p11

Documentation

Index

• type AttributeInfo
• type Token
  • func NewToken(lib, tokenLabel, pin string) (Token, error)
• type TokenCtx

Types

type AttributeInfo

type AttributeInfo struct {
	// contains filtered or unexported fields
}

AttributeInfo contains information about how to print/display an attribute

type Token

type Token interface {
	// Checksum calculates a checksum value for an AES key. A block of zeroes is encrypted in CBC-mode with a zero IV.
	Checksum(keyLabel string) ([]byte, error)

	// ImportKey imports an AES key and applies a label.
	ImportKey(keyBytes []byte, label string) error

	// DeleteAllExcept deletes all keys on the token except those with a label specified.
	DeleteAllExcept(keyLabels []string) error

	// PrintObjects prints all objects in the token if label is nil, otherwise it prints only the objects with that
	// label
	PrintObjects(label *string) error

	// GenerateKey creates a new RSA or AES or EC key of the given size in the token
	GenerateKeyPair(label string, keyid string, algorithm string, keytype string, keysize int) error

	// GenerateKey creates a new RSA or AES key of the given size in the token
	GetPublicKey(label string, keyid string) (publicKey *ecdsa.PublicKey, keyBytes []byte, err error)

	// Sign returns a signature using the in-built curve
	Sign(label string, keyid string, hash []byte) (signature []byte, err error)

	// Verify checks the provided hash against the provisioned address
	Verify(label string, keyid string, hash []byte, signature []byte) (err error)

	// PrintMechanisms prints mechanism info for all supported mechanisms.
	PrintMechanisms() error

	// Finalise closes the library and unloads it.
	Finalise() error
}

Token provides a high level interface to a P11 token.

func NewToken

func NewToken(lib, tokenLabel, pin string) (Token, error)

NewToken connects to a PKCS#11 token and creates a logged in, ready-to-use interface. Call Finalize() on the return object when finished.

type TokenCtx

type TokenCtx interface {
	CloseSession(sh pkcs11.SessionHandle) error
	CreateObject(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) (pkcs11.ObjectHandle, error)
	Destroy()
	DestroyObject(sh pkcs11.SessionHandle, oh pkcs11.ObjectHandle) error
	Encrypt(sh pkcs11.SessionHandle, message []byte) ([]byte, error)
	EncryptInit(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, o pkcs11.ObjectHandle) error
	Finalize() error
	FindObjects(sh pkcs11.SessionHandle, max int) ([]pkcs11.ObjectHandle, bool, error)
	FindObjectsFinal(sh pkcs11.SessionHandle) error
	FindObjectsInit(sh pkcs11.SessionHandle, temp []*pkcs11.Attribute) error
	GenerateKey(sh pkcs11.SessionHandle, mech []*pkcs11.Mechanism, temp []*pkcs11.Attribute) (pkcs11.ObjectHandle, error)
	GenerateKeyPair(sh pkcs11.SessionHandle, mech []*pkcs11.Mechanism, public, private []*pkcs11.Attribute) (pkcs11.ObjectHandle, pkcs11.ObjectHandle, error)
	GetAttributeValue(sh pkcs11.SessionHandle, o pkcs11.ObjectHandle, a []*pkcs11.Attribute) ([]*pkcs11.Attribute, error)
	GetSlotList(tokenPresent bool) ([]uint, error)
	GetTokenInfo(slotID uint) (pkcs11.TokenInfo, error)
	Initialize() error
	SignInit(sh pkcs11.SessionHandle, m []*pkcs11.Mechanism, o pkcs11.ObjectHandle) error
	Sign(sh pkcs11.SessionHandle, message []byte) ([]byte, error)
	Login(sh pkcs11.SessionHandle, userType uint, pin string) error
	OpenSession(slotID uint, flags uint) (pkcs11.SessionHandle, error)
	GetMechanismList(slotID uint) ([]*pkcs11.Mechanism, error)
	GetMechanismInfo(slotID uint, m []*pkcs11.Mechanism) (pkcs11.MechanismInfo, error)
}

TokenCtx contains the functions we use from github.com/miekg/pkcs11.