##_##name } + const OSSL_DISPATCH p11prov_rand_functions[] = { DISPATCH_RAND_ELEM(rand, NEWCTX, newctx), DISPATCH_RAND_ELEM(rand, FREECTX, freectx), @@ -191,7 +197,7 @@ const OSSL_DISPATCH p11prov_rand_functions[] = { { 0, NULL }, }; -CK_RV p11prov_check_random(P11PROV_CTX *ctx) +static CK_RV p11prov_check_random(P11PROV_CTX *ctx) { struct p11prov_rand_ctx rctx = { .provctx = ctx, @@ -207,3 +213,30 @@ CK_RV p11prov_check_random(P11PROV_CTX *ctx) return CKR_OK; } + +OSSL_ALGORITHM rand_algorithms[] = { + DEFAULT_ALGORITHM(RAND, p11prov_rand_functions), +}; + +CK_RV p11prov_register_random(P11PROV_CTX *ctx, bool fips_property) +{ + OSSL_ALGORITHM *algs; + CK_RV ret; + + ret = p11prov_check_random(ctx); + if (ret == CKR_FUNCTION_NOT_SUPPORTED) { + /* not supported */ + return p11prov_ctx_add_algs(ctx, OSSL_OP_RAND, NULL); + } + + algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * 2); + if (algs == NULL) { + (void)p11prov_ctx_add_algs(ctx, OSSL_OP_RAND, NULL); + return CKR_HOST_MEMORY; + } + + p11prov_assign_alg(&algs[0], rand_algorithms, 0, + fips_property ? P11PROV_FIPS_PROPERTIES : NULL); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_RAND, algs); +} diff --git a/src/random.h b/src/random.h index 950a19e7..87b92a96 100644 --- a/src/random.h +++ b/src/random.h @@ -4,13 +4,6 @@ #ifndef _PKCS11_RANDOM_H #define _PKCS11_RANDOM_H -#define DISPATCH_RAND_FN(name) DECL_DISPATCH_FUNC(rand, p11prov_rand, name) -#define DISPATCH_RAND_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_RAND_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } -extern const OSSL_DISPATCH p11prov_rand_functions[]; - -CK_RV p11prov_check_random(P11PROV_CTX *ctx); +CK_RV p11prov_register_random(P11PROV_CTX *ctx, bool fips_property); #endif /* _PKCS11_RANDOM_H */ diff --git a/src/registration.c b/src/registration.c new file mode 100644 index 00000000..5b99b4a2 --- /dev/null +++ b/src/registration.c @@ -0,0 +1,665 @@ +/* Copyright (C) 2026 Simo Sorce + SPDX-License-Identifier: Apache-2.0 */ + +#include "provider.h" + +CK_MECHANISM_TYPE p11prov_tbid_to_mech(enum p11prov_mech_tbid tbid) +{ + switch (tbid) { + case TBID_RSA_PKCS_KEY_PAIR_GEN: + return CKM_RSA_PKCS_KEY_PAIR_GEN; + case TBID_RSA_PKCS: + return CKM_RSA_PKCS; + case TBID_SHA1_RSA_PKCS: + return CKM_SHA1_RSA_PKCS; + case TBID_SHA224_RSA_PKCS: + return CKM_SHA224_RSA_PKCS; + case TBID_SHA256_RSA_PKCS: + return CKM_SHA256_RSA_PKCS; + case TBID_SHA384_RSA_PKCS: + return CKM_SHA384_RSA_PKCS; + case TBID_SHA512_RSA_PKCS: + return CKM_SHA512_RSA_PKCS; + case TBID_SHA3_224_RSA_PKCS: + return CKM_SHA3_224_RSA_PKCS; + case TBID_SHA3_256_RSA_PKCS: + return CKM_SHA3_256_RSA_PKCS; + case TBID_SHA3_384_RSA_PKCS: + return CKM_SHA3_384_RSA_PKCS; + case TBID_SHA3_512_RSA_PKCS: + return CKM_SHA3_512_RSA_PKCS; + case TBID_RSA_PKCS_PSS: + return CKM_RSA_PKCS_PSS; + case TBID_SHA1_RSA_PKCS_PSS: + return CKM_SHA1_RSA_PKCS_PSS; + case TBID_SHA256_RSA_PKCS_PSS: + return CKM_SHA256_RSA_PKCS_PSS; + case TBID_SHA384_RSA_PKCS_PSS: + return CKM_SHA384_RSA_PKCS_PSS; + case TBID_SHA512_RSA_PKCS_PSS: + return CKM_SHA512_RSA_PKCS_PSS; + case TBID_SHA224_RSA_PKCS_PSS: + return CKM_SHA224_RSA_PKCS_PSS; + case TBID_SHA3_256_RSA_PKCS_PSS: + return CKM_SHA3_256_RSA_PKCS_PSS; + case TBID_SHA3_384_RSA_PKCS_PSS: + return CKM_SHA3_384_RSA_PKCS_PSS; + case TBID_SHA3_512_RSA_PKCS_PSS: + return CKM_SHA3_512_RSA_PKCS_PSS; + case TBID_SHA3_224_RSA_PKCS_PSS: + return CKM_SHA3_224_RSA_PKCS_PSS; + case TBID_RSA_PKCS_OAEP: + return CKM_RSA_PKCS_OAEP; + case TBID_RSA_X_509: + return CKM_RSA_X_509; + case TBID_RSA_X9_31: + return CKM_RSA_X9_31; + case TBID_RSA_X9_31_KEY_PAIR_GEN: + return CKM_RSA_X9_31_KEY_PAIR_GEN; + case TBID_EC_KEY_PAIR_GEN: + return CKM_EC_KEY_PAIR_GEN; + case TBID_ECDSA: + return CKM_ECDSA; + case TBID_ECDSA_SHA1: + return CKM_ECDSA_SHA1; + case TBID_ECDSA_SHA224: + return CKM_ECDSA_SHA224; + case TBID_ECDSA_SHA256: + return CKM_ECDSA_SHA256; + case TBID_ECDSA_SHA384: + return CKM_ECDSA_SHA384; + case TBID_ECDSA_SHA512: + return CKM_ECDSA_SHA512; + case TBID_ECDSA_SHA3_224: + return CKM_ECDSA_SHA3_224; + case TBID_ECDSA_SHA3_256: + return CKM_ECDSA_SHA3_256; + case TBID_ECDSA_SHA3_384: + return CKM_ECDSA_SHA3_384; + case TBID_ECDSA_SHA3_512: + return CKM_ECDSA_SHA3_512; + case TBID_ECDH1_DERIVE: + return CKM_ECDH1_DERIVE; + case TBID_ECDH1_COFACTOR_DERIVE: + return CKM_ECDH1_COFACTOR_DERIVE; + case TBID_EC_EDWARDS_KEY_PAIR_GEN: + return CKM_EC_EDWARDS_KEY_PAIR_GEN; + case TBID_EC_MONTGOMERY_KEY_PAIR_GEN: + return CKM_EC_MONTGOMERY_KEY_PAIR_GEN; + case TBID_EDDSA: + return CKM_EDDSA; + case TBID_HKDF_DERIVE: + return CKM_HKDF_DERIVE; + case TBID_SHA_1: + return CKM_SHA_1; + case TBID_SHA_1_HMAC: + return CKM_SHA_1_HMAC; + case TBID_SHA_1_HMAC_GENERAL: + return CKM_SHA_1_HMAC_GENERAL; + case TBID_SHA1_KEY_DERIVATION: + return CKM_SHA1_KEY_DERIVATION; + case TBID_SHA_1_KEY_GEN: + return CKM_SHA_1_KEY_GEN; + case TBID_SHA224: + return CKM_SHA224; + case TBID_SHA224_HMAC: + return CKM_SHA224_HMAC; + case TBID_SHA224_HMAC_GENERAL: + return CKM_SHA224_HMAC_GENERAL; + case TBID_SHA224_KEY_DERIVATION: + return CKM_SHA224_KEY_DERIVATION; + case TBID_SHA224_KEY_GEN: + return CKM_SHA224_KEY_GEN; + case TBID_SHA256: + return CKM_SHA256; + case TBID_SHA256_HMAC: + return CKM_SHA256_HMAC; + case TBID_SHA256_HMAC_GENERAL: + return CKM_SHA256_HMAC_GENERAL; + case TBID_SHA256_KEY_DERIVATION: + return CKM_SHA256_KEY_DERIVATION; + case TBID_SHA256_KEY_GEN: + return CKM_SHA256_KEY_GEN; + case TBID_SHA384: + return CKM_SHA384; + case TBID_SHA384_HMAC: + return CKM_SHA384_HMAC; + case TBID_SHA384_HMAC_GENERAL: + return CKM_SHA384_HMAC_GENERAL; + case TBID_SHA384_KEY_DERIVATION: + return CKM_SHA384_KEY_DERIVATION; + case TBID_SHA384_KEY_GEN: + return CKM_SHA384_KEY_GEN; + case TBID_SHA512: + return CKM_SHA512; + case TBID_SHA512_HMAC: + return CKM_SHA512_HMAC; + case TBID_SHA512_HMAC_GENERAL: + return CKM_SHA512_HMAC_GENERAL; + case TBID_SHA512_KEY_DERIVATION: + return CKM_SHA512_KEY_DERIVATION; + case TBID_SHA512_KEY_GEN: + return CKM_SHA512_KEY_GEN; + case TBID_SHA512_224: + return CKM_SHA512_224; + case TBID_SHA512_224_HMAC: + return CKM_SHA512_224_HMAC; + case TBID_SHA512_224_HMAC_GENERAL: + return CKM_SHA512_224_HMAC_GENERAL; + case TBID_SHA512_224_KEY_DERIVATION: + return CKM_SHA512_224_KEY_DERIVATION; + case TBID_SHA512_224_KEY_GEN: + return CKM_SHA512_224_KEY_GEN; + case TBID_SHA512_256: + return CKM_SHA512_256; + case TBID_SHA512_256_HMAC: + return CKM_SHA512_256_HMAC; + case TBID_SHA512_256_HMAC_GENERAL: + return CKM_SHA512_256_HMAC_GENERAL; + case TBID_SHA512_256_KEY_DERIVATION: + return CKM_SHA512_256_KEY_DERIVATION; + case TBID_SHA512_256_KEY_GEN: + return CKM_SHA512_256_KEY_GEN; + case TBID_SHA512_T: + return CKM_SHA512_T; + case TBID_SHA512_T_HMAC: + return CKM_SHA512_T_HMAC; + case TBID_SHA512_T_HMAC_GENERAL: + return CKM_SHA512_T_HMAC_GENERAL; + case TBID_SHA512_T_KEY_DERIVATION: + return CKM_SHA512_T_KEY_DERIVATION; + case TBID_SHA512_T_KEY_GEN: + return CKM_SHA512_T_KEY_GEN; + case TBID_SHA3_224: + return CKM_SHA3_224; + case TBID_SHA3_224_HMAC: + return CKM_SHA3_224_HMAC; + case TBID_SHA3_224_HMAC_GENERAL: + return CKM_SHA3_224_HMAC_GENERAL; + case TBID_SHA3_224_KEY_DERIVATION: + return CKM_SHA3_224_KEY_DERIVATION; + case TBID_SHA3_224_KEY_GEN: + return CKM_SHA3_224_KEY_GEN; + case TBID_SHA3_256: + return CKM_SHA3_256; + case TBID_SHA3_256_HMAC: + return CKM_SHA3_256_HMAC; + case TBID_SHA3_256_HMAC_GENERAL: + return CKM_SHA3_256_HMAC_GENERAL; + case TBID_SHA3_256_KEY_DERIVATION: + return CKM_SHA3_256_KEY_DERIVATION; + case TBID_SHA3_256_KEY_GEN: + return CKM_SHA3_256_KEY_GEN; + case TBID_SHA3_384: + return CKM_SHA3_384; + case TBID_SHA3_384_HMAC: + return CKM_SHA3_384_HMAC; + case TBID_SHA3_384_HMAC_GENERAL: + return CKM_SHA3_384_HMAC_GENERAL; + case TBID_SHA3_384_KEY_DERIVATION: + return CKM_SHA3_384_KEY_DERIVATION; + case TBID_SHA3_384_KEY_GEN: + return CKM_SHA3_384_KEY_GEN; + case TBID_SHA3_512: + return CKM_SHA3_512; + case TBID_SHA3_512_HMAC: + return CKM_SHA3_512_HMAC; + case TBID_SHA3_512_HMAC_GENERAL: + return CKM_SHA3_512_HMAC_GENERAL; + case TBID_SHA3_512_KEY_DERIVATION: + return CKM_SHA3_512_KEY_DERIVATION; + case TBID_SHA3_512_KEY_GEN: + return CKM_SHA3_512_KEY_GEN; + case TBID_ML_DSA_KEY_PAIR_GEN: + return CKM_ML_DSA_KEY_PAIR_GEN; + case TBID_ML_DSA: + return CKM_ML_DSA; + case TBID_HASH_ML_DSA: + return CKM_HASH_ML_DSA; + case TBID_HASH_ML_DSA_SHA224: + return CKM_HASH_ML_DSA_SHA224; + case TBID_HASH_ML_DSA_SHA256: + return CKM_HASH_ML_DSA_SHA256; + case TBID_HASH_ML_DSA_SHA384: + return CKM_HASH_ML_DSA_SHA384; + case TBID_HASH_ML_DSA_SHA512: + return CKM_HASH_ML_DSA_SHA512; + case TBID_HASH_ML_DSA_SHA3_224: + return CKM_HASH_ML_DSA_SHA3_224; + case TBID_HASH_ML_DSA_SHA3_256: + return CKM_HASH_ML_DSA_SHA3_256; + case TBID_HASH_ML_DSA_SHA3_384: + return CKM_HASH_ML_DSA_SHA3_384; + case TBID_HASH_ML_DSA_SHA3_512: + return CKM_HASH_ML_DSA_SHA3_512; + case TBID_HASH_ML_DSA_SHAKE128: + return CKM_HASH_ML_DSA_SHAKE128; + case TBID_HASH_ML_DSA_SHAKE256: + return CKM_HASH_ML_DSA_SHAKE256; + case TBID_ML_KEM_KEY_PAIR_GEN: + return CKM_ML_KEM_KEY_PAIR_GEN; + case TBID_ML_KEM: + return CKM_ML_KEM; + case TBID_SLH_DSA_KEY_PAIR_GEN: + return CKM_SLH_DSA_KEY_PAIR_GEN; + case TBID_SLH_DSA: + return CKM_SLH_DSA; + case TBID_HASH_SLH_DSA: + return CKM_HASH_SLH_DSA; + case TBID_HASH_SLH_DSA_SHA224: + return CKM_HASH_SLH_DSA_SHA224; + case TBID_HASH_SLH_DSA_SHA256: + return CKM_HASH_SLH_DSA_SHA256; + case TBID_HASH_SLH_DSA_SHA384: + return CKM_HASH_SLH_DSA_SHA384; + case TBID_HASH_SLH_DSA_SHA512: + return CKM_HASH_SLH_DSA_SHA512; + case TBID_HASH_SLH_DSA_SHA3_224: + return CKM_HASH_SLH_DSA_SHA3_224; + case TBID_HASH_SLH_DSA_SHA3_256: + return CKM_HASH_SLH_DSA_SHA3_256; + case TBID_HASH_SLH_DSA_SHA3_384: + return CKM_HASH_SLH_DSA_SHA3_384; + case TBID_HASH_SLH_DSA_SHA3_512: + return CKM_HASH_SLH_DSA_SHA3_512; + case TBID_HASH_SLH_DSA_SHAKE128: + return CKM_HASH_SLH_DSA_SHAKE128; + case TBID_HASH_SLH_DSA_SHAKE256: + return CKM_HASH_SLH_DSA_SHAKE256; + case TBID_AES_KEY_GEN: + return CKM_AES_KEY_GEN; + case TBID_AES_ECB: + return CKM_AES_ECB; + case TBID_AES_CBC: + return CKM_AES_CBC; + case TBID_AES_CBC_PAD: + return CKM_AES_CBC_PAD; + case TBID_AES_OFB: + return CKM_AES_OFB; + case TBID_AES_CFB128: + return CKM_AES_CFB128; + case TBID_AES_CFB1: + return CKM_AES_CFB1; + case TBID_AES_CFB8: + return CKM_AES_CFB8; + case TBID_AES_CTR: + return CKM_AES_CTR; + case TBID_AES_CTS: + return CKM_AES_CTS; + case TBID_AES_GCM: + return CKM_AES_GCM; + case TBID_AES_MAC: + return CKM_AES_MAC; + case TBID_AES_MAC_GENERAL: + return CKM_AES_MAC_GENERAL; + case TBID_AES_CCM: + return CKM_AES_CCM; + case TBID_AES_CMAC: + return CKM_AES_CMAC; + case TBID_AES_CMAC_GENERAL: + return CKM_AES_CMAC_GENERAL; + case TBID_AES_XCBC_MAC: + return CKM_AES_XCBC_MAC; + case TBID_AES_XCBC_MAC_96: + return CKM_AES_XCBC_MAC_96; + case TBID_AES_GMAC: + return CKM_AES_GMAC; + case TBID_CHACHA20_POLY1305: + return CKM_CHACHA20_POLY1305; + case TBID_GENERIC_SECRET_KEY_GEN: + return CKM_GENERIC_SECRET_KEY_GEN; + default: + return CK_UNAVAILABLE_INFORMATION; + } +} + +int p11prov_mech_to_tbid(CK_MECHANISM_TYPE mech) +{ + switch (mech) { + case CKM_RSA_PKCS_KEY_PAIR_GEN: + return TBID_RSA_PKCS_KEY_PAIR_GEN; + case CKM_RSA_PKCS: + return TBID_RSA_PKCS; + case CKM_SHA1_RSA_PKCS: + return TBID_SHA1_RSA_PKCS; + case CKM_SHA224_RSA_PKCS: + return TBID_SHA224_RSA_PKCS; + case CKM_SHA256_RSA_PKCS: + return TBID_SHA256_RSA_PKCS; + case CKM_SHA384_RSA_PKCS: + return TBID_SHA384_RSA_PKCS; + case CKM_SHA512_RSA_PKCS: + return TBID_SHA512_RSA_PKCS; + case CKM_SHA3_224_RSA_PKCS: + return TBID_SHA3_224_RSA_PKCS; + case CKM_SHA3_256_RSA_PKCS: + return TBID_SHA3_256_RSA_PKCS; + case CKM_SHA3_384_RSA_PKCS: + return TBID_SHA3_384_RSA_PKCS; + case CKM_SHA3_512_RSA_PKCS: + return TBID_SHA3_512_RSA_PKCS; + case CKM_RSA_PKCS_PSS: + return TBID_RSA_PKCS_PSS; + case CKM_SHA1_RSA_PKCS_PSS: + return TBID_SHA1_RSA_PKCS_PSS; + case CKM_SHA256_RSA_PKCS_PSS: + return TBID_SHA256_RSA_PKCS_PSS; + case CKM_SHA384_RSA_PKCS_PSS: + return TBID_SHA384_RSA_PKCS_PSS; + case CKM_SHA512_RSA_PKCS_PSS: + return TBID_SHA512_RSA_PKCS_PSS; + case CKM_SHA224_RSA_PKCS_PSS: + return TBID_SHA224_RSA_PKCS_PSS; + case CKM_SHA3_256_RSA_PKCS_PSS: + return TBID_SHA3_256_RSA_PKCS_PSS; + case CKM_SHA3_384_RSA_PKCS_PSS: + return TBID_SHA3_384_RSA_PKCS_PSS; + case CKM_SHA3_512_RSA_PKCS_PSS: + return TBID_SHA3_512_RSA_PKCS_PSS; + case CKM_SHA3_224_RSA_PKCS_PSS: + return TBID_SHA3_224_RSA_PKCS_PSS; + case CKM_RSA_PKCS_OAEP: + return TBID_RSA_PKCS_OAEP; + case CKM_RSA_X_509: + return TBID_RSA_X_509; + case CKM_RSA_X9_31: + return TBID_RSA_X9_31; + case CKM_RSA_X9_31_KEY_PAIR_GEN: + return TBID_RSA_X9_31_KEY_PAIR_GEN; + case CKM_EC_KEY_PAIR_GEN: + return TBID_EC_KEY_PAIR_GEN; + case CKM_ECDSA: + return TBID_ECDSA; + case CKM_ECDSA_SHA1: + return TBID_ECDSA_SHA1; + case CKM_ECDSA_SHA224: + return TBID_ECDSA_SHA224; + case CKM_ECDSA_SHA256: + return TBID_ECDSA_SHA256; + case CKM_ECDSA_SHA384: + return TBID_ECDSA_SHA384; + case CKM_ECDSA_SHA512: + return TBID_ECDSA_SHA512; + case CKM_ECDSA_SHA3_224: + return TBID_ECDSA_SHA3_224; + case CKM_ECDSA_SHA3_256: + return TBID_ECDSA_SHA3_256; + case CKM_ECDSA_SHA3_384: + return TBID_ECDSA_SHA3_384; + case CKM_ECDSA_SHA3_512: + return TBID_ECDSA_SHA3_512; + case CKM_ECDH1_DERIVE: + return TBID_ECDH1_DERIVE; + case CKM_ECDH1_COFACTOR_DERIVE: + return TBID_ECDH1_COFACTOR_DERIVE; + case CKM_EC_EDWARDS_KEY_PAIR_GEN: + return TBID_EC_EDWARDS_KEY_PAIR_GEN; + case CKM_EC_MONTGOMERY_KEY_PAIR_GEN: + return TBID_EC_MONTGOMERY_KEY_PAIR_GEN; + case CKM_EDDSA: + return TBID_EDDSA; + case CKM_HKDF_DERIVE: + return TBID_HKDF_DERIVE; + case CKM_SHA_1: + return TBID_SHA_1; + case CKM_SHA_1_HMAC: + return TBID_SHA_1_HMAC; + case CKM_SHA_1_HMAC_GENERAL: + return TBID_SHA_1_HMAC_GENERAL; + case CKM_SHA1_KEY_DERIVATION: + return TBID_SHA1_KEY_DERIVATION; + case CKM_SHA_1_KEY_GEN: + return TBID_SHA_1_KEY_GEN; + case CKM_SHA224: + return TBID_SHA224; + case CKM_SHA224_HMAC: + return TBID_SHA224_HMAC; + case CKM_SHA224_HMAC_GENERAL: + return TBID_SHA224_HMAC_GENERAL; + case CKM_SHA224_KEY_DERIVATION: + return TBID_SHA224_KEY_DERIVATION; + case CKM_SHA224_KEY_GEN: + return TBID_SHA224_KEY_GEN; + case CKM_SHA256: + return TBID_SHA256; + case CKM_SHA256_HMAC: + return TBID_SHA256_HMAC; + case CKM_SHA256_HMAC_GENERAL: + return TBID_SHA256_HMAC_GENERAL; + case CKM_SHA256_KEY_DERIVATION: + return TBID_SHA256_KEY_DERIVATION; + case CKM_SHA256_KEY_GEN: + return TBID_SHA256_KEY_GEN; + case CKM_SHA384: + return TBID_SHA384; + case CKM_SHA384_HMAC: + return TBID_SHA384_HMAC; + case CKM_SHA384_HMAC_GENERAL: + return TBID_SHA384_HMAC_GENERAL; + case CKM_SHA384_KEY_DERIVATION: + return TBID_SHA384_KEY_DERIVATION; + case CKM_SHA384_KEY_GEN: + return TBID_SHA384_KEY_GEN; + case CKM_SHA512: + return TBID_SHA512; + case CKM_SHA512_HMAC: + return TBID_SHA512_HMAC; + case CKM_SHA512_HMAC_GENERAL: + return TBID_SHA512_HMAC_GENERAL; + case CKM_SHA512_KEY_DERIVATION: + return TBID_SHA512_KEY_DERIVATION; + case CKM_SHA512_KEY_GEN: + return TBID_SHA512_KEY_GEN; + case CKM_SHA512_224: + return TBID_SHA512_224; + case CKM_SHA512_224_HMAC: + return TBID_SHA512_224_HMAC; + case CKM_SHA512_224_HMAC_GENERAL: + return TBID_SHA512_224_HMAC_GENERAL; + case CKM_SHA512_224_KEY_DERIVATION: + return TBID_SHA512_224_KEY_DERIVATION; + case CKM_SHA512_224_KEY_GEN: + return TBID_SHA512_224_KEY_GEN; + case CKM_SHA512_256: + return TBID_SHA512_256; + case CKM_SHA512_256_HMAC: + return TBID_SHA512_256_HMAC; + case CKM_SHA512_256_HMAC_GENERAL: + return TBID_SHA512_256_HMAC_GENERAL; + case CKM_SHA512_256_KEY_DERIVATION: + return TBID_SHA512_256_KEY_DERIVATION; + case CKM_SHA512_256_KEY_GEN: + return TBID_SHA512_256_KEY_GEN; + case CKM_SHA512_T: + return TBID_SHA512_T; + case CKM_SHA512_T_HMAC: + return TBID_SHA512_T_HMAC; + case CKM_SHA512_T_HMAC_GENERAL: + return TBID_SHA512_T_HMAC_GENERAL; + case CKM_SHA512_T_KEY_DERIVATION: + return TBID_SHA512_T_KEY_DERIVATION; + case CKM_SHA512_T_KEY_GEN: + return TBID_SHA512_T_KEY_GEN; + case CKM_SHA3_224: + return TBID_SHA3_224; + case CKM_SHA3_224_HMAC: + return TBID_SHA3_224_HMAC; + case CKM_SHA3_224_HMAC_GENERAL: + return TBID_SHA3_224_HMAC_GENERAL; + case CKM_SHA3_224_KEY_DERIVATION: + return TBID_SHA3_224_KEY_DERIVATION; + case CKM_SHA3_224_KEY_GEN: + return TBID_SHA3_224_KEY_GEN; + case CKM_SHA3_256: + return TBID_SHA3_256; + case CKM_SHA3_256_HMAC: + return TBID_SHA3_256_HMAC; + case CKM_SHA3_256_HMAC_GENERAL: + return TBID_SHA3_256_HMAC_GENERAL; + case CKM_SHA3_256_KEY_DERIVATION: + return TBID_SHA3_256_KEY_DERIVATION; + case CKM_SHA3_256_KEY_GEN: + return TBID_SHA3_256_KEY_GEN; + case CKM_SHA3_384: + return TBID_SHA3_384; + case CKM_SHA3_384_HMAC: + return TBID_SHA3_384_HMAC; + case CKM_SHA3_384_HMAC_GENERAL: + return TBID_SHA3_384_HMAC_GENERAL; + case CKM_SHA3_384_KEY_DERIVATION: + return TBID_SHA3_384_KEY_DERIVATION; + case CKM_SHA3_384_KEY_GEN: + return