PKCS#11 – Sample Application
PKCS#11 library includes sample application code for customer reference to demonstrate use of the following:
- C_GetSlotList to find the slot and token you require.
- C_GetTokenInfo to obtain information about a particular token, token status, and the status of a token's secure storage.
- NVIDIA channel extension APIs C_NVIDIA_InitializeChannel, C_NVIDIA_OpenSession and C_NVIDIA_FinalizeChannel to redirect digest operation on to TZ-SE (QNX only) and to redirect sign and verify operations with CKM_SHA256_HMAC on to a SHA engine (QNX only).
- C_UnwrapKey to provision a wrapped key using CKM_NVIDIA_AES_GCM_KEY_UNWRAP.
- Wrap and unwrap a key using CKM_AES_CBC and retrieval of the IV generated during the wrap operation (the same IV is required to successfully unwrap the key).
- CKM_NVIDIA_AES_CBC_KEY_DATA_WRAP mechanism with a CK_NVIDIA_AES_CBC_KEY_DATA_WRAP_PARAMS mechanism parameter to wrap either one secret key, or a pair of secret keys with custom data interleaved between the two.
- Commit a key to secure storage using C_NVIDIA_CommitTokenObjects.
- Encrypt with CKM_AES_GCM and retrieval of the IV generated during the encrypt operation with C_NVIDIA_EncryptGetIV.
- Mechanisms:
- CKM_EDDSA
- CKM_SP800_108_COUNTER_KDF
- CKM_SHA256
- CKM_SHA512
- CKM_SHA256_HMAC (QNX only)
- CKM_NVIDIA_SP800_56C_TWO_STEPS_KDF
- CKM_AES_GCM
- CKM_AES_CMAC
- CKM_AES_CBC
- CKM_AES_KEY_GEN
- CKM_NVIDIA_AES_CBC_KEY_DATA_WRAP
- CKM_NVIDIA_AES_GCM_KEY_UNWRAP
Refer to the following README for instructions to build the sample application, pkcs11_reference_application:
samples/nvpkcs11/external/README