Configuring Token-Keyslot Restrictions#

This section describes restricting keyslots available to a token.

Keyslots Usage#

Security engines store cryptographic symmetric keys in keyslots and perform certain operations on the keys before releasing these loaded keyslots.

  1. AES Keyslots are loaded for the following PKCS11 APIs:

    • C_EncryptInit

    • C_DecryptInit

    • C_SignInit

    • C_VerifyInit

    • C_MessageEncryptInit

    • C_MessageDecryptInit

    • C_MessageSignInit

    • C_MessageVerifyInit

  2. AES Keyslots are released in the below scenarios:

    • The operation successfully terminates (for example, C_DecryptFinal)

    • When the operation is cancelled (for example, C_SessionCancel, C_CloseSession)

    • When an error happens (for example, the wrong length is passed in)

Support restricting the number of AES keyslots that are available to be used by a particular token, for serving the following reasons:

  1. Security : Reduce the impact of a compromised application on a particular token holding of all the keyslots.

  2. Safety : Ensure that keyslots are available to safety applications even in the presence of a compromised QM application

for cryptographic purposes.

  1. Performance : Allocate enough keyslots for better performance of intensive SE use applications (ex: Camera, sensor etc).

PCT Configuration#

Maximum number of AES keyslots available for usage for all tokens can be restricted through PCT. Any request to reserve a keyslot beyond the configured maximum number of keyslots would be denied.

Each token can be configured by adding an entry in the se_keyslot_cfg.token_keyslot_cfg array. The tokenId is specified in the mapping described in the PKCS#11 – Implementation Details.

Each entry is described as below:

token_keyslot_cfg[i] = {tokenId, max. number of GPSE keyslots, max. number of GC-SE1 keyslots, max. number of GC-SE2 keyslots}

Each token has access to keyslots on the GPSE, GC-SE1 and GC-SE2. The configuration allows to set the maximum number of keyslots for each of these engines. If the maximum number of keyslots for a SE is set to 16, then the applications on this token can reserve and use all the available keyslots.

Sample PCT configuration fragment:

.num_tokens = 3,
.token_keyslot_cfg[0] = {3U, // Id of the TOKEN that needs to be configured.
                    1U, // Maximum number of GPSE keyslots available to the token.
                    8U, // Maximum number of GC-SE1 keyslots available to the token.
                    8U}, // Maximum number of GC-SE2 keyslots available to the token.
.token_keyslot_cfg[1] = {4U,
                    16U, // This indicates that token-4 will have all GPSE keyslots available.
                    16U, // This indicates that token-4 will have all GC-SE1 keyslots available.
                    16U}, // This indicates that token-4 will have all GC-SE2 keyslots available.
.token_keyslot_cfg[2] = {7U,
                    0U, // This indicates that token-7 will have NO GPSE keyslots available.
                    0U, // This indicates that token-7 will have NO GC-SE1 keyslots available.
                    0U}, // This indicates that token-7 will have NO GC-SE2 keyslots available.