TBID_SHA3_384_KEY_GEN; + case CKM_SHA3_512: + return TBID_SHA3_512; + case CKM_SHA3_512_HMAC: + return TBID_SHA3_512_HMAC; + case CKM_SHA3_512_HMAC_GENERAL: + return TBID_SHA3_512_HMAC_GENERAL; + case CKM_SHA3_512_KEY_DERIVATION: + return TBID_SHA3_512_KEY_DERIVATION; + case CKM_SHA3_512_KEY_GEN: + return TBID_SHA3_512_KEY_GEN; + case CKM_ML_DSA_KEY_PAIR_GEN: + return TBID_ML_DSA_KEY_PAIR_GEN; + case CKM_ML_DSA: + return TBID_ML_DSA; + case CKM_HASH_ML_DSA: + return TBID_HASH_ML_DSA; + case CKM_HASH_ML_DSA_SHA224: + return TBID_HASH_ML_DSA_SHA224; + case CKM_HASH_ML_DSA_SHA256: + return TBID_HASH_ML_DSA_SHA256; + case CKM_HASH_ML_DSA_SHA384: + return TBID_HASH_ML_DSA_SHA384; + case CKM_HASH_ML_DSA_SHA512: + return TBID_HASH_ML_DSA_SHA512; + case CKM_HASH_ML_DSA_SHA3_224: + return TBID_HASH_ML_DSA_SHA3_224; + case CKM_HASH_ML_DSA_SHA3_256: + return TBID_HASH_ML_DSA_SHA3_256; + case CKM_HASH_ML_DSA_SHA3_384: + return TBID_HASH_ML_DSA_SHA3_384; + case CKM_HASH_ML_DSA_SHA3_512: + return TBID_HASH_ML_DSA_SHA3_512; + case CKM_HASH_ML_DSA_SHAKE128: + return TBID_HASH_ML_DSA_SHAKE128; + case CKM_HASH_ML_DSA_SHAKE256: + return TBID_HASH_ML_DSA_SHAKE256; + case CKM_ML_KEM_KEY_PAIR_GEN: + return TBID_ML_KEM_KEY_PAIR_GEN; + case CKM_ML_KEM: + return TBID_ML_KEM; + case CKM_SLH_DSA_KEY_PAIR_GEN: + return TBID_SLH_DSA_KEY_PAIR_GEN; + case CKM_SLH_DSA: + return TBID_SLH_DSA; + case CKM_HASH_SLH_DSA: + return TBID_HASH_SLH_DSA; + case CKM_HASH_SLH_DSA_SHA224: + return TBID_HASH_SLH_DSA_SHA224; + case CKM_HASH_SLH_DSA_SHA256: + return TBID_HASH_SLH_DSA_SHA256; + case CKM_HASH_SLH_DSA_SHA384: + return TBID_HASH_SLH_DSA_SHA384; + case CKM_HASH_SLH_DSA_SHA512: + return TBID_HASH_SLH_DSA_SHA512; + case CKM_HASH_SLH_DSA_SHA3_224: + return TBID_HASH_SLH_DSA_SHA3_224; + case CKM_HASH_SLH_DSA_SHA3_256: + return TBID_HASH_SLH_DSA_SHA3_256; + case CKM_HASH_SLH_DSA_SHA3_384: + return TBID_HASH_SLH_DSA_SHA3_384; + case CKM_HASH_SLH_DSA_SHA3_512: + return TBID_HASH_SLH_DSA_SHA3_512; + case CKM_HASH_SLH_DSA_SHAKE128: + return TBID_HASH_SLH_DSA_SHAKE128; + case CKM_HASH_SLH_DSA_SHAKE256: + return TBID_HASH_SLH_DSA_SHAKE256; + case CKM_AES_KEY_GEN: + return TBID_AES_KEY_GEN; + case CKM_AES_ECB: + return TBID_AES_ECB; + case CKM_AES_CBC: + return TBID_AES_CBC; + case CKM_AES_CBC_PAD: + return TBID_AES_CBC_PAD; + case CKM_AES_OFB: + return TBID_AES_OFB; + case CKM_AES_CFB128: + return TBID_AES_CFB128; + case CKM_AES_CFB1: + return TBID_AES_CFB1; + case CKM_AES_CFB8: + return TBID_AES_CFB8; + case CKM_AES_CTR: + return TBID_AES_CTR; + case CKM_AES_CTS: + return TBID_AES_CTS; + case CKM_AES_GCM: + return TBID_AES_GCM; + case CKM_AES_MAC: + return TBID_AES_MAC; + case CKM_AES_MAC_GENERAL: + return TBID_AES_MAC_GENERAL; + case CKM_AES_CCM: + return TBID_AES_CCM; + case CKM_AES_CMAC: + return TBID_AES_CMAC; + case CKM_AES_CMAC_GENERAL: + return TBID_AES_CMAC_GENERAL; + case CKM_AES_XCBC_MAC: + return TBID_AES_XCBC_MAC; + case CKM_AES_XCBC_MAC_96: + return TBID_AES_XCBC_MAC_96; + case CKM_AES_GMAC: + return TBID_AES_GMAC; + case CKM_CHACHA20_POLY1305: + return TBID_CHACHA20_POLY1305; + case CKM_GENERIC_SECRET_KEY_GEN: + return TBID_GENERIC_SECRET_KEY_GEN; + default: + return -1; + } +} + +CK_RV p11prov_get_mech_state_table(P11PROV_CTX *ctx, bool available[TBID_SIZE]) +{ + P11PROV_SLOTS_CTX *slots; + P11PROV_SLOT *slot; + int slot_idx = 0; + CK_RV ret; + + ret = p11prov_take_slots(ctx, &slots); + if (ret != CKR_OK) { + return ret; + } + + for (slot = p11prov_fetch_slot(slots, &slot_idx); slot != NULL; + slot = p11prov_fetch_slot(slots, &slot_idx)) { + + CK_MECHANISM_TYPE *mechs; + int nmechs; + nmechs = p11prov_slot_get_mechanisms(slot, &mechs); + + for (int i = 0; i < nmechs; i++) { + int tbid = p11prov_mech_to_tbid(mechs[i]); + if (tbid == -1) { + continue; + } + available[tbid] = true; + } + } + p11prov_return_slots(slots); + + return CKR_OK; +} + +void p11prov_assign_alg(OSSL_ALGORITHM *dest, const OSSL_ALGORITHM *algs, + int idx, const char *fips_property) +{ + *dest = algs[idx]; + if (fips_property) { + dest->property_definition = fips_property; + } +} diff --git a/src/registration.h b/src/registration.h new file mode 100644 index 00000000..1a7e5475 --- /dev/null +++ b/src/registration.h @@ -0,0 +1,459 @@ +/* Copyright (C) 2026 Simo Sorce + SPDX-License-Identifier: Apache-2.0 */ + +#ifndef _REGISTRATION_H_ +#define _REGISTRATION_H_ + +/* list of supported mechanism that are used to declare + * supported functionality to openssl based on token + * support. */ + +enum p11prov_mech_tbid { + /* RSA */ + TBID_RSA_PKCS_KEY_PAIR_GEN = 0, + TBID_RSA_PKCS, + TBID_SHA1_RSA_PKCS, + TBID_SHA224_RSA_PKCS, + TBID_SHA256_RSA_PKCS, + TBID_SHA384_RSA_PKCS, + TBID_SHA512_RSA_PKCS, + TBID_SHA3_224_RSA_PKCS, + TBID_SHA3_256_RSA_PKCS, + TBID_SHA3_384_RSA_PKCS, + TBID_SHA3_512_RSA_PKCS, + TBID_RSA_PKCS_PSS, + TBID_SHA1_RSA_PKCS_PSS, + TBID_SHA256_RSA_PKCS_PSS, + TBID_SHA384_RSA_PKCS_PSS, + TBID_SHA512_RSA_PKCS_PSS, + TBID_SHA224_RSA_PKCS_PSS, + TBID_SHA3_256_RSA_PKCS_PSS, + TBID_SHA3_384_RSA_PKCS_PSS, + TBID_SHA3_512_RSA_PKCS_PSS, + TBID_SHA3_224_RSA_PKCS_PSS, + TBID_RSA_PKCS_OAEP, + TBID_RSA_X_509, + TBID_RSA_X9_31_KEY_PAIR_GEN, + TBID_RSA_X9_31, + + /* EC */ + TBID_EC_KEY_PAIR_GEN, + TBID_ECDSA, + TBID_ECDSA_SHA1, + TBID_ECDSA_SHA224, + TBID_ECDSA_SHA256, + TBID_ECDSA_SHA384, + TBID_ECDSA_SHA512, + TBID_ECDSA_SHA3_224, + TBID_ECDSA_SHA3_256, + TBID_ECDSA_SHA3_384, + TBID_ECDSA_SHA3_512, + TBID_ECDH1_DERIVE, + TBID_ECDH1_COFACTOR_DERIVE, + TBID_EC_EDWARDS_KEY_PAIR_GEN, + TBID_EC_MONTGOMERY_KEY_PAIR_GEN, + TBID_EDDSA, + + /* HKDF */ + TBID_HKDF_DERIVE, + + /* SHA Hashes */ + TBID_SHA_1, + TBID_SHA_1_HMAC, + TBID_SHA_1_HMAC_GENERAL, + TBID_SHA1_KEY_DERIVATION, + TBID_SHA_1_KEY_GEN, + TBID_SHA224, + TBID_SHA224_HMAC, + TBID_SHA224_HMAC_GENERAL, + TBID_SHA224_KEY_DERIVATION, + TBID_SHA224_KEY_GEN, + TBID_SHA256, + TBID_SHA256_HMAC, + TBID_SHA256_HMAC_GENERAL, + TBID_SHA256_KEY_DERIVATION, + TBID_SHA256_KEY_GEN, + TBID_SHA384, + TBID_SHA384_HMAC, + TBID_SHA384_HMAC_GENERAL, + TBID_SHA384_KEY_DERIVATION, + TBID_SHA384_KEY_GEN, + TBID_SHA512, + TBID_SHA512_HMAC, + TBID_SHA512_HMAC_GENERAL, + TBID_SHA512_KEY_DERIVATION, + TBID_SHA512_KEY_GEN, + TBID_SHA512_224, + TBID_SHA512_224_HMAC, + TBID_SHA512_224_HMAC_GENERAL, + TBID_SHA512_224_KEY_DERIVATION, + TBID_SHA512_224_KEY_GEN, + TBID_SHA512_256, + TBID_SHA512_256_HMAC, + TBID_SHA512_256_HMAC_GENERAL, + TBID_SHA512_256_KEY_DERIVATION, + TBID_SHA512_256_KEY_GEN, + TBID_SHA512_T, + TBID_SHA512_T_HMAC, + TBID_SHA512_T_HMAC_GENERAL, + TBID_SHA512_T_KEY_DERIVATION, + TBID_SHA512_T_KEY_GEN, + TBID_SHA3_224, + TBID_SHA3_224_HMAC, + TBID_SHA3_224_HMAC_GENERAL, + TBID_SHA3_224_KEY_DERIVATION, + TBID_SHA3_224_KEY_GEN, + TBID_SHA3_256, + TBID_SHA3_256_HMAC, + TBID_SHA3_256_HMAC_GENERAL, + TBID_SHA3_256_KEY_DERIVATION, + TBID_SHA3_256_KEY_GEN, + TBID_SHA3_384, + TBID_SHA3_384_HMAC, + TBID_SHA3_384_HMAC_GENERAL, + TBID_SHA3_384_KEY_DERIVATION, + TBID_SHA3_384_KEY_GEN, + TBID_SHA3_512, + TBID_SHA3_512_HMAC, + TBID_SHA3_512_HMAC_GENERAL, + TBID_SHA3_512_KEY_DERIVATION, + TBID_SHA3_512_KEY_GEN, + + /* ML-DSA */ + TBID_ML_DSA_KEY_PAIR_GEN, + TBID_ML_DSA, + TBID_HASH_ML_DSA, + TBID_HASH_ML_DSA_SHA224, + TBID_HASH_ML_DSA_SHA256, + TBID_HASH_ML_DSA_SHA384, + TBID_HASH_ML_DSA_SHA512, + TBID_HASH_ML_DSA_SHA3_224, + TBID_HASH_ML_DSA_SHA3_256, + TBID_HASH_ML_DSA_SHA3_384, + TBID_HASH_ML_DSA_SHA3_512, + TBID_HASH_ML_DSA_SHAKE128, + TBID_HASH_ML_DSA_SHAKE256, + + /* ML-KEM */ + TBID_ML_KEM_KEY_PAIR_GEN, + TBID_ML_KEM, + + /* SLH-DSA */ + TBID_SLH_DSA_KEY_PAIR_GEN, + TBID_SLH_DSA, + TBID_HASH_SLH_DSA, + TBID_HASH_SLH_DSA_SHA224, + TBID_HASH_SLH_DSA_SHA256, + TBID_HASH_SLH_DSA_SHA384, + TBID_HASH_SLH_DSA_SHA512, + TBID_HASH_SLH_DSA_SHA3_224, + TBID_HASH_SLH_DSA_SHA3_256, + TBID_HASH_SLH_DSA_SHA3_384, + TBID_HASH_SLH_DSA_SHA3_512, + TBID_HASH_SLH_DSA_SHAKE128, + TBID_HASH_SLH_DSA_SHAKE256, + + /* AES */ + TBID_AES_KEY_GEN, + TBID_AES_ECB, + TBID_AES_CBC, + TBID_AES_CBC_PAD, + TBID_AES_OFB, + TBID_AES_CFB128, + TBID_AES_CFB1, + TBID_AES_CFB8, + TBID_AES_CTR, + TBID_AES_CTS, + TBID_AES_GCM, + TBID_AES_MAC, + TBID_AES_MAC_GENERAL, + TBID_AES_CCM, + TBID_AES_CMAC, + TBID_AES_CMAC_GENERAL, + TBID_AES_XCBC_MAC, + TBID_AES_XCBC_MAC_96, + TBID_AES_GMAC, + + /* other */ + TBID_CHACHA20_POLY1305, + TBID_GENERIC_SECRET_KEY_GEN, + + /* Must be last */ + TBID_SIZE, +}; + +CK_MECHANISM_TYPE p11prov_tbid_to_mech(enum p11prov_mech_tbid tbid); +int p11prov_mech_to_tbid(CK_MECHANISM_TYPE mech); +CK_RV p11prov_get_mech_state_table(P11PROV_CTX *ctx, bool available[TBID_SIZE]); + +#define P11PROV_DEFAULT_PROPERTIES "provider=pkcs11" +#define P11PROV_FIPS_PROPERTIES "provider=pkcs11,fips=yes" +#define P11PROV_DEFAULT_PROVIDER "provider=default" + +#define P11PROV_NAME_HKDF "HKDF" +#define P11PROV_NAME_RSA "RSA" +#define P11PROV_NAME_RSAPSS "RSA-PSS" +#define P11PROV_NAME_EC "EC" +#define P11PROV_NAME_ECDSA "ECDSA" +#define P11PROV_NAME_ECDH "ECDH" +#define P11PROV_NAME_ED25519 "ED25519" +#define P11PROV_NAME_ED448 "ED448" +#define P11PROV_NAME_X25519 "X25519" +#define P11PROV_NAME_X448 "X448" +#define P11PROV_NAME_CERTIFICATE "CERTIFICATE" + +#define P11PROV_NAMES_RSA "RSA:rsaEncryption:1.2.840.113549.1.1.1" +#define P11PROV_DESCS_RSA "PKCS11 RSA Implementation" +#define P11PROV_NAMES_RSAPSS "RSA-PSS:RSASSA-PSS:1.2.840.113549.1.1.10" +#define P11PROV_DESCS_RSAPSS "PKCS11 RSA PSS Implementation" +#define P11PROV_NAMES_RSA_SHA1 \ + "RSA-SHA1:RSA-SHA-1:sha1WithRSAEncryption:1.2.840.113549.1.1.5" +#define P11PROV_DESCS_RSA_SHA1 "PKCS11 RSA-SHA1 Implementation" +#define P11PROV_NAMES_RSA_SHA256 \ + "RSA-SHA2-256:RSA-SHA256:sha256WithRSAEncryption:1.2.840.113549.1.1.11" +#define P11PROV_DESCS_RSA_SHA256 "PKCS11 RSA-SHA256 Implementation" +#define P11PROV_NAMES_RSA_SHA384 \ + "RSA-SHA2-384:RSA-SHA384:sha384WithRSAEncryption:1.2.840.113549.1.1.12" +#define P11PROV_DESCS_RSA_SHA384 "PKCS11 RSA-SHA384 Implementation" +#define P11PROV_NAMES_RSA_SHA512 \ + "RSA-SHA2-512:RSA-SHA512:sha512WithRSAEncryption:1.2.840.113549.1.1.13" +#define P11PROV_DESCS_RSA_SHA512 "PKCS11 RSA-SHA512 Implementation" +#define P11PROV_NAMES_RSA_SHA224 \ + "RSA-SHA2-224:RSA-SHA224:sha224WithRSAEncryption:1.2.840.113549.1.1.14" +#define P11PROV_DESCS_RSA_SHA224 "PKCS11 RSA-SHA224 Implementation" +#define P11PROV_NAMES_RSA_SHA3_224 \ + "RSA-SHA3-224:id-rsassa-pkcs1-v1_5-with-sha3-224:2.16.840.1.101.3.4.3.13" +#define P11PROV_DESCS_RSA_SHA3_224 "PKCS11 RSA-SHA3_224 Implementation" +#define P11PROV_NAMES_RSA_SHA3_256 \ + "RSA-SHA3-256:id-rsassa-pkcs1-v1_5-with-sha3-256:2.16.840.1.101.3.4.3.14" +#define P11PROV_DESCS_RSA_SHA3_256 "PKCS11 RSA-SHA3_256 Implementation" +#define P11PROV_NAMES_RSA_SHA3_384 \ + "RSA-SHA3-384:id-rsassa-pkcs1-v1_5-with-sha3-384:2.16.840.1.101.3.4.3.15" +#define P11PROV_DESCS_RSA_SHA3_384 "PKCS11 RSA-SHA3_384 Implementation" +#define P11PROV_NAMES_RSA_SHA3_512 \ + "RSA-SHA3-512:id-rsassa-pkcs1-v1_5-with-sha3-512:2.16.840.1.101.3.4.3.16" +#define P11PROV_DESCS_RSA_SHA3_512 "PKCS11 RSA-SHA3_512 Implementation" +#define P11PROV_NAMES_EC "EC:id-ecPublicKey:1.2.840.10045.2.1" +#define P11PROV_DESCS_EC "PKCS11 EC Implementation" +#define P11PROV_NAMES_ECDSA P11PROV_NAME_ECDSA +#define P11PROV_DESCS_ECDSA "PKCS11 ECDSA Implementation" +#define P11PROV_NAMES_ECDSA_SHA1 \ + "ECDSA-SHA1:ECDSA-SHA-1:ecdsa-with-SHA1:1.2.840.10045.4.1" +#define P11PROV_DESCS_ECDSA_SHA1 "PKCS11 ECDSA-SHA1 Implementation" +#define P11PROV_NAMES_ECDSA_SHA224 \ + "ECDSA-SHA2-224:ECDSA-SHA224:ecdsa-with-SHA224:1.2.840.10045.4.3.1" +#define P11PROV_DESCS_ECDSA_SHA224 "PKCS11 ECDSA-SHA224 Implementation" +#define P11PROV_NAMES_ECDSA_SHA256 \ + "ECDSA-SHA2-256:ECDSA-SHA256:ecdsa-with-SHA256:1.2.840.10045.4.3.2" +#define P11PROV_DESCS_ECDSA_SHA256 "PKCS11 ECDSA-SHA256 Implementation" +#define P11PROV_NAMES_ECDSA_SHA384 \ + "ECDSA-SHA2-384:ECDSA-SHA384:ecdsa-with-SHA384:1.2.840.10045.4.3.3" +#define P11PROV_DESCS_ECDSA_SHA384 "PKCS11 ECDSA-SHA384 Implementation" +#define P11PROV_NAMES_ECDSA_SHA512 \ + "ECDSA-SHA2-512:ECDSA-SHA512:ecdsa-with-SHA512:1.2.840.10045.4.3.4" +#define P11PROV_DESCS_ECDSA_SHA512 "PKCS11 ECDSA-SHA512 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_224 \ + "ECDSA-SHA3-224:ecdsa_with_SHA3-224:id-ecdsa-with-sha3-224:2.16.840.1." \ + "101.3.4.3.9" +#define P11PROV_DESCS_ECDSA_SHA3_224 "PKCS11 ECDSA-SHA3_224 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_256 \ + "ECDSA-SHA3-256:ecdsa_with_SHA3-256:id-ecdsa-with-sha3-256:2.16.840.1." \ + "101.3.4.3.10" +#define P11PROV_DESCS_ECDSA_SHA3_256 "PKCS11 ECDSA-SHA3_256 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_384 \ + "ECDSA-SHA3-384:ecdsa_with_SHA3-384:id-ecdsa-with-sha3-384:2.16.840.1." \ + "101.3.4.3.11" +#define P11PROV_DESCS_ECDSA_SHA3_384 "PKCS11 ECDSA-SHA3_384 Implementation" +#define P11PROV_NAMES_ECDSA_SHA3_512 \ + "ECDSA-SHA3-512:ecdsa_with_SHA3-512:id-ecdsa-with-sha3-512:2.16.840.1." \ + "101.3.4.3.12" +#define P11PROV_DESCS_ECDSA_SHA3_512 "PKCS11 ECDSA-SHA3_512 Implementation" +#define P11PROV_NAMES_ECDH P11PROV_NAME_ECDH +#define P11PROV_DESCS_ECDH "PKCS11 ECDH Implementation" +#define P11PROV_NAMES_HKDF "HKDF" +#define P11PROV_DESCS_HKDF "PKCS11 HKDF Implementation" +#define P11PROV_NAMES_ED25519 "ED25519:1.3.101.112" +#define P11PROV_DESCS_ED25519 "PKCS11 ED25519 Implementation" +#define P11PROV_NAMES_ED25519PH "ED25519ph" +#define P11PROV_DESCS_ED25519PH "PKCS11 ED25519ph implementation" +#define P11PROV_NAMES_ED25519CTX "ED25519ctx" +#define P11PROV_DESCS_ED25519CTX "PKCS11 ED25519ctx implementation" +#define P11PROV_NAMES_ED448 "ED448:1.3.101.113" +#define P11PROV_DESCS_ED448 "PKCS11 ED448 Implementation" +#define P11PROV_NAMES_ED448PH "ED448ph" +#define P11PROV_DESCS_ED448PH "PKCS11 ED448ph implementation" +#define P11PROV_NAMES_X25519 "X25519:1.3.101.110" +#define P11PROV_DESCS_X25519 "PKCS11 X25519 Implementation" +#define P11PROV_NAMES_X448 "X448:1.3.101.111" +#define P11PROV_DESCS_X448 "PKCS11 X448 Implementation" +#define P11PROV_NAMES_MLDSA_44 \ + "ML-DSA-44:MLDSA44:2.16.840.1.101.3.4.3.17:id-ml-dsa-44" +#define P11PROV_DESCS_MLDSA_44 "PKCS11 ML-DSA-44 implementation" +#define P11PROV_NAMES_MLDSA_65 \ + "ML-DSA-65:MLDSA65:2.16.840.1.101.3.4.3.18:id-ml-dsa-65" +#define P11PROV_DESCS_MLDSA_65 "PKCS11 ML-DSA-65 implementation" +#define P11PROV_NAMES_MLDSA_87 \ + "ML-DSA-87:MLDSA87:2.16.840.1.101.3.4.3.19:id-ml-dsa-87" +#define P11PROV_DESCS_MLDSA_87 "PKCS11 ML-DSA-87 implementation" +#define P11PROV_NAMES_ML_KEM_512 \ + "ML-KEM-512:MLKEM512:id-alg-ml-kem-512:2.16.840.1.101.3.4.4.1" +#define P11PROV_DESCS_ML_KEM_512 "PKCS11 ML-KEM-512 implementation" +#define P11PROV_NAMES_ML_KEM_768 \ + "ML-KEM-768:MLKEM768:id-alg-ml-kem-768:2.16.840.1.101.3.4.4.2" +#define P11PROV_DESCS_ML_KEM_768 "PKCS11 ML-KEM-768 implementation" +#define P11PROV_NAMES_ML_KEM_1024 \ + "ML-KEM-1024:MLKEM1024:id-alg-ml-kem-1024:2.16.840.1.101.3.4.4.3" +#define P11PROV_DESCS_ML_KEM_1024 "PKCS11 ML-KEM-1024 implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_128S \ + "SLH-DSA-SHA2-128s:2.16.840.1.101.3.4.3.20" +#define P11PROV_DESCS_SLHDSA_SHA2_128S "PKCS11 SLH-DSA-SHA2-128s implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_128F \ + "SLH-DSA-SHA2-128f:2.16.840.1.101.3.4.3.21" +#define P11PROV_DESCS_SLHDSA_SHA2_128F "PKCS11 SLH-DSA-SHA2-128f implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_192S \ + "SLH-DSA-SHA2-192s:2.16.840.1.101.3.4.3.22" +#define P11PROV_DESCS_SLHDSA_SHA2_192S "PKCS11 SLH-DSA-SHA2-192s implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_192F \ + "SLH-DSA-SHA2-192f:2.16.840.1.101.3.4.3.23" +#define P11PROV_DESCS_SLHDSA_SHA2_192F "PKCS11 SLH-DSA-SHA2-192f implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_256S \ + "SLH-DSA-SHA2-256s:2.16.840.1.101.3.4.3.24" +#define P11PROV_DESCS_SLHDSA_SHA2_256S "PKCS11 SLH-DSA-SHA2-256s implementation" +#define P11PROV_NAMES_SLHDSA_SHA2_256F \ + "SLH-DSA-SHA2-256f:2.16.840.1.101.3.4.3.25" +#define P11PROV_DESCS_SLHDSA_SHA2_256F "PKCS11 SLH-DSA-SHA2-256f implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_128S \ + "SLH-DSA-SHAKE-128s:2.16.840.1.101.3.4.3.26" +#define P11PROV_DESCS_SLHDSA_SHAKE_128S \ + "PKCS11 SLH-DSA-SHAKE-128s implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_128F \ + "SLH-DSA-SHAKE-128f:2.16.840.1.101.3.4.3.27" +#define P11PROV_DESCS_SLHDSA_SHAKE_128F \ + "PKCS11 SLH-DSA-SHAKE-128f implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_192S \ + "SLH-DSA-SHAKE-192s:2.16.840.1.101.3.4.3.28" +#define P11PROV_DESCS_SLHDSA_SHAKE_192S \ + "PKCS11 SLH-DSA-SHAKE-192s implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_192F \ + "SLH-DSA-SHAKE-192f:2.16.840.1.101.3.4.3.29" +#define P11PROV_DESCS_SLHDSA_SHAKE_192F \ + "PKCS11 SLH-DSA-SHAKE-192f implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_256S \ + "SLH-DSA-SHAKE-256s:2.16.840.1.101.3.4.3.30" +#define P11PROV_DESCS_SLHDSA_SHAKE_256S \ + "PKCS11 SLH-DSA-SHAKE-256s implementation" +#define P11PROV_NAMES_SLHDSA_SHAKE_256F \ + "SLH-DSA-SHAKE-256f:2.16.840.1.101.3.4.3.31" +#define P11PROV_DESCS_SLHDSA_SHAKE_256F \ + "PKCS11 SLH-DSA-SHAKE-256f implementation" +#define P11PROV_NAMES_RAND "PKCS11-RAND" +#define P11PROV_DESCS_RAND "PKCS11 Random Generator" +#define P11PROV_NAMES_TLS13_KDF "TLS13-KDF" +#define P11PROV_DESCS_TLS13_KDF "PKCS11 TLS 1.3 HKDF Implementation" +#define P11PROV_NAMES_URI "pkcs11" +#define P11PROV_DESCS_URI "PKCS11 URI Store" +#define P11PROV_NAMES_AES "AES:2.16.840.1.101.3.4.1" +#define P11PROV_DESCS_AES "PKCS11 AES Implementation" +#define P11PROV_NAMES_AES_128_ECB "AES-128-ECB:2.16.840.1.101.3.4.1.1" +#define P11PROV_DESCS_AES_128_ECB "AES-128 ECB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_ECB "AES-192-ECB:2.16.840.1.101.3.4.1.21" +#define P11PROV_DESCS_AES_192_ECB "AES-192 ECB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_ECB "AES-256-ECB:2.16.840.1.101.3.4.1.41" +#define P11PROV_DESCS_AES_256_ECB "AES-256 ECB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CBC \ + "AES-128-CBC:AES128:aes128:2.16.840.1.101.3.4.1.2" +#define P11PROV_DESCS_AES_128_CBC "AES-128 CBC PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CBC \ + "AES-192-CBC:AES192:aes192:2.16.840.1.101.3.4.1.22" +#define P11PROV_DESCS_AES_192_CBC "AES-192 CBC PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CBC \ + "AES-256-CBC:AES256:aes256:2.16.840.1.101.3.4.1.42" +#define P11PROV_DESCS_AES_256_CBC "AES-256 CBC PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_OFB "AES-128-OFB:2.16.840.1.101.3.4.1.3" +#define P11PROV_DESCS_AES_128_OFB "AES-128 OFB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_OFB "AES-192-OFB:2.16.840.1.101.3.4.1.23" +#define P11PROV_DESCS_AES_192_OFB "AES-192 OFB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_OFB "AES-256-OFB:2.16.840.1.101.3.4.1.43" +#define P11PROV_DESCS_AES_256_OFB "AES-256 OFB PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CFB "AES-128-CFB:2.16.840.1.101.3.4.1.4" +#define P11PROV_DESCS_AES_128_CFB \ + "AES-128 CFB128 PKCS11 provider Implementation" +#define P11PROV_NAMES_AES_192_CFB "AES-192-CFB:2.16.840.1.101.3.4.1.24" +#define P11PROV_DESCS_AES_192_CFB \ + "AES-192 CFB128 PKCS11 provider Implementation" +#define P11PROV_NAMES_AES_256_CFB "AES-256-CFB:2.16.840.1.101.3.4.1.44" +#define P11PROV_DESCS_AES_256_CFB \ + "AES-256 CFB128 PKCS11 provider Implementation" +#define P11PROV_NAMES_AES_128_CFB1 "AES-128-CFB1" +#define P11PROV_DESCS_AES_128_CFB1 "AES-128 CFB1 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CFB1 "AES-192-CFB1" +#define P11PROV_DESCS_AES_192_CFB1 "AES-192 CFB1 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CFB1 "AES-256-CFB1" +#define P11PROV_DESCS_AES_256_CFB1 "AES-256 CFB1 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CFB8 "AES-128-CFB8" +#define P11PROV_DESCS_AES_128_CFB8 "AES-128 CFB8 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CFB8 "AES-192-CFB8" +#define P11PROV_DESCS_AES_192_CFB8 "AES-192 CFB8 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CFB8 "AES-256-CFB8" +#define P11PROV_DESCS_AES_256_CFB8 "AES-256 CFB8 PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CTR "AES-128-CTR" +#define P11PROV_DESCS_AES_128_CTR "AES-128 CTR PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CTR "AES-192-CTR" +#define P11PROV_DESCS_AES_192_CTR "AES-192 CTR PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CTR "AES-256-CTR" +#define P11PROV_DESCS_AES_256_CTR "AES-256 CTR PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_CTS "AES-128-CBC-CTS" +#define P11PROV_DESCS_AES_128_CTS "AES-128 CTS PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_CTS "AES-192-CBC-CTS" +#define P11PROV_DESCS_AES_192_CTS "AES-192 CTS PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_CTS "AES-256-CBC-CTS" +#define P11PROV_DESCS_AES_256_CTS "AES-256 CTS PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_128_GCM "AES-128-GCM" +#define P11PROV_DESCS_AES_128_GCM "AES-128 GCM PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_192_GCM "AES-192-GCM" +#define P11PROV_DESCS_AES_192_GCM "AES-192 GCM PKCS11 Provider Implementation" +#define P11PROV_NAMES_AES_256_GCM "AES-256-GCM" +#define P11PROV_DESCS_AES_256_GCM "AES-256 GCM PKCS11 Provider Implementation" +#define P11PROV_NAMES_CHACHA20_256_POLY1305 "ChaCha20-Poly1305" +#define P11PROV_DESCS_CHACHA20_256_POLY1305 \ + "CHACHA20-POLY1305 PKCS11 Provider Implementation" +#define P11PROV_NAMES_GENERIC_SECRET "GENERIC-SECRET" +#define P11PROV_DESCS_GENERIC_SECRET "PKCS11 Generic Secret Implementation" + +#define P11PROV_NAMES_SHA1 "SHA1:SHA-1:SSL3-SHA1:1.3.14.3.2.26" +#define P11PROV_DESCS_SHA1 "PKCS11 SHA1 Implementation" +#define P11PROV_NAMES_SHA224 "SHA2-224:SHA-224:SHA224:2.16.840.1.101.3.4.2.4" +#define P11PROV_DESCS_SHA224 "PKCS11 SHA2-224 Implementation" +#define P11PROV_NAMES_SHA256 "SHA2-256:SHA-256:SHA256:2.16.840.1.101.3.4.2.1" +#define P11PROV_DESCS_SHA256 "PKCS11 SHA2-256 Implementation" +#define P11PROV_NAMES_SHA384 "SHA2-384:SHA-384:SHA384:2.16.840.1.101.3.4.2.2" +#define P11PROV_DESCS_SHA384 "PKCS11 SHA2-384 Implementation" +#define P11PROV_NAMES_SHA512 "SHA2-512:SHA-512:SHA512:2.16.840.1.101.3.4.2.3" +#define P11PROV_DESCS_SHA512 "PKCS11 SHA2-512 Implementation" +#define P11PROV_NAMES_SHA512_224 \ + "SHA2-512/224:SHA-512/224:SHA512-224:2.16.840.1.101.3.4.2.5" +#define P11PROV_DESCS_SHA512_224 "PKCS11 SHA2-512/224 Implementation" +#define P11PROV_NAMES_SHA512_256 \ + "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6" +#define P11PROV_DESCS_SHA512_256 "PKCS11 SHA2-512/224 Implementation" +#define P11PROV_NAMES_SHA3_224 "SHA3-224:2.16.840.1.101.3.4.2.7" +#define P11PROV_DESCS_SHA3_224 "PKCS11 SHA3-224 Implementation" +#define P11PROV_NAMES_SHA3_256 "SHA3-256:2.16.840.1.101.3.4.2.8" +#define P11PROV_DESCS_SHA3_256 "PKCS11 SHA3-256 Implementation" +#define P11PROV_NAMES_SHA3_384 "SHA3-384:2.16.840.1.101.3.4.2.9" +#define P11PROV_DESCS_SHA3_384 "PKCS11 SHA3-384 Implementation" +#define P11PROV_NAMES_SHA3_512 "SHA3-512:2.16.840.1.101.3.4.2.10" +#define P11PROV_DESCS_SHA3_512 "PKCS11 SHA3-512 Implementation" + +#define DEFAULT_ALGORITHM(name, func) \ + { \ + P11PROV_NAMES_##name, \ + P11PROV_DEFAULT_PROPERTIES, \ + func, \ + P11PROV_DESCS_##name, \ + } + +void p11prov_assign_alg(OSSL_ALGORITHM *dest, const OSSL_ALGORITHM *algs, + int idx, const char *fips_property); + +#endif /* _REGISTRATION_H_ */ diff --git a/src/sig/ecdsa.c b/src/sig/ecdsa.c index fa248a25..c238a281 100644 --- a/src/sig/ecdsa.c +++ b/src/sig/ecdsa.c @@ -8,6 +8,9 @@ #include "openssl/ec.h" #include "openssl/err.h" +#define DISPATCH_ECDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_ecdsa, name) + DISPATCH_ECDSA_FN(newctx); DISPATCH_ECDSA_FN(sign_init); DISPATCH_ECDSA_FN(sign); @@ -662,7 +665,7 @@ static const OSSL_PARAM *p11prov_ecdsa_settable_ctx_params(void *ctx, return params; } -const OSSL_DISPATCH p11prov_ecdsa_signature_functions[] = { +const OSSL_DISPATCH p11prov_ecdsa_functions[] = { DISPATCH_SIG_ELEM(ecdsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -695,7 +698,7 @@ const OSSL_DISPATCH p11prov_ecdsa_signature_functions[] = { { \ return p11prov_ecdsa_digest_verify_init(ctx, digest, provkey, params); \ } \ - const OSSL_DISPATCH p11prov_ecdsa_##alg##_signature_functions[] = { \ + const OSSL_DISPATCH p11prov_ecdsa_##alg##_functions[] = { \ DISPATCH_SIG_ELEM(ecdsa, NEWCTX, newctx), \ DISPATCH_SIG_ELEM(sig, FREECTX, freectx), \ DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), \ diff --git a/src/sig/eddsa.c b/src/sig/eddsa.c index 70d82d30..d7030752 100644 --- a/src/sig/eddsa.c +++ b/src/sig/eddsa.c @@ -8,6 +8,9 @@ #include "openssl/ec.h" #include "openssl/err.h" +#define DISPATCH_EDDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_eddsa, name) + DISPATCH_EDDSA_FN(newctx); DISPATCH_EDDSA_FN(digest_sign_init); DISPATCH_EDDSA_FN(sign); @@ -492,7 +495,7 @@ static const char **p11prov_ed448_query_key_types(void) } #endif /* OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT */ -const OSSL_DISPATCH p11prov_ed25519_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed25519_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -514,7 +517,7 @@ const OSSL_DISPATCH p11prov_ed25519_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_ed448_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed448_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -537,7 +540,7 @@ const OSSL_DISPATCH p11prov_ed448_signature_functions[] = { }; #if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -const OSSL_DISPATCH p11prov_ed25519ph_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed25519ph_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -549,7 +552,7 @@ const OSSL_DISPATCH p11prov_ed25519ph_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_ed25519ctx_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed25519ctx_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -561,7 +564,7 @@ const OSSL_DISPATCH p11prov_ed25519ctx_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_ed448ph_signature_functions[] = { +const OSSL_DISPATCH p11prov_ed448ph_functions[] = { DISPATCH_SIG_ELEM(eddsa, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), diff --git a/src/sig/internal.h b/src/sig/internal.h index 6e7d93c7..ed6a1a5d 100644 --- a/src/sig/internal.h +++ b/src/sig/internal.h @@ -4,6 +4,11 @@ #ifndef _SIG_INTERNAL_H #define _SIG_INTERNAL_H +#include "sig/signature.h" + +struct p11prov_sig_ctx; +typedef struct p11prov_sig_ctx P11PROV_SIG_CTX; + enum instance { ED_Unset = 0, ED_25519, @@ -110,4 +115,54 @@ int p11prov_sig_digest_final(P11PROV_SIG_CTX *sigctx, unsigned char *sig, #define DER_NIST_SIGALGS DER_NIST_ALGS, 0x03 #define DER_NIST_SIGALGS_LEN (DER_NIST_ALGS_LEN + 1) +#define DISPATCH_SIG_ELEM(prefix, NAME, name) \ + { OSSL_FUNC_SIGNATURE_##NAME, (void (*)(void))p11prov_##prefix##_##name } + +extern const OSSL_DISPATCH p11prov_rsa_functions[]; +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) +extern const OSSL_DISPATCH p11prov_rsa_sha1_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha224_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha256_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha384_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha512_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_224_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_256_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_384_functions[]; +extern const OSSL_DISPATCH p11prov_rsa_sha3_512_functions[]; +#endif +extern const OSSL_DISPATCH p11prov_ecdsa_functions[]; +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) +extern const OSSL_DISPATCH p11prov_ecdsa_sha1_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha224_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha256_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha384_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha512_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_224_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_256_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_384_functions[]; +extern const OSSL_DISPATCH p11prov_ecdsa_sha3_512_functions[]; +#endif +extern const OSSL_DISPATCH p11prov_ed25519_functions[]; +extern const OSSL_DISPATCH p11prov_ed448_functions[]; +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) +extern const OSSL_DISPATCH p11prov_ed25519ph_functions[]; +extern const OSSL_DISPATCH p11prov_ed25519ctx_functions[]; +extern const OSSL_DISPATCH p11prov_ed448ph_functions[]; +#endif +extern const OSSL_DISPATCH p11prov_mldsa_44_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa_65_functions[]; +extern const OSSL_DISPATCH p11prov_mldsa_87_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_functions[]; +extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_functions[]; + #endif /* _SIG_INTERNAL_H */ diff --git a/src/sig/mldsa.c b/src/sig/mldsa.c index 1b427af2..63f130a1 100644 --- a/src/sig/mldsa.c +++ b/src/sig/mldsa.c @@ -7,6 +7,9 @@ #include "openssl/evp.h" #include "openssl/err.h" +#define DISPATCH_MLDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_mldsa, name) + DISPATCH_MLDSA_FN(sign_init); DISPATCH_MLDSA_FN(sign); DISPATCH_MLDSA_FN(verify_init); @@ -555,7 +558,7 @@ static const OSSL_PARAM *p11prov_mldsa_settable_ctx_params(void *ctx, return params; } -const OSSL_DISPATCH p11prov_mldsa_44_signature_functions[] = { +const OSSL_DISPATCH p11prov_mldsa_44_functions[] = { DISPATCH_SIG_ELEM(mldsa_44, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -586,7 +589,7 @@ const OSSL_DISPATCH p11prov_mldsa_44_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_mldsa_65_signature_functions[] = { +const OSSL_DISPATCH p11prov_mldsa_65_functions[] = { DISPATCH_SIG_ELEM(mldsa_65, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -617,7 +620,7 @@ const OSSL_DISPATCH p11prov_mldsa_65_signature_functions[] = { { 0, NULL }, }; -const OSSL_DISPATCH p11prov_mldsa_87_signature_functions[] = { +const OSSL_DISPATCH p11prov_mldsa_87_functions[] = { DISPATCH_SIG_ELEM(mldsa_87, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), diff --git a/src/sig/rsasig.c b/src/sig/rsasig.c index 1fd0c1d2..46241cc2 100644 --- a/src/sig/rsasig.c +++ b/src/sig/rsasig.c @@ -385,6 +385,9 @@ static int p11prov_rsasig_set_pss_saltlen_max(void *ctx, bool max_to_digest) return RET_OSSL_OK; } +#define DISPATCH_RSASIG_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_rsasig, name) + DISPATCH_RSASIG_FN(newctx); DISPATCH_RSASIG_FN(sign_init); DISPATCH_RSASIG_FN(sign); @@ -1258,7 +1261,7 @@ static const OSSL_PARAM *p11prov_rsasig_settable_ctx_params(void *ctx, return params; } -const OSSL_DISPATCH p11prov_rsa_signature_functions[] = { +const OSSL_DISPATCH p11prov_rsa_functions[] = { DISPATCH_SIG_ELEM(rsasig, NEWCTX, newctx), DISPATCH_SIG_ELEM(sig, FREECTX, freectx), DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), @@ -1292,7 +1295,7 @@ const OSSL_DISPATCH p11prov_rsa_signature_functions[] = { return p11prov_rsasig_digest_verify_init(ctx, digest, provkey, \ params); \ } \ - const OSSL_DISPATCH p11prov_rsa_##alg##_signature_functions[] = { \ + const OSSL_DISPATCH p11prov_rsa_##alg##_functions[] = { \ DISPATCH_SIG_ELEM(rsasig, NEWCTX, newctx), \ DISPATCH_SIG_ELEM(sig, FREECTX, freectx), \ DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), \ diff --git a/src/sig/signature.c b/src/sig/signature.c index 84e3c512..4a2013b5 100644 --- a/src/sig/signature.c +++ b/src/sig/signature.c @@ -670,3 +670,315 @@ int p11prov_sig_digest_final(P11PROV_SIG_CTX *sigctx, unsigned char *sig, sigctx->session = NULL; return result; } + +enum p11prov_signature_algorithms { + P11PROV_SIG_RSA = 0, +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + P11PROV_SIG_RSA_SHA1, + P11PROV_SIG_RSA_SHA224, + P11PROV_SIG_RSA_SHA256, + P11PROV_SIG_RSA_SHA384, + P11PROV_SIG_RSA_SHA512, + P11PROV_SIG_RSA_SHA3_224, + P11PROV_SIG_RSA_SHA3_256, + P11PROV_SIG_RSA_SHA3_384, + P11PROV_SIG_RSA_SHA3_512, +#endif + P11PROV_SIG_ECDSA, +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + P11PROV_SIG_ECDSA_SHA1, + P11PROV_SIG_ECDSA_SHA224, + P11PROV_SIG_ECDSA_SHA256, + P11PROV_SIG_ECDSA_SHA384, + P11PROV_SIG_ECDSA_SHA512, + P11PROV_SIG_ECDSA_SHA3_224, + P11PROV_SIG_ECDSA_SHA3_256, + P11PROV_SIG_ECDSA_SHA3_384, + P11PROV_SIG_ECDSA_SHA3_512, +#endif + P11PROV_SIG_ED25519, + P11PROV_SIG_ED448, +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + P11PROV_SIG_ED25519PH, + P11PROV_SIG_ED25519CTX, + P11PROV_SIG_ED448PH, +#endif + P11PROV_SIG_MLDSA_44, + P11PROV_SIG_MLDSA_65, + P11PROV_SIG_MLDSA_87, + P11PROV_SIG_SLHDSA_SHA2_128S, + P11PROV_SIG_SLHDSA_SHAKE_128S, + P11PROV_SIG_SLHDSA_SHA2_128F, + P11PROV_SIG_SLHDSA_SHAKE_128F, + P11PROV_SIG_SLHDSA_SHA2_192S, + P11PROV_SIG_SLHDSA_SHAKE_192S, + P11PROV_SIG_SLHDSA_SHA2_192F, + P11PROV_SIG_SLHDSA_SHAKE_192F, + P11PROV_SIG_SLHDSA_SHA2_256S, + P11PROV_SIG_SLHDSA_SHAKE_256S, + P11PROV_SIG_SLHDSA_SHA2_256F, + P11PROV_SIG_SLHDSA_SHAKE_256F, + P11PROV_SIG_NUM_ALGS +}; + +const OSSL_ALGORITHM signature_algorithms[P11PROV_SIG_NUM_ALGS] = { + [P11PROV_SIG_RSA] = DEFAULT_ALGORITHM(RSA, p11prov_rsa_functions), +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + [P11PROV_SIG_RSA_SHA1] = + DEFAULT_ALGORITHM(RSA_SHA1, p11prov_rsa_sha1_functions), + [P11PROV_SIG_RSA_SHA224] = + DEFAULT_ALGORITHM(RSA_SHA224, p11prov_rsa_sha224_functions), + [P11PROV_SIG_RSA_SHA256] = + DEFAULT_ALGORITHM(RSA_SHA256, p11prov_rsa_sha256_functions), + [P11PROV_SIG_RSA_SHA384] = + DEFAULT_ALGORITHM(RSA_SHA384, p11prov_rsa_sha384_functions), + [P11PROV_SIG_RSA_SHA512] = + DEFAULT_ALGORITHM(RSA_SHA512, p11prov_rsa_sha512_functions), + [P11PROV_SIG_RSA_SHA3_224] = + DEFAULT_ALGORITHM(RSA_SHA3_224, p11prov_rsa_sha3_224_functions), + [P11PROV_SIG_RSA_SHA3_256] = + DEFAULT_ALGORITHM(RSA_SHA3_256, p11prov_rsa_sha3_256_functions), + [P11PROV_SIG_RSA_SHA3_384] = + DEFAULT_ALGORITHM(RSA_SHA3_384, p11prov_rsa_sha3_384_functions), + [P11PROV_SIG_RSA_SHA3_512] = + DEFAULT_ALGORITHM(RSA_SHA3_512, p11prov_rsa_sha3_512_functions), +#endif + [P11PROV_SIG_ECDSA] = DEFAULT_ALGORITHM(ECDSA, p11prov_ecdsa_functions), +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + [P11PROV_SIG_ECDSA_SHA1] = + DEFAULT_ALGORITHM(ECDSA_SHA1, p11prov_ecdsa_sha1_functions), + [P11PROV_SIG_ECDSA_SHA224] = + DEFAULT_ALGORITHM(ECDSA_SHA224, p11prov_ecdsa_sha224_functions), + [P11PROV_SIG_ECDSA_SHA256] = + DEFAULT_ALGORITHM(ECDSA_SHA256, p11prov_ecdsa_sha256_functions), + [P11PROV_SIG_ECDSA_SHA384] = + DEFAULT_ALGORITHM(ECDSA_SHA384, p11prov_ecdsa_sha384_functions), + [P11PROV_SIG_ECDSA_SHA512] = + DEFAULT_ALGORITHM(ECDSA_SHA512, p11prov_ecdsa_sha512_functions), + [P11PROV_SIG_ECDSA_SHA3_224] = + DEFAULT_ALGORITHM(ECDSA_SHA3_224, p11prov_ecdsa_sha3_224_functions), + [P11PROV_SIG_ECDSA_SHA3_256] = + DEFAULT_ALGORITHM(ECDSA_SHA3_256, p11prov_ecdsa_sha3_256_functions), + [P11PROV_SIG_ECDSA_SHA3_384] = + DEFAULT_ALGORITHM(ECDSA_SHA3_384, p11prov_ecdsa_sha3_384_functions), + [P11PROV_SIG_ECDSA_SHA3_512] = + DEFAULT_ALGORITHM(ECDSA_SHA3_512, p11prov_ecdsa_sha3_512_functions), +#endif + [P11PROV_SIG_ED25519] = + DEFAULT_ALGORITHM(ED25519, p11prov_ed25519_functions), + [P11PROV_SIG_ED448] = DEFAULT_ALGORITHM(ED448, p11prov_ed448_functions), +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + [P11PROV_SIG_ED25519PH] = + DEFAULT_ALGORITHM(ED25519PH, p11prov_ed25519ph_functions), + [P11PROV_SIG_ED25519CTX] = + DEFAULT_ALGORITHM(ED25519CTX, p11prov_ed25519ctx_functions), + [P11PROV_SIG_ED448PH] = + DEFAULT_ALGORITHM(ED448PH, p11prov_ed448ph_functions), +#endif + [P11PROV_SIG_MLDSA_44] = + DEFAULT_ALGORITHM(MLDSA_44, p11prov_mldsa_44_functions), + [P11PROV_SIG_MLDSA_65] = + DEFAULT_ALGORITHM(MLDSA_65, p11prov_mldsa_65_functions), + [P11PROV_SIG_MLDSA_87] = + DEFAULT_ALGORITHM(MLDSA_87, p11prov_mldsa_87_functions), + [P11PROV_SIG_SLHDSA_SHA2_128S] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_128S, p11prov_slhdsa_sha2_128s_functions), + [P11PROV_SIG_SLHDSA_SHAKE_128S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128S, p11prov_slhdsa_shake_128s_functions), + [P11PROV_SIG_SLHDSA_SHA2_128F] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_128F, p11prov_slhdsa_sha2_128f_functions), + [P11PROV_SIG_SLHDSA_SHAKE_128F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_128F, p11prov_slhdsa_shake_128f_functions), + [P11PROV_SIG_SLHDSA_SHA2_192S] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_192S, p11prov_slhdsa_sha2_192s_functions), + [P11PROV_SIG_SLHDSA_SHAKE_192S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192S, p11prov_slhdsa_shake_192s_functions), + [P11PROV_SIG_SLHDSA_SHA2_192F] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_192F, p11prov_slhdsa_sha2_192f_functions), + [P11PROV_SIG_SLHDSA_SHAKE_192F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_192F, p11prov_slhdsa_shake_192f_functions), + [P11PROV_SIG_SLHDSA_SHA2_256S] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_256S, p11prov_slhdsa_sha2_256s_functions), + [P11PROV_SIG_SLHDSA_SHAKE_256S] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256S, p11prov_slhdsa_shake_256s_functions), + [P11PROV_SIG_SLHDSA_SHA2_256F] = + DEFAULT_ALGORITHM(SLHDSA_SHA2_256F, p11prov_slhdsa_sha2_256f_functions), + [P11PROV_SIG_SLHDSA_SHAKE_256F] = DEFAULT_ALGORITHM( + SLHDSA_SHAKE_256F, p11prov_slhdsa_shake_256f_functions), +}; + +CK_RV p11prov_register_signatures(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property) +{ + const char *property = NULL; + OSSL_ALGORITHM *algs = + OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_SIG_NUM_ALGS + 1)); + int i = 0; + + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + if (fips_property) { + property = P11PROV_FIPS_PROPERTIES; + } + + if (mechs[TBID_RSA_PKCS] || mechs[TBID_RSA_PKCS_PSS] + || mechs[TBID_SHA1_RSA_PKCS] || mechs[TBID_SHA224_RSA_PKCS] + || mechs[TBID_SHA256_RSA_PKCS] || mechs[TBID_SHA384_RSA_PKCS] + || mechs[TBID_SHA512_RSA_PKCS] || mechs[TBID_SHA3_224_RSA_PKCS] + || mechs[TBID_SHA3_256_RSA_PKCS] || mechs[TBID_SHA3_384_RSA_PKCS] + || mechs[TBID_SHA3_512_RSA_PKCS] || mechs[TBID_SHA1_RSA_PKCS_PSS] + || mechs[TBID_SHA224_RSA_PKCS_PSS] || mechs[TBID_SHA256_RSA_PKCS_PSS] + || mechs[TBID_SHA384_RSA_PKCS_PSS] || mechs[TBID_SHA512_RSA_PKCS_PSS] + || mechs[TBID_SHA3_224_RSA_PKCS_PSS] + || mechs[TBID_SHA3_256_RSA_PKCS_PSS] + || mechs[TBID_SHA3_384_RSA_PKCS_PSS] + || mechs[TBID_SHA3_512_RSA_PKCS_PSS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, P11PROV_SIG_RSA, + property); + } +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + if (mechs[TBID_SHA1_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA1, property); + } + if (mechs[TBID_SHA224_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA224, property); + } + if (mechs[TBID_SHA256_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA256, property); + } + if (mechs[TBID_SHA384_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA384, property); + } + if (mechs[TBID_SHA512_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA512, property); + } + if (mechs[TBID_SHA3_224_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_224, property); + } + if (mechs[TBID_SHA3_256_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_256, property); + } + if (mechs[TBID_SHA3_384_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_384, property); + } + if (mechs[TBID_SHA3_512_RSA_PKCS]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_RSA_SHA3_512, property); + } +#endif + + if (mechs[TBID_ECDSA] || mechs[TBID_ECDSA_SHA1] || mechs[TBID_ECDSA_SHA224] + || mechs[TBID_ECDSA_SHA256] || mechs[TBID_ECDSA_SHA384] + || mechs[TBID_ECDSA_SHA512] || mechs[TBID_ECDSA_SHA3_224] + || mechs[TBID_ECDSA_SHA3_256] || mechs[TBID_ECDSA_SHA3_384] + || mechs[TBID_ECDSA_SHA3_512]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, P11PROV_SIG_ECDSA, + property); + } +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + if (mechs[TBID_ECDSA_SHA1]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA1, property); + } + if (mechs[TBID_ECDSA_SHA224]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA224, property); + } + if (mechs[TBID_ECDSA_SHA256]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA256, property); + } + if (mechs[TBID_ECDSA_SHA384]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA384, property); + } + if (mechs[TBID_ECDSA_SHA512]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA512, property); + } + if (mechs[TBID_ECDSA_SHA3_224]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_224, property); + } + if (mechs[TBID_ECDSA_SHA3_256]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_256, property); + } + if (mechs[TBID_ECDSA_SHA3_384]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_384, property); + } + if (mechs[TBID_ECDSA_SHA3_512]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ECDSA_SHA3_512, property); + } +#endif + + if (mechs[TBID_EDDSA] || mechs[TBID_EC_EDWARDS_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED25519, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, P11PROV_SIG_ED448, + property); +#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED25519PH, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED25519CTX, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_ED448PH, property); +#endif + } + + if (mechs[TBID_ML_DSA] || mechs[TBID_ML_DSA_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_MLDSA_44, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_MLDSA_65, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_MLDSA_87, property); + } + + if (mechs[TBID_SLH_DSA] || mechs[TBID_SLH_DSA_KEY_PAIR_GEN]) { + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_128S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_128S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_128F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_128F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_192S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_192S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_192F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_192F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_256S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_256S, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHA2_256F, property); + p11prov_assign_alg(&algs[i++], signature_algorithms, + P11PROV_SIG_SLHDSA_SHAKE_256F, property); + } + + if (i == 0) { + OPENSSL_free(algs); + algs = NULL; + } + + return p11prov_ctx_add_algs(ctx, OSSL_OP_SIGNATURE, algs); +} diff --git a/src/sig/signature.h b/src/sig/signature.h index 298c6fb4..1bb7b0e4 100644 --- a/src/sig/signature.h +++ b/src/sig/signature.h @@ -4,82 +4,9 @@ #ifndef _SIGNATURE_H #define _SIGNATURE_H -struct p11prov_sig_ctx; -typedef struct p11prov_sig_ctx P11PROV_SIG_CTX; - -/* common sig functions */ -#define DISPATCH_SIG_FN(name) DECL_DISPATCH_FUNC(signature, p11prov_sig, name) -#define DISPATCH_SIG_ELEM(prefix, NAME, name) \ - { \ - OSSL_FUNC_SIGNATURE_##NAME, (void (*)(void))p11prov_##prefix##_##name \ - } - -/* rsa sig functions */ -#define DISPATCH_RSASIG_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_rsasig, name) -extern const OSSL_DISPATCH p11prov_rsa_signature_functions[]; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -extern const OSSL_DISPATCH p11prov_rsa_sha1_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha512_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_rsa_sha3_512_signature_functions[]; -#endif - -/* ecdsa sig functions */ -#define DISPATCH_ECDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_ecdsa, name) -extern const OSSL_DISPATCH p11prov_ecdsa_signature_functions[]; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -extern const OSSL_DISPATCH p11prov_ecdsa_sha1_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha512_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_224_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_256_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_384_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ecdsa_sha3_512_signature_functions[]; -#endif - -/* eddsa sig functions */ -#define DISPATCH_EDDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_eddsa, name) -extern const OSSL_DISPATCH p11prov_ed25519_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ed448_signature_functions[]; -#if defined(OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT) -extern const OSSL_DISPATCH p11prov_ed25519ph_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ed25519ctx_signature_functions[]; -extern const OSSL_DISPATCH p11prov_ed448ph_signature_functions[]; -#endif - CK_MECHANISM_TYPE p11prov_digest_to_rsapss_mech(CK_MECHANISM_TYPE digest); -/* mldsa sig functions */ -#define DISPATCH_MLDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_mldsa, name) -extern const OSSL_DISPATCH p11prov_mldsa_44_signature_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_65_signature_functions[]; -extern const OSSL_DISPATCH p11prov_mldsa_87_signature_functions[]; - -/* slhdsa sig functions */ -#define DISPATCH_SLHDSA_FN(name) \ - DECL_DISPATCH_FUNC(signature, p11prov_slhdsa, name) -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_128f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_128f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_192f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_192f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256s_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_sha2_256f_signature_functions[]; -extern const OSSL_DISPATCH p11prov_slhdsa_shake_256f_signature_functions[]; +CK_RV p11prov_register_signatures(P11PROV_CTX *ctx, bool mechs[TBID_SIZE], + bool fips_property); #endif /* _SIGNATURE_H */ diff --git a/src/sig/slhdsa.c b/src/sig/slhdsa.c index 464ee410..e5552d51 100644 --- a/src/sig/slhdsa.c +++ b/src/sig/slhdsa.c @@ -7,6 +7,9 @@ #include "openssl/evp.h" #include "openssl/err.h" +#define DISPATCH_SLHDSA_FN(name) \ + DECL_DISPATCH_FUNC(signature, p11prov_slhdsa, name) + DISPATCH_SLHDSA_FN(sign_init); DISPATCH_SLHDSA_FN(sign); DISPATCH_SLHDSA_FN(verify_init); @@ -667,7 +670,7 @@ static const OSSL_PARAM *p11prov_slhdsa_settable_ctx_params(void *ctx, #endif #define SLHDSA_SIGNATURE_FUNCTIONS(variant) \ - const OSSL_DISPATCH p11prov_slhdsa_##variant##_signature_functions[] = { \ + const OSSL_DISPATCH p11prov_slhdsa_##variant##_functions[] = { \ DISPATCH_SIG_ELEM(slhdsa_##variant, NEWCTX, newctx), \ DISPATCH_SIG_ELEM(sig, FREECTX, freectx), \ DISPATCH_SIG_ELEM(sig, DUPCTX, dupctx), \ diff --git a/src/store.c b/src/store.c index c56ac3d8..ad83c36a 100644 --- a/src/store.c +++ b/src/store.c @@ -2,6 +2,7 @@ SPDX-License-Identifier: Apache-2.0 */ #include "provider.h" +#include #include #include "store.h" @@ -258,6 +259,8 @@ static void store_fetch(struct p11prov_store_ctx *ctx, p11prov_uri_free(search_uri); } +#define DISPATCH_STORE_FN(name) DECL_DISPATCH_FUNC(store, p11prov_store, name) + DISPATCH_STORE_FN(open); DISPATCH_STORE_FN(attach); DISPATCH_STORE_FN(load); @@ -819,6 +822,9 @@ int p11prov_store_direct_fetch(void *provctx, const char *uri, return ret; } +#define DISPATCH_STORE_ELEM(NAME, name) \ + { OSSL_FUNC_STORE_##NAME, (void (*)(void))p11prov_store_##name } + const OSSL_DISPATCH p11prov_store_functions[] = { DISPATCH_STORE_ELEM(OPEN, open), DISPATCH_STORE_ELEM(ATTACH, attach), @@ -830,3 +836,20 @@ const OSSL_DISPATCH p11prov_store_functions[] = { DISPATCH_STORE_ELEM(EXPORT_OBJECT, export_object), { 0, NULL }, }; + +OSSL_ALGORITHM store_algorithms[] = { + DEFAULT_ALGORITHM(URI, p11prov_store_functions), +}; + +CK_RV p11prov_register_store(P11PROV_CTX *ctx, bool fips_property) +{ + OSSL_ALGORITHM *algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * 2); + if (algs == NULL) { + return CKR_HOST_MEMORY; + } + + p11prov_assign_alg(&algs[0], store_algorithms, 0, + fips_property ? P11PROV_FIPS_PROPERTIES : NULL); + + return p11prov_ctx_add_algs(ctx, OSSL_OP_STORE, algs); +} diff --git a/src/store.h b/src/store.h index 4cce30cf..1dbc12f1 100644 --- a/src/store.h +++ b/src/store.h @@ -4,17 +4,10 @@ #ifndef _STORE_H #define _STORE_H -#include - -#define DISPATCH_STORE_FN(name) DECL_DISPATCH_FUNC(store, p11prov_store, name) -#define DISPATCH_STORE_ELEM(NAME, name) \ - { \ - OSSL_FUNC_STORE_##NAME, (void (*)(void))p11prov_store_##name \ - } -extern const OSSL_DISPATCH p11prov_store_functions[]; - int p11prov_store_direct_fetch(void *provctx, const char *uri, OSSL_CALLBACK *object_cb, void *object_cbarg, OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg); +CK_RV p11prov_register_store(P11PROV_CTX *ctx, bool fips_property); + #endif /* _STORE_H */ From 9a56991d42c48672a7399650a72f80693dbfde93 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Aug 2026 17:25:48 -0400 Subject: [PATCH 2/7] Consolidate initialization locking Move the initialization mutex from the module context to the provider context and introduce a new `P11PROV_OPS_NEEDS_INIT` state. By handling the lock at the context level, both module and operations initialization are now executed within a single locked section. This reduces lock toggling, optimizes initialization, and prevents race conditions when multiple threads attempt to initialize the provider simultaneously. Assisted-by: Gemini:Gemini Pro Latest Signed-off-by: Simo Sorce --- src/interface.c | 43 +++++++---------- src/interface.h | 4 +- src/provider.c | 120 ++++++++++++++++++++++++++++++++++++------------ src/provider.h | 11 +++++ 4 files changed, 120 insertions(+), 58 deletions(-) diff --git a/src/interface.c b/src/interface.c index 87b0434f..8e0cd616 100644 --- a/src/interface.c +++ b/src/interface.c @@ -22,7 +22,6 @@ struct p11prov_module_ctx { CK_INFO ck_info; - pthread_mutex_t lock; bool initialized; bool reinit; }; @@ -265,7 +264,6 @@ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, { struct p11prov_module_ctx *mctx; const char *env_module; - CK_RV ret; mctx = OPENSSL_zalloc(sizeof(struct p11prov_module_ctx)); if (!mctx) { @@ -303,12 +301,6 @@ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, } } - ret = MUTEX_INIT(mctx); - if (ret != CKR_OK) { - p11prov_module_free(mctx); - return ret; - } - *_mctx = mctx; return CKR_OK; } @@ -317,22 +309,19 @@ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, #define RTLD_DEEPBIND 0 #endif -CK_RV p11prov_module_init(P11PROV_MODULE *mctx) +CK_RV p11prov_module_init(P11PROV_CTX *ctx) { + P11PROV_MODULE *mctx; P11PROV_SLOTS_CTX *slots; CK_C_INITIALIZE_ARGS args = { 0 }; CK_RV ret; + mctx = p11prov_ctx_get_module(ctx); if (!mctx) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); return CKR_GENERAL_ERROR; } - ret = MUTEX_LOCK(mctx); - if (ret != CKR_OK) { - return ret; - } - - /* LOCKED SECTION ------------- */ if (mctx->initialized) { ret = CKR_OK; goto done; @@ -383,11 +372,13 @@ CK_RV p11prov_module_init(P11PROV_MODULE *mctx) p11prov_ctx_set_slots(mctx->provctx, slots); + p11prov_ctx_set_status(ctx, P11PROV_OPS_NEEDS_INIT); ret = CKR_OK; done: - (void)MUTEX_UNLOCK(mctx); - /* ------------- LOCKED SECTION */ + if (ret != CKR_OK) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); + } return ret; } @@ -421,24 +412,22 @@ void p11prov_module_mark_reinit(P11PROV_MODULE *mctx) mctx->reinit = true; } -CK_RV p11prov_module_reinit(P11PROV_MODULE *mctx) +CK_RV p11prov_module_reinit(P11PROV_CTX *ctx) { + P11PROV_MODULE *mctx; CK_C_INITIALIZE_ARGS args = { 0 }; CK_INFO ck_info = { 0 }; CK_RV ret; + mctx = p11prov_ctx_get_module(ctx); if (!mctx) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); return CKR_GENERAL_ERROR; } - ret = MUTEX_LOCK(mctx); - if (ret != CKR_OK) { - return ret; - } - - /* LOCKED SECTION ------------- */ if (!mctx->reinit) { /* another thread already did it */ + ret = CKR_OK; goto done; } @@ -495,9 +484,11 @@ CK_RV p11prov_module_reinit(P11PROV_MODULE *mctx) ret = CKR_GENERAL_ERROR; } + p11prov_ctx_set_status(ctx, P11PROV_INITIALIZED); done: - (void)MUTEX_UNLOCK(mctx); - /* ------------- LOCKED SECTION */ + if (ret != CKR_OK) { + p11prov_ctx_set_status(ctx, P11PROV_IN_ERROR); + } return ret; } diff --git a/src/interface.h b/src/interface.h index 8e255406..52e9b7e2 100644 --- a/src/interface.h +++ b/src/interface.h @@ -15,11 +15,11 @@ /* interface declarations for PKCS#11 wrapper functions */ CK_RV p11prov_module_new(P11PROV_CTX *ctx, const char *path, const char *init_args, P11PROV_MODULE **_mctx); -CK_RV p11prov_module_init(P11PROV_MODULE *mctx); +CK_RV p11prov_module_init(P11PROV_CTX *ctx); P11PROV_INTERFACE *p11prov_module_get_interface(P11PROV_MODULE *mctx); void p11prov_module_free(P11PROV_MODULE *mctx); void p11prov_module_mark_reinit(P11PROV_MODULE *mctx); -CK_RV p11prov_module_reinit(P11PROV_MODULE *mctx); +CK_RV p11prov_module_reinit(P11PROV_CTX *ctx); CK_RV p11prov_Initialize(P11PROV_CTX *ctx, CK_VOID_PTR pInitArgs); CK_RV p11prov_Finalize(P11PROV_CTX *ctx, CK_VOID_PTR pReserved); CK_RV p11prov_GetInfo(P11PROV_CTX *ctx, CK_INFO_PTR pInfo); diff --git a/src/provider.c b/src/provider.c index 250ee313..32b3553b 100644 --- a/src/provider.c +++ b/src/provider.c @@ -26,14 +26,8 @@ struct p11prov_interface; struct quirk; struct p11prov_ctx { - - enum { - P11PROV_UNINITIALIZED = 0, - P11PROV_INITIALIZED, - P11PROV_NEEDS_REINIT, - P11PROV_NO_DEINIT, - P11PROV_IN_ERROR, - } status; + pthread_mutex_t init_lock; + enum p11prov_ctx_status status; /* Provider handles */ const OSSL_CORE_HANDLE *handle; @@ -86,6 +80,19 @@ struct p11prov_ctx { int nquirks; }; +#define INIT_LOCK_INIT(ctx) \ + p11prov_mutex_init(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) +#define INIT_LOCK_LOCK(obj) \ + p11prov_mutex_lock(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) +#define INIT_LOCK_UNLOCK(obj) \ + p11prov_mutex_unlock(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) +#define INIT_LOCK_DESTROY(ctx) \ + p11prov_mutex_destroy(ctx, &ctx->init_lock, "init_lock", OPENSSL_FILE, \ + OPENSSL_LINE, OPENSSL_FUNC) + static struct p11prov_context_pool { struct p11prov_ctx **contexts; int num; @@ -479,6 +486,16 @@ P11PROV_INTERFACE *p11prov_ctx_get_interface(P11PROV_CTX *ctx) return p11prov_module_get_interface(ctx->module); } +P11PROV_MODULE *p11prov_ctx_get_module(P11PROV_CTX *ctx) +{ + return ctx->module; +} + +void p11prov_ctx_set_status(P11PROV_CTX *ctx, enum p11prov_ctx_status status) +{ + ctx->status = status; +} + CK_SLOT_ID p11prov_ctx_get_default_slotid(P11PROV_CTX *ctx) { return ctx->default_slotid; @@ -510,32 +527,54 @@ CK_RV p11prov_ctx_status(P11PROV_CTX *ctx) switch (ctx->status) { case P11PROV_UNINITIALIZED: - ret = p11prov_module_init(ctx->module); + ret = INIT_LOCK_LOCK(ctx); + if (ret != CKR_OK) { + return ret; + } + /* LOCKED SECTION ------------- */ + ret = p11prov_module_init(ctx); + /* optimize lock use and also init operations */ + if (ret == CKR_OK) { + ret = operations_init(ctx); + } + (void)INIT_LOCK_UNLOCK(ctx); + /* ------------- LOCKED SECTION */ if (ret != CKR_OK) { P11PROV_raise(ctx, ret, "Module initialization failed!"); - ctx->status = P11PROV_IN_ERROR; - break; + return ret; } + break; + case P11PROV_OPS_NEEDS_INIT: + ret = INIT_LOCK_LOCK(ctx); + if (ret != CKR_OK) { + return ret; + } + /* LOCKED SECTION ------------- */ ret = operations_init(ctx); + (void)INIT_LOCK_UNLOCK(ctx); + /* ------------- LOCKED SECTION */ if (ret != CKR_OK) { P11PROV_raise(ctx, ret, "Operations initialization failed!"); - ctx->status = P11PROV_IN_ERROR; - break; + return ret; } - ctx->status = P11PROV_INITIALIZED; break; case P11PROV_INITIALIZED: case P11PROV_NO_DEINIT: ret = CKR_OK; break; case P11PROV_NEEDS_REINIT: - ret = p11prov_module_reinit(ctx->module); + ret = INIT_LOCK_LOCK(ctx); + if (ret != CKR_OK) { + return ret; + } + /* LOCKED SECTION ------------- */ + ret = p11prov_module_reinit(ctx); + (void)INIT_LOCK_UNLOCK(ctx); + /* ------------- LOCKED SECTION */ if (ret != CKR_OK) { P11PROV_raise(ctx, ret, "Module re-initialization failed!"); - ctx->status = P11PROV_IN_ERROR; - break; + return ret; } - ctx->status = P11PROV_INITIALIZED; break; case P11PROV_IN_ERROR: P11PROV_raise(ctx, CKR_GENERAL_ERROR, "Module in error state!"); @@ -630,6 +669,8 @@ static void p11prov_ctx_free(P11PROV_CTX *ctx) /* remove from pool */ context_rm_pool(ctx); + INIT_LOCK_DESTROY(ctx); + OPENSSL_clear_free(ctx, sizeof(P11PROV_CTX)); } @@ -888,20 +929,26 @@ static CK_RV operations_init(P11PROV_CTX *ctx) bool available_mechs[TBID_SIZE] = { 0 }; CK_RV ret; + if (ctx->status != P11PROV_OPS_NEEDS_INIT) { + /* another thread did this first */ + ret = CKR_OK; + goto done; + } + ret = p11prov_get_mech_state_table(ctx, available_mechs); if (ret != CKR_OK) { - return ret; + goto done; } ret = p11prov_register_digests(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } #if SKEY_SUPPORT == 1 ret = p11prov_register_ciphers(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } #endif @@ -909,34 +956,34 @@ static CK_RV operations_init(P11PROV_CTX *ctx) ret = p11prov_register_kdfs(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } ret = p11prov_register_random(ctx, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } /* keymgmt -> static */ ret = p11prov_register_keyexch(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } ret = p11prov_register_signatures(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } ret = p11prov_register_asym_ciphers(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } ret = p11prov_register_kems(ctx, available_mechs, ctx->assume_fips); if (ret != CKR_OK) { - return ret; + goto done; } /* skeymgmt -> static */ @@ -947,7 +994,14 @@ static CK_RV operations_init(P11PROV_CTX *ctx) /* store -> static */ - return CKR_OK; + ctx->status = P11PROV_INITIALIZED; + ret = CKR_OK; + +done: + if (ret != CKR_OK) { + ctx->status = P11PROV_IN_ERROR; + } + return ret; } static CK_RV static_operations_init(P11PROV_CTX *ctx) @@ -1276,17 +1330,23 @@ int OSSL_provider_init(const OSSL_CORE_HANDLE *handle, const OSSL_DISPATCH *in, P11PROV_debug("Starting provider %s %d.%d", PACKAGE_NAME, PACKAGE_MAJOR, PACKAGE_MINOR); + ret = INIT_LOCK_INIT(ctx); + if (ret != 0) { + OPENSSL_free(ctx); + return RET_OSSL_ERR; + } + ret = pthread_rwlock_init(&ctx->quirk_lock, NULL); if (ret != 0) { ret = errno; P11PROV_debug("rwlock init failed (%d)", ret); - OPENSSL_free(ctx); + p11prov_ctx_free(ctx); return RET_OSSL_ERR; } ctx->libctx = OSSL_LIB_CTX_new_from_dispatch(handle, in); if (ctx->libctx == NULL) { - OPENSSL_free(ctx); + p11prov_ctx_free(ctx); return RET_OSSL_ERR; } diff --git a/src/provider.h b/src/provider.h index 1b7f6d4c..183d4ae0 100644 --- a/src/provider.h +++ b/src/provider.h @@ -67,7 +67,18 @@ typedef struct p11prov_obj_pool P11PROV_OBJ_POOL; #endif /* Provider ctx */ +enum p11prov_ctx_status { + P11PROV_UNINITIALIZED = 0, + P11PROV_OPS_NEEDS_INIT, + P11PROV_INITIALIZED, + P11PROV_NEEDS_REINIT, + P11PROV_NO_DEINIT, + P11PROV_IN_ERROR, +}; + P11PROV_INTERFACE *p11prov_ctx_get_interface(P11PROV_CTX *ctx); +P11PROV_MODULE *p11prov_ctx_get_module(P11PROV_CTX *ctx); +void p11prov_ctx_set_status(P11PROV_CTX *ctx, enum p11prov_ctx_status status); CK_UTF8CHAR_PTR p11prov_ctx_pin(P11PROV_CTX *ctx); OSSL_LIB_CTX *p11prov_ctx_get_libctx(P11PROV_CTX *ctx); CK_RV p11prov_ctx_status(P11PROV_CTX *ctx); From f60231f8c69bbc402c7537759951206a17ea9f5b Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Fri, 7 Aug 2026 18:25:43 -0400 Subject: [PATCH 3/7] Add decoders for ML-DSA, ML-KEM, and SLH-DSA Register DER decoders for post-quantum algorithms including ML-DSA, ML-KEM, and SLH-DSA variants. This enables the PKCS#11 provider to properly decode and load these keys. Additionally, add tests for ML-DSA, ML-KEM, and SLH-DSA to `tpem_encoder` to verify their PEM encoding and decoding functionality. --- src/decoder.c | 199 +++++++++++++++++++++++++++++++++++++++++++++ tests/tpem_encoder | 70 ++++++++++++++++ 2 files changed, 269 insertions(+) diff --git a/src/decoder.c b/src/decoder.c index 8a34da5f..cfe5f893 100644 --- a/src/decoder.c +++ b/src/decoder.c @@ -227,6 +227,25 @@ P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_ED448, ed448) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_X25519, x25519) P11PROV_DER_COMMON_DECODE_FN(P11PROV_NAME_X448, x448) +P11PROV_DER_COMMON_DECODE_FN("ML-DSA-44", ml_dsa_44) +P11PROV_DER_COMMON_DECODE_FN("ML-DSA-65", ml_dsa_65) +P11PROV_DER_COMMON_DECODE_FN("ML-DSA-87", ml_dsa_87) +P11PROV_DER_COMMON_DECODE_FN("ML-KEM-512", ml_kem_512) +P11PROV_DER_COMMON_DECODE_FN("ML-KEM-768", ml_kem_768) +P11PROV_DER_COMMON_DECODE_FN("ML-KEM-1024", ml_kem_1024) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-128s", slh_dsa_sha2_128s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-128f", slh_dsa_sha2_128f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-192s", slh_dsa_sha2_192s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-192f", slh_dsa_sha2_192f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-256s", slh_dsa_sha2_256s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHA2-256f", slh_dsa_sha2_256f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-128s", slh_dsa_shake_128s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-128f", slh_dsa_shake_128f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-192s", slh_dsa_shake_192s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-192f", slh_dsa_shake_192f) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-256s", slh_dsa_shake_256s) +P11PROV_DER_COMMON_DECODE_FN("SLH-DSA-SHAKE-256f", slh_dsa_shake_256f) + #define DISPATCH_BASE_DECODER_ELEM(NAME, name) \ { OSSL_FUNC_DECODER_##NAME, (void (*)(void))p11prov_decoder_##name } #define DISPATCH_DECODER_ELEM(NAME, type, structure, format, name) \ @@ -249,6 +268,24 @@ DISPATCH_DECODER_FN_LIST(der, p11prov, ed25519); DISPATCH_DECODER_FN_LIST(der, p11prov, ed448); DISPATCH_DECODER_FN_LIST(der, p11prov, x25519); DISPATCH_DECODER_FN_LIST(der, p11prov, x448); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_dsa_44); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_dsa_65); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_dsa_87); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_kem_512); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_kem_768); +DISPATCH_DECODER_FN_LIST(der, p11prov, ml_kem_1024); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_128s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_128f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_192s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_192f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_256s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_sha2_256f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_128s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_128f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_192s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_192f); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_256s); +DISPATCH_DECODER_FN_LIST(der, p11prov, slh_dsa_shake_256f); enum p11prov_decoder_algorithms { P11PROV_DECODER_DER, @@ -259,6 +296,24 @@ enum p11prov_decoder_algorithms { P11PROV_DECODER_ED448, P11PROV_DECODER_X25519, P11PROV_DECODER_X448, + P11PROV_DECODER_ML_DSA_44, + P11PROV_DECODER_ML_DSA_65, + P11PROV_DECODER_ML_DSA_87, + P11PROV_DECODER_ML_KEM_512, + P11PROV_DECODER_ML_KEM_768, + P11PROV_DECODER_ML_KEM_1024, + P11PROV_DECODER_SLH_DSA_SHA2_128S, + P11PROV_DECODER_SLH_DSA_SHA2_128F, + P11PROV_DECODER_SLH_DSA_SHA2_192S, + P11PROV_DECODER_SLH_DSA_SHA2_192F, + P11PROV_DECODER_SLH_DSA_SHA2_256S, + P11PROV_DECODER_SLH_DSA_SHA2_256F, + P11PROV_DECODER_SLH_DSA_SHAKE_128S, + P11PROV_DECODER_SLH_DSA_SHAKE_128F, + P11PROV_DECODER_SLH_DSA_SHAKE_192S, + P11PROV_DECODER_SLH_DSA_SHAKE_192F, + P11PROV_DECODER_SLH_DSA_SHAKE_256S, + P11PROV_DECODER_SLH_DSA_SHAKE_256F, P11PROV_DECODER_NUM_ALGS }; @@ -322,6 +377,114 @@ const OSSL_ALGORITHM decoder_algorithms[P11PROV_DECODER_NUM_ALGS] = { p11prov_der_decoder_p11prov_x448_functions, "X448 decoder implementation in PKCS11 provider", }, + [P11PROV_DECODER_ML_DSA_44] = { + "ML-DSA-44", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_dsa_44_functions, + "ML-DSA-44 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_DSA_65] = { + "ML-DSA-65", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_dsa_65_functions, + "ML-DSA-65 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_DSA_87] = { + "ML-DSA-87", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_dsa_87_functions, + "ML-DSA-87 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_KEM_512] = { + "ML-KEM-512", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_kem_512_functions, + "ML-KEM-512 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_KEM_768] = { + "ML-KEM-768", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_kem_768_functions, + "ML-KEM-768 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_ML_KEM_1024] = { + "ML-KEM-1024", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_ml_kem_1024_functions, + "ML-KEM-1024 decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_128S] = { + "SLH-DSA-SHA2-128s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_128s_functions, + "SLH-DSA-SHA2-128s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_128F] = { + "SLH-DSA-SHA2-128f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_128f_functions, + "SLH-DSA-SHA2-128f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_192S] = { + "SLH-DSA-SHA2-192s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_192s_functions, + "SLH-DSA-SHA2-192s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_192F] = { + "SLH-DSA-SHA2-192f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_192f_functions, + "SLH-DSA-SHA2-192f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_256S] = { + "SLH-DSA-SHA2-256s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_256s_functions, + "SLH-DSA-SHA2-256s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHA2_256F] = { + "SLH-DSA-SHA2-256f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_sha2_256f_functions, + "SLH-DSA-SHA2-256f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_128S] = { + "SLH-DSA-SHAKE-128s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_128s_functions, + "SLH-DSA-SHAKE-128s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_128F] = { + "SLH-DSA-SHAKE-128f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_128f_functions, + "SLH-DSA-SHAKE-128f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_192S] = { + "SLH-DSA-SHAKE-192s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_192s_functions, + "SLH-DSA-SHAKE-192s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_192F] = { + "SLH-DSA-SHAKE-192f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_192f_functions, + "SLH-DSA-SHAKE-192f decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_256S] = { + "SLH-DSA-SHAKE-256s", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_256s_functions, + "SLH-DSA-SHAKE-256s decoder implementation in PKCS11 provider", + }, + [P11PROV_DECODER_SLH_DSA_SHAKE_256F] = { + "SLH-DSA-SHAKE-256f", + DER_DECODER_PROP, + p11prov_der_decoder_p11prov_slh_dsa_shake_256f_functions, + "SLH-DSA-SHAKE-256f decoder implementation in PKCS11 provider", + }, }; CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property) @@ -358,6 +521,42 @@ CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property) property); p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X448, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_DSA_44, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_DSA_65, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_DSA_87, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_KEM_512, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_KEM_768, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_ML_KEM_1024, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_128S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_128F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_192S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_192F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_256S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHA2_256F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_128S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_128F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_192S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_192F, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_256S, property); + p11prov_assign_alg(&algs[i++], decoder_algorithms, + P11PROV_DECODER_SLH_DSA_SHAKE_256F, property); return p11prov_ctx_add_algs(ctx, OSSL_OP_DECODER, algs); } diff --git a/tests/tpem_encoder b/tests/tpem_encoder index 9491ed62..272fa6fc 100755 --- a/tests/tpem_encoder +++ b/tests/tpem_encoder @@ -7,6 +7,9 @@ source "${TESTSSRCDIR}/helpers.sh" # Forward declaration to avoid shellcheck's SC2153 did you mean ... : "${PRIURI:?}" "${ECPRIURI:?}" "${EDPRIURI:=}" : "${PUBURI:?}" "${ECPUBURI:?}" "${EDPUBURI:=}" +: "${MLDSAPRIURI:=}" "${MLDSAPUBURI:=}" +: "${MLKEMPRIURI:=}" "${MLKEMPUBURI:=}" +: "${SLHDSAPRIURI:=}" "${SLHDSAPUBURI:=}" # We need to configure early loading otherwise no digests are loaded, # and all checks are skipped @@ -142,6 +145,73 @@ else title PARA "Skipping Test PEM Encoding ED support" fi; +# Only run ML-DSA test if setup created ML-DSA key +if [[ -n "${MLDSAPRIURI}" ]]; then + title PARA "Test PEM Encoding ML-DSA support" + + make-uri-pem "${MLDSAPRIURI}" "${TMPPDIR}/mldsapriuri-pkey.pem" + sign-verify "${TMPPDIR}/mldsapriuri-pkey.pem" "${MLDSAPUBURI}" "${TMPPDIR}/64krandom.bin" "no-digest" + + export ALGORITHM=ML-DSA-44 + ossl ' + genpkey -propquery "provider=pkcs11" + -algorithm "${ALGORITHM}" + -pkeyopt "pkcs11_uri:pkcs11:object=Test-PEM-Encode-ML-DSA-${LABEL_SUFFIX_URI}" + -out "${TMPPDIR}/mldsa-pkey-uri.pem"' + + grep -e "-----BEGIN PKCS#11 PROVIDER URI-----" "${TMPPDIR}/mldsa-pkey-uri.pem" + + sign-verify "${TMPPDIR}/mldsa-pkey-uri.pem" \ + "pkcs11:object=Test-PEM-Encode-ML-DSA-${LABEL_SUFFIX_URI}" \ + "${TMPPDIR}/64krandom.bin" "no-digest" +else + title PARA "Skipping Test PEM Encoding ML-DSA support" +fi; + +# Only run ML-KEM test if setup created ML-KEM key +if [[ -n "${MLKEMPRIURI}" ]]; then + title PARA "Test PEM Encoding ML-KEM support" + + make-uri-pem "${MLKEMPRIURI}" "${TMPPDIR}/mlkempriuri-pkey.pem" + ossl 'pkey -in "${TMPPDIR}/mlkempriuri-pkey.pem" -noout' + + export ALGORITHM=ML-KEM-512 + ossl ' + genpkey -propquery "provider=pkcs11" + -algorithm "${ALGORITHM}" + -pkeyopt "pkcs11_uri:pkcs11:object=Test-PEM-Encode-ML-KEM-${LABEL_SUFFIX_URI}" + -out "${TMPPDIR}/mlkem-pkey-uri.pem"' + + grep -e "-----BEGIN PKCS#11 PROVIDER URI-----" "${TMPPDIR}/mlkem-pkey-uri.pem" + + ossl 'pkey -in "${TMPPDIR}/mlkem-pkey-uri.pem" -noout' +else + title PARA "Skipping Test PEM Encoding ML-KEM support" +fi; + +# Only run SLH-DSA test if setup created SLH-DSA key +if [[ -n "${SLHDSAPRIURI}" ]]; then + title PARA "Test PEM Encoding SLH-DSA support" + + make-uri-pem "${SLHDSAPRIURI}" "${TMPPDIR}/slhdsapriuri-pkey.pem" + sign-verify "${TMPPDIR}/slhdsapriuri-pkey.pem" "${SLHDSAPUBURI}" "${TMPPDIR}/64krandom.bin" "no-digest" + + export ALGORITHM=SLH-DSA-SHAKE-128s + ossl ' + genpkey -propquery "provider=pkcs11" + -algorithm "${ALGORITHM}" + -pkeyopt "pkcs11_uri:pkcs11:object=Test-PEM-Encode-SLH-DSA-${LABEL_SUFFIX_URI}" + -out "${TMPPDIR}/slhdsa-pkey-uri.pem"' + + grep -e "-----BEGIN PKCS#11 PROVIDER URI-----" "${TMPPDIR}/slhdsa-pkey-uri.pem" + + sign-verify "${TMPPDIR}/slhdsa-pkey-uri.pem" \ + "pkcs11:object=Test-PEM-Encode-SLH-DSA-${LABEL_SUFFIX_URI}" \ + "${TMPPDIR}/64krandom.bin" "no-digest" +else + title PARA "Skipping Test PEM Encoding SLH-DSA support" +fi; + title PARA "Test visible string has to match" make-uri-pem "${PRIURI}" "${TMPPDIR}/priuri-wrong-version-key.pem" "PKCS#11 Provider URI v2.0" FAIL=0 From 7348d165b5f0d2fb445cf27735623dde4ef32182 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 10 Aug 2026 10:42:21 -0400 Subject: [PATCH 4/7] fixup! Modularize algorithm registration --- src/cipher.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/cipher.c b/src/cipher.c index 357701a4..ccb4360a 100644 --- a/src/cipher.c +++ b/src/cipher.c @@ -855,7 +855,7 @@ static CK_RV tls_aead_get_data(CK_MECHANISM_PTR mech, data_buffer *explicitiv, { /* In TLS 1.2, OpenSSL provides a buffer with this layout: * [explicit IV] [plaintext] [authentication tag] - * + * * In the encryption case, it expects the provider to fill in * the explicit IV and tag, and to overwrite the plaintext with * ciphertext. Explicit IV can be either: From 6ddd952134c80292005e6c0679ff0e0ce69d3ca2 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 10 Aug 2026 11:57:56 -0400 Subject: [PATCH 5/7] fixup! Modularize algorithm registration --- src/decoder.c | 70 +--- src/encoder.c | 342 ++++------------- src/kmgmt/common.c | 56 +-- src/registration.c | 914 +++++++++++++++------------------------------ 4 files changed, 395 insertions(+), 987 deletions(-) diff --git a/src/decoder.c b/src/decoder.c index cfe5f893..962fef93 100644 --- a/src/decoder.c +++ b/src/decoder.c @@ -489,74 +489,24 @@ const OSSL_ALGORITHM decoder_algorithms[P11PROV_DECODER_NUM_ALGS] = { CK_RV p11prov_register_decoders(P11PROV_CTX *ctx, bool fips_property) { - const char *property = NULL; OSSL_ALGORITHM *algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_DECODER_NUM_ALGS + 1)); - int i = 0; if (algs == NULL) { return CKR_HOST_MEMORY; } - if (fips_property) { - property = PEM_DECODER_FIPS; + for (int i = 0; i < P11PROV_DECODER_NUM_ALGS; i++) { + const char *property = NULL; + if (fips_property) { + if (i == P11PROV_DECODER_DER) { + property = PEM_DECODER_FIPS; + } else { + property = DER_DECODER_FIPS; + } + } + p11prov_assign_alg(&algs[i], decoder_algorithms, i, property); } - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_DER, - property); - - if (fips_property) { - property = DER_DECODER_FIPS; - } - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_RSA, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_RSAPSS, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_EC, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_ED25519, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_ED448, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X25519, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, P11PROV_DECODER_X448, - property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_ML_DSA_44, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_ML_DSA_65, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_ML_DSA_87, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_ML_KEM_512, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_ML_KEM_768, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_ML_KEM_1024, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHA2_128S, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHA2_128F, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHA2_192S, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHA2_192F, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHA2_256S, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHA2_256F, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHAKE_128S, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHAKE_128F, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHAKE_192S, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHAKE_192F, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHAKE_256S, property); - p11prov_assign_alg(&algs[i++], decoder_algorithms, - P11PROV_DECODER_SLH_DSA_SHAKE_256F, property); return p11prov_ctx_add_algs(ctx, OSSL_OP_DECODER, algs); } diff --git a/src/encoder.c b/src/encoder.c index 3fa9b2e5..2dafab13 100644 --- a/src/encoder.c +++ b/src/encoder.c @@ -1838,50 +1838,80 @@ enum p11prov_encoder_algorithms { P11PROV_ENCODER_NUM_ALGS }; +struct encoder_algorithms { + OSSL_ALGORITHM a; + const char *fipsprop; + bool is_privk; +}; + #define TEXT_ALGORITHM(name, func) \ - { \ - P11PROV_NAMES_##name, \ - TEXT_PROP, \ - func, \ - P11PROV_DESCS_##name, \ + { .a = \ + { \ + P11PROV_NAMES_##name, \ + TEXT_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + }, \ + .fipsprop = TEXT_FIPS, \ + .is_privk = false, \ } #define DER_PKCS1_ALGORITHM(name, func) \ - { \ - P11PROV_NAMES_##name, \ - DER_PKCS1_PROP, \ - func, \ - P11PROV_DESCS_##name, \ + { .a = \ + { \ + P11PROV_NAMES_##name, \ + DER_PKCS1_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + }, \ + .fipsprop = DER_PKCS1_FIPS, \ + .is_privk = false, \ } #define PEM_PKCS1_ALGORITHM(name, func) \ - { \ - P11PROV_NAMES_##name, \ - PEM_PKCS1_PROP, \ - func, \ - P11PROV_DESCS_##name, \ + { .a = \ + { \ + P11PROV_NAMES_##name, \ + PEM_PKCS1_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + }, \ + .fipsprop = PEM_PKCS1_FIPS, \ + .is_privk = false, \ } #define DER_SPKI_ALGORITHM(name, func) \ - { \ - P11PROV_NAMES_##name, \ - DER_SPKI_PROP, \ - func, \ - P11PROV_DESCS_##name, \ + { .a = \ + { \ + P11PROV_NAMES_##name, \ + DER_SPKI_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + }, \ + .fipsprop = DER_SPKI_FIPS, \ + .is_privk = false, \ } #define PEM_SPKI_ALGORITHM(name, func) \ - { \ - P11PROV_NAMES_##name, \ - PEM_SPKI_PROP, \ - func, \ - P11PROV_DESCS_##name, \ + { .a = \ + { \ + P11PROV_NAMES_##name, \ + PEM_SPKI_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + }, \ + .fipsprop = PEM_SPKI_FIPS, \ + .is_privk = false, \ } #define PEM_PRIVK_ALGORITHM(name, func) \ - { \ - P11PROV_NAMES_##name, \ - PEM_PRIVK_PROP, \ - func, \ - P11PROV_DESCS_##name, \ - } - -const OSSL_ALGORITHM encoder_algorithms[P11PROV_ENCODER_NUM_ALGS] = { + { .a = \ + { \ + P11PROV_NAMES_##name, \ + PEM_PRIVK_PROP, \ + func, \ + P11PROV_DESCS_##name, \ + }, \ + .fipsprop = PEM_PRIVK_FIPS, \ + .is_privk = true, \ + } + +const struct encoder_algorithms encoder_algorithms[P11PROV_ENCODER_NUM_ALGS] = { [P11PROV_ENCODER_RSA_TEXT] = TEXT_ALGORITHM(RSA, p11prov_rsa_encoder_text_functions), [P11PROV_ENCODER_RSA_DER_PKCS1] = @@ -2077,243 +2107,15 @@ CK_RV p11prov_register_encoders(P11PROV_CTX *ctx, bool fips_property, return CKR_HOST_MEMORY; } - p11prov_assign_alg(&algs[i++], encoder_algorithms, P11PROV_ENCODER_RSA_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSA_DER_PKCS1, - fips_property ? DER_PKCS1_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSA_PEM_PKCS1, - fips_property ? PEM_PKCS1_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSA_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSA_PEM_SPKI, - fips_property ? PEM_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSAPSS_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSAPSS_DER_PKCS1, - fips_property ? DER_PKCS1_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSAPSS_PEM_PKCS1, - fips_property ? PEM_PKCS1_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSAPSS_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSAPSS_PEM_SPKI, - fips_property ? PEM_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, P11PROV_ENCODER_EC_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_EC_DER_PKCS1, - fips_property ? DER_PKCS1_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_EC_PEM_PKCS1, - fips_property ? PEM_PKCS1_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_EC_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ED25519_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ED448_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_X25519_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_X448_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_44_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_44_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_65_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_65_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_87_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_87_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_512_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_512_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_768_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_768_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_1024_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_1024_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_128S_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_128S_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_128F_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_128F_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_192S_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_192S_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_192F_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_192F_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_256S_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_256S_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_256F_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_256F_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_128S_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_128S_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_128F_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_128F_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_192S_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_192S_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_192F_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_192F_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_256S_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_256S_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_256F_TEXT, - fips_property ? TEXT_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_256F_DER_SPKI, - fips_property ? DER_SPKI_FIPS : NULL); - - if (encode_pkey_as_pk11_uri) { - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSA_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_RSAPSS_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_EC_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ED25519_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ED448_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_X25519_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_X448_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_44_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_65_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_DSA_87_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_512_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_768_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_ML_KEM_1024_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_128S_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_128F_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_192S_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_192F_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_256S_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHA2_256F_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_128S_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_128F_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_192S_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_192F_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_256S_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); - p11prov_assign_alg(&algs[i++], encoder_algorithms, - P11PROV_ENCODER_SLH_DSA_SHAKE_256F_PEM_PRIVK, - fips_property ? PEM_PRIVK_FIPS : NULL); + for (int e = 0; e < P11PROV_ENCODER_NUM_ALGS; e++) { + if (!encode_pkey_as_pk11_uri && encoder_algorithms[e].is_privk) { + continue; + } + algs[i] = encoder_algorithms[e].a; + if (fips_property) { + algs[i].property_definition = encoder_algorithms[e].fipsprop; + } + i++; } return p11prov_ctx_add_algs(ctx, OSSL_OP_ENCODER, algs); diff --git a/src/kmgmt/common.c b/src/kmgmt/common.c index b94444ef..af434eb8 100644 --- a/src/kmgmt/common.c +++ b/src/kmgmt/common.c @@ -593,7 +593,6 @@ CK_RV p11prov_register_kmgmt(P11PROV_CTX *ctx, bool fips_property) const char *property = NULL; OSSL_ALGORITHM *algs = OPENSSL_zalloc(sizeof(OSSL_ALGORITHM) * (P11PROV_KMGMT_NUM_ALGS + 1)); - int i = 0; if (algs == NULL) { return CKR_HOST_MEMORY; @@ -603,58 +602,9 @@ CK_RV p11prov_register_kmgmt(P11PROV_CTX *ctx, bool fips_property) property = P11PROV_FIPS_PROPERTIES; } - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_RSA, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_RSAPSS, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_EC, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_HKDF, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ED25519, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ED448, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_X25519, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_X448, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_44, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_65, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_MLDSA_87, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_512, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_768, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, P11PROV_KMGMT_ML_KEM_1024, - property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHA2_128S, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHA2_128F, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHA2_192S, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHA2_192F, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHA2_256S, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHA2_256F, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHAKE_128S, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHAKE_128F, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHAKE_192S, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHAKE_192F, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHAKE_256S, property); - p11prov_assign_alg(&algs[i++], kmgmt_algorithms, - P11PROV_KMGMT_SLHDSA_SHAKE_256F, property); + for (int i = 0; i < P11PROV_KMGMT_NUM_ALGS; i++) { + p11prov_assign_alg(&algs[i], kmgmt_algorithms, i, property); + } return p11prov_ctx_add_algs(ctx, OSSL_OP_KEYMGMT, algs); } diff --git a/src/registration.c b/src/registration.c index 5b99b4a2..2faa4a7e 100644 --- a/src/registration.c +++ b/src/registration.c @@ -3,311 +3,168 @@ #include "provider.h" +#define CASE_TBID_TO_CKM(name) \ + case TBID_##name: \ + return CKM_##name + +#define CASE_CKM_TO_TBID(name) \ + case CKM_##name: \ + return TBID_##name + CK_MECHANISM_TYPE p11prov_tbid_to_mech(enum p11prov_mech_tbid tbid) { switch (tbid) { - case TBID_RSA_PKCS_KEY_PAIR_GEN: - return CKM_RSA_PKCS_KEY_PAIR_GEN; - case TBID_RSA_PKCS: - return CKM_RSA_PKCS; - case TBID_SHA1_RSA_PKCS: - return CKM_SHA1_RSA_PKCS; - case TBID_SHA224_RSA_PKCS: - return CKM_SHA224_RSA_PKCS; - case TBID_SHA256_RSA_PKCS: - return CKM_SHA256_RSA_PKCS; - case TBID_SHA384_RSA_PKCS: - return CKM_SHA384_RSA_PKCS; - case TBID_SHA512_RSA_PKCS: - return CKM_SHA512_RSA_PKCS; - case TBID_SHA3_224_RSA_PKCS: - return CKM_SHA3_224_RSA_PKCS; - case TBID_SHA3_256_RSA_PKCS: - return CKM_SHA3_256_RSA_PKCS; - case TBID_SHA3_384_RSA_PKCS: - return CKM_SHA3_384_RSA_PKCS; - case TBID_SHA3_512_RSA_PKCS: - return CKM_SHA3_512_RSA_PKCS; - case TBID_RSA_PKCS_PSS: - return CKM_RSA_PKCS_PSS; - case TBID_SHA1_RSA_PKCS_PSS: - return CKM_SHA1_RSA_PKCS_PSS; - case TBID_SHA256_RSA_PKCS_PSS: - return CKM_SHA256_RSA_PKCS_PSS; - case TBID_SHA384_RSA_PKCS_PSS: - return CKM_SHA384_RSA_PKCS_PSS; - case TBID_SHA512_RSA_PKCS_PSS: - return CKM_SHA512_RSA_PKCS_PSS; - case TBID_SHA224_RSA_PKCS_PSS: - return CKM_SHA224_RSA_PKCS_PSS; - case TBID_SHA3_256_RSA_PKCS_PSS: - return CKM_SHA3_256_RSA_PKCS_PSS; - case TBID_SHA3_384_RSA_PKCS_PSS: - return CKM_SHA3_384_RSA_PKCS_PSS; - case TBID_SHA3_512_RSA_PKCS_PSS: - return CKM_SHA3_512_RSA_PKCS_PSS; - case TBID_SHA3_224_RSA_PKCS_PSS: - return CKM_SHA3_224_RSA_PKCS_PSS; - case TBID_RSA_PKCS_OAEP: - return CKM_RSA_PKCS_OAEP; - case TBID_RSA_X_509: - return CKM_RSA_X_509; - case TBID_RSA_X9_31: - return CKM_RSA_X9_31; - case TBID_RSA_X9_31_KEY_PAIR_GEN: - return CKM_RSA_X9_31_KEY_PAIR_GEN; - case TBID_EC_KEY_PAIR_GEN: - return CKM_EC_KEY_PAIR_GEN; - case TBID_ECDSA: - return CKM_ECDSA; - case TBID_ECDSA_SHA1: - return CKM_ECDSA_SHA1; - case TBID_ECDSA_SHA224: - return CKM_ECDSA_SHA224; - case TBID_ECDSA_SHA256: - return CKM_ECDSA_SHA256; - case TBID_ECDSA_SHA384: - return CKM_ECDSA_SHA384; - case TBID_ECDSA_SHA512: - return CKM_ECDSA_SHA512; - case TBID_ECDSA_SHA3_224: - return CKM_ECDSA_SHA3_224; - case TBID_ECDSA_SHA3_256: - return CKM_ECDSA_SHA3_256; - case TBID_ECDSA_SHA3_384: - return CKM_ECDSA_SHA3_384; - case TBID_ECDSA_SHA3_512: - return CKM_ECDSA_SHA3_512; - case TBID_ECDH1_DERIVE: - return CKM_ECDH1_DERIVE; - case TBID_ECDH1_COFACTOR_DERIVE: - return CKM_ECDH1_COFACTOR_DERIVE; - case TBID_EC_EDWARDS_KEY_PAIR_GEN: - return CKM_EC_EDWARDS_KEY_PAIR_GEN; - case TBID_EC_MONTGOMERY_KEY_PAIR_GEN: - return CKM_EC_MONTGOMERY_KEY_PAIR_GEN; - case TBID_EDDSA: - return CKM_EDDSA; - case TBID_HKDF_DERIVE: - return CKM_HKDF_DERIVE; - case TBID_SHA_1: - return CKM_SHA_1; - case TBID_SHA_1_HMAC: - return CKM_SHA_1_HMAC; - case TBID_SHA_1_HMAC_GENERAL: - return CKM_SHA_1_HMAC_GENERAL; - case TBID_SHA1_KEY_DERIVATION: - return CKM_SHA1_KEY_DERIVATION; - case TBID_SHA_1_KEY_GEN: - return CKM_SHA_1_KEY_GEN; - case TBID_SHA224: - return CKM_SHA224; - case TBID_SHA224_HMAC: - return CKM_SHA224_HMAC; - case TBID_SHA224_HMAC_GENERAL: - return CKM_SHA224_HMAC_GENERAL; - case TBID_SHA224_KEY_DERIVATION: - return CKM_SHA224_KEY_DERIVATION; - case TBID_SHA224_KEY_GEN: - return CKM_SHA224_KEY_GEN; - case TBID_SHA256: - return CKM_SHA256; - case TBID_SHA256_HMAC: - return CKM_SHA256_HMAC; - case TBID_SHA256_HMAC_GENERAL: - return CKM_SHA256_HMAC_GENERAL; - case TBID_SHA256_KEY_DERIVATION: - return CKM_SHA256_KEY_DERIVATION; - case TBID_SHA256_KEY_GEN: - return CKM_SHA256_KEY_GEN; - case TBID_SHA384: - return CKM_SHA384; - case TBID_SHA384_HMAC: - return CKM_SHA384_HMAC; - case TBID_SHA384_HMAC_GENERAL: - return CKM_SHA384_HMAC_GENERAL; - case TBID_SHA384_KEY_DERIVATION: - return CKM_SHA384_KEY_DERIVATION; - case TBID_SHA384_KEY_GEN: - return CKM_SHA384_KEY_GEN; - case TBID_SHA512: - return CKM_SHA512; - case TBID_SHA512_HMAC: - return CKM_SHA512_HMAC; - case TBID_SHA512_HMAC_GENERAL: - return CKM_SHA512_HMAC_GENERAL; - case TBID_SHA512_KEY_DERIVATION: - return CKM_SHA512_KEY_DERIVATION; - case TBID_SHA512_KEY_GEN: - return CKM_SHA512_KEY_GEN; - case TBID_SHA512_224: - return CKM_SHA512_224; - case TBID_SHA512_224_HMAC: - return CKM_SHA512_224_HMAC; - case TBID_SHA512_224_HMAC_GENERAL: - return CKM_SHA512_224_HMAC_GENERAL; - case TBID_SHA512_224_KEY_DERIVATION: - return CKM_SHA512_224_KEY_DERIVATION; - case TBID_SHA512_224_KEY_GEN: - return CKM_SHA512_224_KEY_GEN; - case TBID_SHA512_256: - return CKM_SHA512_256; - case TBID_SHA512_256_HMAC: - return CKM_SHA512_256_HMAC; - case TBID_SHA512_256_HMAC_GENERAL: - return CKM_SHA512_256_HMAC_GENERAL; - case TBID_SHA512_256_KEY_DERIVATION: - return CKM_SHA512_256_KEY_DERIVATION; - case TBID_SHA512_256_KEY_GEN: - return CKM_SHA512_256_KEY_GEN; - case TBID_SHA512_T: - return CKM_SHA512_T; - case TBID_SHA512_T_HMAC: - return CKM_SHA512_T_HMAC; - case TBID_SHA512_T_HMAC_GENERAL: - return CKM_SHA512_T_HMAC_GENERAL; - case TBID_SHA512_T_KEY_DERIVATION: - return CKM_SHA512_T_KEY_DERIVATION; - case TBID_SHA512_T_KEY_GEN: - return CKM_SHA512_T_KEY_GEN; - case TBID_SHA3_224: - return CKM_SHA3_224; - case TBID_SHA3_224_HMAC: - return CKM_SHA3_224_HMAC; - case TBID_SHA3_224_HMAC_GENERAL: - return CKM_SHA3_224_HMAC_GENERAL; - case TBID_SHA3_224_KEY_DERIVATION: - return CKM_SHA3_224_KEY_DERIVATION; - case TBID_SHA3_224_KEY_GEN: - return CKM_SHA3_224_KEY_GEN; - case TBID_SHA3_256: - return CKM_SHA3_256; - case TBID_SHA3_256_HMAC: - return CKM_SHA3_256_HMAC; - case TBID_SHA3_256_HMAC_GENERAL: - return CKM_SHA3_256_HMAC_GENERAL; - case TBID_SHA3_256_KEY_DERIVATION: - return CKM_SHA3_256_KEY_DERIVATION; - case TBID_SHA3_256_KEY_GEN: - return CKM_SHA3_256_KEY_GEN; - case TBID_SHA3_384: - return CKM_SHA3_384; - case TBID_SHA3_384_HMAC: - return CKM_SHA3_384_HMAC; - case TBID_SHA3_384_HMAC_GENERAL: - return CKM_SHA3_384_HMAC_GENERAL; - case TBID_SHA3_384_KEY_DERIVATION: - return CKM_SHA3_384_KEY_DERIVATION; - case TBID_SHA3_384_KEY_GEN: - return CKM_SHA3_384_KEY_GEN; - case TBID_SHA3_512: - return CKM_SHA3_512; - case TBID_SHA3_512_HMAC: - return CKM_SHA3_512_HMAC; - case TBID_SHA3_512_HMAC_GENERAL: - return CKM_SHA3_512_HMAC_GENERAL; - case TBID_SHA3_512_KEY_DERIVATION: - return CKM_SHA3_512_KEY_DERIVATION; - case TBID_SHA3_512_KEY_GEN: - return CKM_SHA3_512_KEY_GEN; - case TBID_ML_DSA_KEY_PAIR_GEN: - return CKM_ML_DSA_KEY_PAIR_GEN; - case TBID_ML_DSA: - return CKM_ML_DSA; - case TBID_HASH_ML_DSA: - return CKM_HASH_ML_DSA; - case TBID_HASH_ML_DSA_SHA224: - return CKM_HASH_ML_DSA_SHA224; - case TBID_HASH_ML_DSA_SHA256: - return CKM_HASH_ML_DSA_SHA256; - case TBID_HASH_ML_DSA_SHA384: - return CKM_HASH_ML_DSA_SHA384; - case TBID_HASH_ML_DSA_SHA512: - return CKM_HASH_ML_DSA_SHA512; - case TBID_HASH_ML_DSA_SHA3_224: - return CKM_HASH_ML_DSA_SHA3_224; - case TBID_HASH_ML_DSA_SHA3_256: - return CKM_HASH_ML_DSA_SHA3_256; - case TBID_HASH_ML_DSA_SHA3_384: - return CKM_HASH_ML_DSA_SHA3_384; - case TBID_HASH_ML_DSA_SHA3_512: - return CKM_HASH_ML_DSA_SHA3_512; - case TBID_HASH_ML_DSA_SHAKE128: - return CKM_HASH_ML_DSA_SHAKE128; - case TBID_HASH_ML_DSA_SHAKE256: - return CKM_HASH_ML_DSA_SHAKE256; - case TBID_ML_KEM_KEY_PAIR_GEN: - return CKM_ML_KEM_KEY_PAIR_GEN; - case TBID_ML_KEM: - return CKM_ML_KEM; - case TBID_SLH_DSA_KEY_PAIR_GEN: - return CKM_SLH_DSA_KEY_PAIR_GEN; - case TBID_SLH_DSA: - return CKM_SLH_DSA; - case TBID_HASH_SLH_DSA: - return CKM_HASH_SLH_DSA; - case TBID_HASH_SLH_DSA_SHA224: - return CKM_HASH_SLH_DSA_SHA224; - case TBID_HASH_SLH_DSA_SHA256: - return CKM_HASH_SLH_DSA_SHA256; - case TBID_HASH_SLH_DSA_SHA384: - return CKM_HASH_SLH_DSA_SHA384; - case TBID_HASH_SLH_DSA_SHA512: - return CKM_HASH_SLH_DSA_SHA512; - case TBID_HASH_SLH_DSA_SHA3_224: - return CKM_HASH_SLH_DSA_SHA3_224; - case TBID_HASH_SLH_DSA_SHA3_256: - return CKM_HASH_SLH_DSA_SHA3_256; - case TBID_HASH_SLH_DSA_SHA3_384: - return CKM_HASH_SLH_DSA_SHA3_384; - case TBID_HASH_SLH_DSA_SHA3_512: - return CKM_HASH_SLH_DSA_SHA3_512; - case TBID_HASH_SLH_DSA_SHAKE128: - return CKM_HASH_SLH_DSA_SHAKE128; - case TBID_HASH_SLH_DSA_SHAKE256: - return CKM_HASH_SLH_DSA_SHAKE256; - case TBID_AES_KEY_GEN: - return CKM_AES_KEY_GEN; - case TBID_AES_ECB: - return CKM_AES_ECB; - case TBID_AES_CBC: - return CKM_AES_CBC; - case TBID_AES_CBC_PAD: - return CKM_AES_CBC_PAD; - case TBID_AES_OFB: - return CKM_AES_OFB; - case TBID_AES_CFB128: - return CKM_AES_CFB128; - case TBID_AES_CFB1: - return CKM_AES_CFB1; - case TBID_AES_CFB8: - return CKM_AES_CFB8; - case TBID_AES_CTR: - return CKM_AES_CTR; - case TBID_AES_CTS: - return CKM_AES_CTS; - case TBID_AES_GCM: - return CKM_AES_GCM; - case TBID_AES_MAC: - return CKM_AES_MAC; - case TBID_AES_MAC_GENERAL: - return CKM_AES_MAC_GENERAL; - case TBID_AES_CCM: - return CKM_AES_CCM; - case TBID_AES_CMAC: - return CKM_AES_CMAC; - case TBID_AES_CMAC_GENERAL: - return CKM_AES_CMAC_GENERAL; - case TBID_AES_XCBC_MAC: - return CKM_AES_XCBC_MAC; - case TBID_AES_XCBC_MAC_96: - return CKM_AES_XCBC_MAC_96; - case TBID_AES_GMAC: - return CKM_AES_GMAC; - case TBID_CHACHA20_POLY1305: - return CKM_CHACHA20_POLY1305; - case TBID_GENERIC_SECRET_KEY_GEN: - return CKM_GENERIC_SECRET_KEY_GEN; + CASE_TBID_TO_CKM(RSA_PKCS_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(RSA_PKCS); + CASE_TBID_TO_CKM(SHA1_RSA_PKCS); + CASE_TBID_TO_CKM(SHA224_RSA_PKCS); + CASE_TBID_TO_CKM(SHA256_RSA_PKCS); + CASE_TBID_TO_CKM(SHA384_RSA_PKCS); + CASE_TBID_TO_CKM(SHA512_RSA_PKCS); + CASE_TBID_TO_CKM(SHA3_224_RSA_PKCS); + CASE_TBID_TO_CKM(SHA3_256_RSA_PKCS); + CASE_TBID_TO_CKM(SHA3_384_RSA_PKCS); + CASE_TBID_TO_CKM(SHA3_512_RSA_PKCS); + CASE_TBID_TO_CKM(RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA1_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA256_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA384_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA512_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA224_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA3_256_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA3_384_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA3_512_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(SHA3_224_RSA_PKCS_PSS); + CASE_TBID_TO_CKM(RSA_PKCS_OAEP); + CASE_TBID_TO_CKM(RSA_X_509); + CASE_TBID_TO_CKM(RSA_X9_31); + CASE_TBID_TO_CKM(RSA_X9_31_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(EC_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(ECDSA); + CASE_TBID_TO_CKM(ECDSA_SHA1); + CASE_TBID_TO_CKM(ECDSA_SHA224); + CASE_TBID_TO_CKM(ECDSA_SHA256); + CASE_TBID_TO_CKM(ECDSA_SHA384); + CASE_TBID_TO_CKM(ECDSA_SHA512); + CASE_TBID_TO_CKM(ECDSA_SHA3_224); + CASE_TBID_TO_CKM(ECDSA_SHA3_256); + CASE_TBID_TO_CKM(ECDSA_SHA3_384); + CASE_TBID_TO_CKM(ECDSA_SHA3_512); + CASE_TBID_TO_CKM(ECDH1_DERIVE); + CASE_TBID_TO_CKM(ECDH1_COFACTOR_DERIVE); + CASE_TBID_TO_CKM(EC_EDWARDS_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(EC_MONTGOMERY_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(EDDSA); + CASE_TBID_TO_CKM(HKDF_DERIVE); + CASE_TBID_TO_CKM(SHA_1); + CASE_TBID_TO_CKM(SHA_1_HMAC); + CASE_TBID_TO_CKM(SHA_1_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA1_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA_1_KEY_GEN); + CASE_TBID_TO_CKM(SHA224); + CASE_TBID_TO_CKM(SHA224_HMAC); + CASE_TBID_TO_CKM(SHA224_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA224_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA224_KEY_GEN); + CASE_TBID_TO_CKM(SHA256); + CASE_TBID_TO_CKM(SHA256_HMAC); + CASE_TBID_TO_CKM(SHA256_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA256_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA256_KEY_GEN); + CASE_TBID_TO_CKM(SHA384); + CASE_TBID_TO_CKM(SHA384_HMAC); + CASE_TBID_TO_CKM(SHA384_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA384_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA384_KEY_GEN); + CASE_TBID_TO_CKM(SHA512); + CASE_TBID_TO_CKM(SHA512_HMAC); + CASE_TBID_TO_CKM(SHA512_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA512_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA512_KEY_GEN); + CASE_TBID_TO_CKM(SHA512_224); + CASE_TBID_TO_CKM(SHA512_224_HMAC); + CASE_TBID_TO_CKM(SHA512_224_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA512_224_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA512_224_KEY_GEN); + CASE_TBID_TO_CKM(SHA512_256); + CASE_TBID_TO_CKM(SHA512_256_HMAC); + CASE_TBID_TO_CKM(SHA512_256_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA512_256_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA512_256_KEY_GEN); + CASE_TBID_TO_CKM(SHA512_T); + CASE_TBID_TO_CKM(SHA512_T_HMAC); + CASE_TBID_TO_CKM(SHA512_T_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA512_T_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA512_T_KEY_GEN); + CASE_TBID_TO_CKM(SHA3_224); + CASE_TBID_TO_CKM(SHA3_224_HMAC); + CASE_TBID_TO_CKM(SHA3_224_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA3_224_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA3_224_KEY_GEN); + CASE_TBID_TO_CKM(SHA3_256); + CASE_TBID_TO_CKM(SHA3_256_HMAC); + CASE_TBID_TO_CKM(SHA3_256_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA3_256_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA3_256_KEY_GEN); + CASE_TBID_TO_CKM(SHA3_384); + CASE_TBID_TO_CKM(SHA3_384_HMAC); + CASE_TBID_TO_CKM(SHA3_384_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA3_384_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA3_384_KEY_GEN); + CASE_TBID_TO_CKM(SHA3_512); + CASE_TBID_TO_CKM(SHA3_512_HMAC); + CASE_TBID_TO_CKM(SHA3_512_HMAC_GENERAL); + CASE_TBID_TO_CKM(SHA3_512_KEY_DERIVATION); + CASE_TBID_TO_CKM(SHA3_512_KEY_GEN); + CASE_TBID_TO_CKM(ML_DSA_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(ML_DSA); + CASE_TBID_TO_CKM(HASH_ML_DSA); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA224); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA256); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA384); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA512); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA3_224); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA3_256); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA3_384); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHA3_512); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHAKE128); + CASE_TBID_TO_CKM(HASH_ML_DSA_SHAKE256); + CASE_TBID_TO_CKM(ML_KEM_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(ML_KEM); + CASE_TBID_TO_CKM(SLH_DSA_KEY_PAIR_GEN); + CASE_TBID_TO_CKM(SLH_DSA); + CASE_TBID_TO_CKM(HASH_SLH_DSA); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA224); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA256); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA384); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA512); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA3_224); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA3_256); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA3_384); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHA3_512); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHAKE128); + CASE_TBID_TO_CKM(HASH_SLH_DSA_SHAKE256); + CASE_TBID_TO_CKM(AES_KEY_GEN); + CASE_TBID_TO_CKM(AES_ECB); + CASE_TBID_TO_CKM(AES_CBC); + CASE_TBID_TO_CKM(AES_CBC_PAD); + CASE_TBID_TO_CKM(AES_OFB); + CASE_TBID_TO_CKM(AES_CFB128); + CASE_TBID_TO_CKM(AES_CFB1); + CASE_TBID_TO_CKM(AES_CFB8); + CASE_TBID_TO_CKM(AES_CTR); + CASE_TBID_TO_CKM(AES_CTS); + CASE_TBID_TO_CKM(AES_GCM); + CASE_TBID_TO_CKM(AES_MAC); + CASE_TBID_TO_CKM(AES_MAC_GENERAL); + CASE_TBID_TO_CKM(AES_CCM); + CASE_TBID_TO_CKM(AES_CMAC); + CASE_TBID_TO_CKM(AES_CMAC_GENERAL); + CASE_TBID_TO_CKM(AES_XCBC_MAC); + CASE_TBID_TO_CKM(AES_XCBC_MAC_96); + CASE_TBID_TO_CKM(AES_GMAC); + CASE_TBID_TO_CKM(CHACHA20_POLY1305); + CASE_TBID_TO_CKM(GENERIC_SECRET_KEY_GEN); default: return CK_UNAVAILABLE_INFORMATION; } @@ -316,308 +173,157 @@ CK_MECHANISM_TYPE p11prov_tbid_to_mech(enum p11prov_mech_tbid tbid) int p11prov_mech_to_tbid(CK_MECHANISM_TYPE mech) { switch (mech) { - case CKM_RSA_PKCS_KEY_PAIR_GEN: - return TBID_RSA_PKCS_KEY_PAIR_GEN; - case CKM_RSA_PKCS: - return TBID_RSA_PKCS; - case CKM_SHA1_RSA_PKCS: - return TBID_SHA1_RSA_PKCS; - case CKM_SHA224_RSA_PKCS: - return TBID_SHA224_RSA_PKCS; - case CKM_SHA256_RSA_PKCS: - return TBID_SHA256_RSA_PKCS; - case CKM_SHA384_RSA_PKCS: - return TBID_SHA384_RSA_PKCS; - case CKM_SHA512_RSA_PKCS: - return TBID_SHA512_RSA_PKCS; - case CKM_SHA3_224_RSA_PKCS: - return TBID_SHA3_224_RSA_PKCS; - case CKM_SHA3_256_RSA_PKCS: - return TBID_SHA3_256_RSA_PKCS; - case CKM_SHA3_384_RSA_PKCS: - return TBID_SHA3_384_RSA_PKCS; - case CKM_SHA3_512_RSA_PKCS: - return TBID_SHA3_512_RSA_PKCS; - case CKM_RSA_PKCS_PSS: - return TBID_RSA_PKCS_PSS; - case CKM_SHA1_RSA_PKCS_PSS: - return TBID_SHA1_RSA_PKCS_PSS; - case CKM_SHA256_RSA_PKCS_PSS: - return TBID_SHA256_RSA_PKCS_PSS; - case CKM_SHA384_RSA_PKCS_PSS: - return TBID_SHA384_RSA_PKCS_PSS; - case CKM_SHA512_RSA_PKCS_PSS: - return TBID_SHA512_RSA_PKCS_PSS; - case CKM_SHA224_RSA_PKCS_PSS: - return TBID_SHA224_RSA_PKCS_PSS; - case CKM_SHA3_256_RSA_PKCS_PSS: - return TBID_SHA3_256_RSA_PKCS_PSS; - case CKM_SHA3_384_RSA_PKCS_PSS: - return TBID_SHA3_384_RSA_PKCS_PSS; - case CKM_SHA3_512_RSA_PKCS_PSS: - return TBID_SHA3_512_RSA_PKCS_PSS; - case CKM_SHA3_224_RSA_PKCS_PSS: - return TBID_SHA3_224_RSA_PKCS_PSS; - case CKM_RSA_PKCS_OAEP: - return TBID_RSA_PKCS_OAEP; - case CKM_RSA_X_509: - return TBID_RSA_X_509; - case CKM_RSA_X9_31: - return TBID_RSA_X9_31; - case CKM_RSA_X9_31_KEY_PAIR_GEN: - return TBID_RSA_X9_31_KEY_PAIR_GEN; - case CKM_EC_KEY_PAIR_GEN: - return TBID_EC_KEY_PAIR_GEN; - case CKM_ECDSA: - return TBID_ECDSA; - case CKM_ECDSA_SHA1: - return TBID_ECDSA_SHA1; - case CKM_ECDSA_SHA224: - return TBID_ECDSA_SHA224; - case CKM_ECDSA_SHA256: - return TBID_ECDSA_SHA256; - case CKM_ECDSA_SHA384: - return TBID_ECDSA_SHA384; - case CKM_ECDSA_SHA512: - return TBID_ECDSA_SHA512; - case CKM_ECDSA_SHA3_224: - return TBID_ECDSA_SHA3_224; - case CKM_ECDSA_SHA3_256: - return TBID_ECDSA_SHA3_256; - case CKM_ECDSA_SHA3_384: - return TBID_ECDSA_SHA3_384; - case CKM_ECDSA_SHA3_512: - return TBID_ECDSA_SHA3_512; - case CKM_ECDH1_DERIVE: - return TBID_ECDH1_DERIVE; - case CKM_ECDH1_COFACTOR_DERIVE: - return TBID_ECDH1_COFACTOR_DERIVE; - case CKM_EC_EDWARDS_KEY_PAIR_GEN: - return TBID_EC_EDWARDS_KEY_PAIR_GEN; - case CKM_EC_MONTGOMERY_KEY_PAIR_GEN: - return TBID_EC_MONTGOMERY_KEY_PAIR_GEN; - case CKM_EDDSA: - return TBID_EDDSA; - case CKM_HKDF_DERIVE: - return TBID_HKDF_DERIVE; - case CKM_SHA_1: - return TBID_SHA_1; - case CKM_SHA_1_HMAC: - return TBID_SHA_1_HMAC; - case CKM_SHA_1_HMAC_GENERAL: - return TBID_SHA_1_HMAC_GENERAL; - case CKM_SHA1_KEY_DERIVATION: - return TBID_SHA1_KEY_DERIVATION; - case CKM_SHA_1_KEY_GEN: - return TBID_SHA_1_KEY_GEN; - case CKM_SHA224: - return TBID_SHA224; - case CKM_SHA224_HMAC: - return TBID_SHA224_HMAC; - case CKM_SHA224_HMAC_GENERAL: - return TBID_SHA224_HMAC_GENERAL; - case CKM_SHA224_KEY_DERIVATION: - return TBID_SHA224_KEY_DERIVATION; - case CKM_SHA224_KEY_GEN: - return TBID_SHA224_KEY_GEN; - case CKM_SHA256: - return TBID_SHA256; - case CKM_SHA256_HMAC: - return TBID_SHA256_HMAC; - case CKM_SHA256_HMAC_GENERAL: - return TBID_SHA256_HMAC_GENERAL; - case CKM_SHA256_KEY_DERIVATION: - return TBID_SHA256_KEY_DERIVATION; - case CKM_SHA256_KEY_GEN: - return TBID_SHA256_KEY_GEN; - case CKM_SHA384: - return TBID_SHA384; - case CKM_SHA384_HMAC: - return TBID_SHA384_HMAC; - case CKM_SHA384_HMAC_GENERAL: - return TBID_SHA384_HMAC_GENERAL; - case CKM_SHA384_KEY_DERIVATION: - return TBID_SHA384_KEY_DERIVATION; - case CKM_SHA384_KEY_GEN: - return TBID_SHA384_KEY_GEN; - case CKM_SHA512: - return TBID_SHA512; - case CKM_SHA512_HMAC: - return TBID_SHA512_HMAC; - case CKM_SHA512_HMAC_GENERAL: - return TBID_SHA512_HMAC_GENERAL; - case CKM_SHA512_KEY_DERIVATION: - return TBID_SHA512_KEY_DERIVATION; - case CKM_SHA512_KEY_GEN: - return TBID_SHA512_KEY_GEN; - case CKM_SHA512_224: - return TBID_SHA512_224; - case CKM_SHA512_224_HMAC: - return TBID_SHA512_224_HMAC; - case CKM_SHA512_224_HMAC_GENERAL: - return TBID_SHA512_224_HMAC_GENERAL; - case CKM_SHA512_224_KEY_DERIVATION: - return TBID_SHA512_224_KEY_DERIVATION; - case CKM_SHA512_224_KEY_GEN: - return TBID_SHA512_224_KEY_GEN; - case CKM_SHA512_256: - return TBID_SHA512_256; - case CKM_SHA512_256_HMAC: - return TBID_SHA512_256_HMAC; - case CKM_SHA512_256_HMAC_GENERAL: - return TBID_SHA512_256_HMAC_GENERAL; - case CKM_SHA512_256_KEY_DERIVATION: - return TBID_SHA512_256_KEY_DERIVATION; - case CKM_SHA512_256_KEY_GEN: - return TBID_SHA512_256_KEY_GEN; - case CKM_SHA512_T: - return TBID_SHA512_T; - case CKM_SHA512_T_HMAC: - return TBID_SHA512_T_HMAC; - case CKM_SHA512_T_HMAC_GENERAL: - return TBID_SHA512_T_HMAC_GENERAL; - case CKM_SHA512_T_KEY_DERIVATION: - return TBID_SHA512_T_KEY_DERIVATION; - case CKM_SHA512_T_KEY_GEN: - return TBID_SHA512_T_KEY_GEN; - case CKM_SHA3_224: - return TBID_SHA3_224; - case CKM_SHA3_224_HMAC: - return TBID_SHA3_224_HMAC; - case CKM_SHA3_224_HMAC_GENERAL: - return TBID_SHA3_224_HMAC_GENERAL; - case CKM_SHA3_224_KEY_DERIVATION: - return TBID_SHA3_224_KEY_DERIVATION; - case CKM_SHA3_224_KEY_GEN: - return TBID_SHA3_224_KEY_GEN; - case CKM_SHA3_256: - return TBID_SHA3_256; - case CKM_SHA3_256_HMAC: - return TBID_SHA3_256_HMAC; - case CKM_SHA3_256_HMAC_GENERAL: - return TBID_SHA3_256_HMAC_GENERAL; - case CKM_SHA3_256_KEY_DERIVATION: - return TBID_SHA3_256_KEY_DERIVATION; - case CKM_SHA3_256_KEY_GEN: - return TBID_SHA3_256_KEY_GEN; - case CKM_SHA3_384: - return TBID_SHA3_384; - case CKM_SHA3_384_HMAC: - return TBID_SHA3_384_HMAC; - case CKM_SHA3_384_HMAC_GENERAL: - return TBID_SHA3_384_HMAC_GENERAL; - case CKM_SHA3_384_KEY_DERIVATION: - return TBID_SHA3_384_KEY_DERIVATION; - case CKM_SHA3_384_KEY_GEN: - return TBID_SHA3_384_KEY_GEN; - case CKM_SHA3_512: - return TBID_SHA3_512; - case CKM_SHA3_512_HMAC: - return TBID_SHA3_512_HMAC; - case CKM_SHA3_512_HMAC_GENERAL: - return TBID_SHA3_512_HMAC_GENERAL; - case CKM_SHA3_512_KEY_DERIVATION: - return TBID_SHA3_512_KEY_DERIVATION; - case CKM_SHA3_512_KEY_GEN: - return TBID_SHA3_512_KEY_GEN; - case CKM_ML_DSA_KEY_PAIR_GEN: - return TBID_ML_DSA_KEY_PAIR_GEN; - case CKM_ML_DSA: - return TBID_ML_DSA; - case CKM_HASH_ML_DSA: - return TBID_HASH_ML_DSA; - case CKM_HASH_ML_DSA_SHA224: - return TBID_HASH_ML_DSA_SHA224; - case CKM_HASH_ML_DSA_SHA256: - return TBID_HASH_ML_DSA_SHA256; - case CKM_HASH_ML_DSA_SHA384: - return TBID_HASH_ML_DSA_SHA384; - case CKM_HASH_ML_DSA_SHA512: - return TBID_HASH_ML_DSA_SHA512; - case CKM_HASH_ML_DSA_SHA3_224: - return TBID_HASH_ML_DSA_SHA3_224; - case CKM_HASH_ML_DSA_SHA3_256: - return TBID_HASH_ML_DSA_SHA3_256; - case CKM_HASH_ML_DSA_SHA3_384: - return TBID_HASH_ML_DSA_SHA3_384; - case CKM_HASH_ML_DSA_SHA3_512: - return TBID_HASH_ML_DSA_SHA3_512; - case CKM_HASH_ML_DSA_SHAKE128: - return TBID_HASH_ML_DSA_SHAKE128; - case CKM_HASH_ML_DSA_SHAKE256: - return TBID_HASH_ML_DSA_SHAKE256; - case CKM_ML_KEM_KEY_PAIR_GEN: - return TBID_ML_KEM_KEY_PAIR_GEN; - case CKM_ML_KEM: - return TBID_ML_KEM; - case CKM_SLH_DSA_KEY_PAIR_GEN: - return TBID_SLH_DSA_KEY_PAIR_GEN; - case CKM_SLH_DSA: - return TBID_SLH_DSA; - case CKM_HASH_SLH_DSA: - return TBID_HASH_SLH_DSA; - case CKM_HASH_SLH_DSA_SHA224: - return TBID_HASH_SLH_DSA_SHA224; - case CKM_HASH_SLH_DSA_SHA256: - return TBID_HASH_SLH_DSA_SHA256; - case CKM_HASH_SLH_DSA_SHA384: - return TBID_HASH_SLH_DSA_SHA384; - case CKM_HASH_SLH_DSA_SHA512: - return TBID_HASH_SLH_DSA_SHA512; - case CKM_HASH_SLH_DSA_SHA3_224: - return TBID_HASH_SLH_DSA_SHA3_224; - case CKM_HASH_SLH_DSA_SHA3_256: - return TBID_HASH_SLH_DSA_SHA3_256; - case CKM_HASH_SLH_DSA_SHA3_384: - return TBID_HASH_SLH_DSA_SHA3_384; - case CKM_HASH_SLH_DSA_SHA3_512: - return TBID_HASH_SLH_DSA_SHA3_512; - case CKM_HASH_SLH_DSA_SHAKE128: - return TBID_HASH_SLH_DSA_SHAKE128; - case CKM_HASH_SLH_DSA_SHAKE256: - return TBID_HASH_SLH_DSA_SHAKE256; - case CKM_AES_KEY_GEN: - return TBID_AES_KEY_GEN; - case CKM_AES_ECB: - return TBID_AES_ECB; - case CKM_AES_CBC: - return TBID_AES_CBC; - case CKM_AES_CBC_PAD: - return TBID_AES_CBC_PAD; - case CKM_AES_OFB: - return TBID_AES_OFB; - case CKM_AES_CFB128: - return TBID_AES_CFB128; - case CKM_AES_CFB1: - return TBID_AES_CFB1; - case CKM_AES_CFB8: - return TBID_AES_CFB8; - case CKM_AES_CTR: - return TBID_AES_CTR; - case CKM_AES_CTS: - return TBID_AES_CTS; - case CKM_AES_GCM: - return TBID_AES_GCM; - case CKM_AES_MAC: - return TBID_AES_MAC; - case CKM_AES_MAC_GENERAL: - return TBID_AES_MAC_GENERAL; - case CKM_AES_CCM: - return TBID_AES_CCM; - case CKM_AES_CMAC: - return TBID_AES_CMAC; - case CKM_AES_CMAC_GENERAL: - return TBID_AES_CMAC_GENERAL; - case CKM_AES_XCBC_MAC: - return TBID_AES_XCBC_MAC; - case CKM_AES_XCBC_MAC_96: - return TBID_AES_XCBC_MAC_96; - case CKM_AES_GMAC: - return TBID_AES_GMAC; - case CKM_CHACHA20_POLY1305: - return TBID_CHACHA20_POLY1305; - case CKM_GENERIC_SECRET_KEY_GEN: - return TBID_GENERIC_SECRET_KEY_GEN; + CASE_CKM_TO_TBID(RSA_PKCS_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(RSA_PKCS); + CASE_CKM_TO_TBID(SHA1_RSA_PKCS); + CASE_CKM_TO_TBID(SHA224_RSA_PKCS); + CASE_CKM_TO_TBID(SHA256_RSA_PKCS); + CASE_CKM_TO_TBID(SHA384_RSA_PKCS); + CASE_CKM_TO_TBID(SHA512_RSA_PKCS); + CASE_CKM_TO_TBID(SHA3_224_RSA_PKCS); + CASE_CKM_TO_TBID(SHA3_256_RSA_PKCS); + CASE_CKM_TO_TBID(SHA3_384_RSA_PKCS); + CASE_CKM_TO_TBID(SHA3_512_RSA_PKCS); + CASE_CKM_TO_TBID(RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA1_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA256_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA384_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA512_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA224_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA3_256_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA3_384_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA3_512_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(SHA3_224_RSA_PKCS_PSS); + CASE_CKM_TO_TBID(RSA_PKCS_OAEP); + CASE_CKM_TO_TBID(RSA_X_509); + CASE_CKM_TO_TBID(RSA_X9_31); + CASE_CKM_TO_TBID(RSA_X9_31_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(EC_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(ECDSA); + CASE_CKM_TO_TBID(ECDSA_SHA1); + CASE_CKM_TO_TBID(ECDSA_SHA224); + CASE_CKM_TO_TBID(ECDSA_SHA256); + CASE_CKM_TO_TBID(ECDSA_SHA384); + CASE_CKM_TO_TBID(ECDSA_SHA512); + CASE_CKM_TO_TBID(ECDSA_SHA3_224); + CASE_CKM_TO_TBID(ECDSA_SHA3_256); + CASE_CKM_TO_TBID(ECDSA_SHA3_384); + CASE_CKM_TO_TBID(ECDSA_SHA3_512); + CASE_CKM_TO_TBID(ECDH1_DERIVE); + CASE_CKM_TO_TBID(ECDH1_COFACTOR_DERIVE); + CASE_CKM_TO_TBID(EC_EDWARDS_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(EC_MONTGOMERY_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(EDDSA); + CASE_CKM_TO_TBID(HKDF_DERIVE); + CASE_CKM_TO_TBID(SHA_1); + CASE_CKM_TO_TBID(SHA_1_HMAC); + CASE_CKM_TO_TBID(SHA_1_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA1_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA_1_KEY_GEN); + CASE_CKM_TO_TBID(SHA224); + CASE_CKM_TO_TBID(SHA224_HMAC); + CASE_CKM_TO_TBID(SHA224_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA224_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA224_KEY_GEN); + CASE_CKM_TO_TBID(SHA256); + CASE_CKM_TO_TBID(SHA256_HMAC); + CASE_CKM_TO_TBID(SHA256_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA256_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA256_KEY_GEN); + CASE_CKM_TO_TBID(SHA384); + CASE_CKM_TO_TBID(SHA384_HMAC); + CASE_CKM_TO_TBID(SHA384_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA384_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA384_KEY_GEN); + CASE_CKM_TO_TBID(SHA512); + CASE_CKM_TO_TBID(SHA512_HMAC); + CASE_CKM_TO_TBID(SHA512_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA512_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA512_KEY_GEN); + CASE_CKM_TO_TBID(SHA512_224); + CASE_CKM_TO_TBID(SHA512_224_HMAC); + CASE_CKM_TO_TBID(SHA512_224_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA512_224_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA512_224_KEY_GEN); + CASE_CKM_TO_TBID(SHA512_256); + CASE_CKM_TO_TBID(SHA512_256_HMAC); + CASE_CKM_TO_TBID(SHA512_256_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA512_256_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA512_256_KEY_GEN); + CASE_CKM_TO_TBID(SHA512_T); + CASE_CKM_TO_TBID(SHA512_T_HMAC); + CASE_CKM_TO_TBID(SHA512_T_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA512_T_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA512_T_KEY_GEN); + CASE_CKM_TO_TBID(SHA3_224); + CASE_CKM_TO_TBID(SHA3_224_HMAC); + CASE_CKM_TO_TBID(SHA3_224_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA3_224_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA3_224_KEY_GEN); + CASE_CKM_TO_TBID(SHA3_256); + CASE_CKM_TO_TBID(SHA3_256_HMAC); + CASE_CKM_TO_TBID(SHA3_256_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA3_256_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA3_256_KEY_GEN); + CASE_CKM_TO_TBID(SHA3_384); + CASE_CKM_TO_TBID(SHA3_384_HMAC); + CASE_CKM_TO_TBID(SHA3_384_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA3_384_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA3_384_KEY_GEN); + CASE_CKM_TO_TBID(SHA3_512); + CASE_CKM_TO_TBID(SHA3_512_HMAC); + CASE_CKM_TO_TBID(SHA3_512_HMAC_GENERAL); + CASE_CKM_TO_TBID(SHA3_512_KEY_DERIVATION); + CASE_CKM_TO_TBID(SHA3_512_KEY_GEN); + CASE_CKM_TO_TBID(ML_DSA_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(ML_DSA); + CASE_CKM_TO_TBID(HASH_ML_DSA); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA224); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA256); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA384); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA512); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA3_224); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA3_256); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA3_384); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHA3_512); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHAKE128); + CASE_CKM_TO_TBID(HASH_ML_DSA_SHAKE256); + CASE_CKM_TO_TBID(ML_KEM_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(ML_KEM); + CASE_CKM_TO_TBID(SLH_DSA_KEY_PAIR_GEN); + CASE_CKM_TO_TBID(SLH_DSA); + CASE_CKM_TO_TBID(HASH_SLH_DSA); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA224); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA256); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA384); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA512); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA3_224); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA3_256); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA3_384); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHA3_512); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHAKE128); + CASE_CKM_TO_TBID(HASH_SLH_DSA_SHAKE256); + CASE_CKM_TO_TBID(AES_KEY_GEN); + CASE_CKM_TO_TBID(AES_ECB); + CASE_CKM_TO_TBID(AES_CBC); + CASE_CKM_TO_TBID(AES_CBC_PAD); + CASE_CKM_TO_TBID(AES_OFB); + CASE_CKM_TO_TBID(AES_CFB128); + CASE_CKM_TO_TBID(AES_CFB1); + CASE_CKM_TO_TBID(AES_CFB8); + CASE_CKM_TO_TBID(AES_CTR); + CASE_CKM_TO_TBID(AES_CTS); + CASE_CKM_TO_TBID(AES_GCM); + CASE_CKM_TO_TBID(AES_MAC); + CASE_CKM_TO_TBID(AES_MAC_GENERAL); + CASE_CKM_TO_TBID(AES_CCM); + CASE_CKM_TO_TBID(AES_CMAC); + CASE_CKM_TO_TBID(AES_CMAC_GENERAL); + CASE_CKM_TO_TBID(AES_XCBC_MAC); + CASE_CKM_TO_TBID(AES_XCBC_MAC_96); + CASE_CKM_TO_TBID(AES_GMAC); + CASE_CKM_TO_TBID(CHACHA20_POLY1305); + CASE_CKM_TO_TBID(GENERIC_SECRET_KEY_GEN); default: return -1; } From 3142ba482b8cca3f0bda7656d41025a1648af82d Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 10 Aug 2026 12:01:26 -0400 Subject: [PATCH 6/7] fixup! Consolidate initialization locking --- src/interface.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/interface.c b/src/interface.c index 8e0cd616..665e5384 100644 --- a/src/interface.c +++ b/src/interface.c @@ -373,6 +373,7 @@ CK_RV p11prov_module_init(P11PROV_CTX *ctx) p11prov_ctx_set_slots(mctx->provctx, slots); p11prov_ctx_set_status(ctx, P11PROV_OPS_NEEDS_INIT); + mctx->initialized = true; ret = CKR_OK; done: From e5ba3d37d26c6594695cc0e75c7504009a18f2a0 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 10 Aug 2026 12:06:43 -0400 Subject: [PATCH 7/7] fixup! Modularize algorithm registration --- src/registration.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/registration.h b/src/registration.h index 1a7e5475..d35e1fd9 100644 --- a/src/registration.h +++ b/src/registration.h @@ -435,7 +435,7 @@ CK_RV p11prov_get_mech_state_table(P11PROV_CTX *ctx, bool available[TBID_SIZE]); #define P11PROV_DESCS_SHA512_224 "PKCS11 SHA2-512/224 Implementation" #define P11PROV_NAMES_SHA512_256 \ "SHA2-512/256:SHA-512/256:SHA512-256:2.16.840.1.101.3.4.2.6" -#define P11PROV_DESCS_SHA512_256 "PKCS11 SHA2-512/224 Implementation" +#define P11PROV_DESCS_SHA512_256 "PKCS11 SHA2-512/256 Implementation" #define P11PROV_NAMES_SHA3_224 "SHA3-224:2.16.840.1.101.3.4.2.7" #define P11PROV_DESCS_SHA3_224 "PKCS11 SHA3-224 Implementation" #define P11PROV_NAMES_SHA3_256 "SHA3-256:2.16.840.1.101.3.4.2.8"