Developer's Guide
 All Classes Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
ex-pkcs11-2.c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <memory.h>
#include "pkcs11.h"
#include "pkcs11p6r.h" // optional, only needed if using P6R vendor extensions
// *** For this example to work Example #1 must be run successfully first. ***
// Copy the following files from example 1 into example 2: PKCS11, PKCS11.sig, pkcs11baseKey.txt
// ***
//
// Example 1 initializes the token with the Security Officer and normal user accounts.
//
int main(int argc,char *argv[])
{
CK_C_INITIALIZE_ARGS initArgs;
CK_SLOT_INFO oneSlot;
CK_DATE start;
CK_DATE end;
CK_ATTRIBUTE keyTemplate[10];
CK_ATTRIBUTE changeTemplate[5];
CK_UTF8CHAR label[50];
CK_UTF8CHAR label2[50];
CK_SLOT_ID_PTR pSlotList = NULL_PTR;
CK_UTF8CHAR_PTR pUserPin = NULL_PTR;
CK_OBJECT_CLASS objClass = 0;
CK_KEY_TYPE keyType = 0;
CK_BBOOL bTFlag = CK_TRUE;
CK_OBJECT_HANDLE hKey = 0;
CK_SESSION_HANDLE hSession = 0;
CK_FLAGS flags = 0;
CK_ULONG ulSlotCount = 0;
CK_ULONG i = 0;
CK_ULONG j = 0;
CK_RV rv = 0;
int match = 0;
// [A] We must first initialize the entire PKCS 11 library
memset( &initArgs, 0, sizeof( CK_C_INITIALIZE_ARGS ));
initArgs.flags = CKF_OS_LOCKING_OK; // -> let PKCS11 use its own locking
if (CKR_OK != (rv = C_Initialize( &initArgs ))) {
printf( "PKCS11 example2: failed C_Initialize (error:%lx)", rv );
return -1;
}
// [B] What slots are defined (see p6pkcs11.conf file)
if (CKR_OK == (rv = C_GetSlotList( CK_FALSE, NULL_PTR, &ulSlotCount )))
{
if (NULL_PTR == (pSlotList = (CK_SLOT_ID_PTR) malloc( ulSlotCount * sizeof( CK_SLOT_ID )))) {
printf( "PKCS11 example2: memory allocation failed" );
return -2;
}
// -> find the slot we want to work on by its description
if (CKR_OK == (rv = C_GetSlotList( CK_FALSE, pSlotList, &ulSlotCount )))
{
for( i=0; i < ulSlotCount; i++ )
{
if (CKR_OK == (rv = C_GetSlotInfo( pSlotList[i], (CK_SLOT_INFO_PTR)&oneSlot )))
{
// -> slot description field is a fixed 64 characters long and is not NULL terminated
match = strncmp( (const char*)oneSlot.slotDescription, "KMIP SLOT1 ", 64 );
if (0 == match)
{
// The normal user must login before he can save a key onto the token
// -> most things on a token require that we first create a session to the token in the slot
flags = CKF_SERIAL_SESSION | CKF_RW_SESSION;
if (CKR_OK != (rv = C_OpenSession( pSlotList[i], flags, NULL, NULL, &hSession ))) {
printf( "PKCS11 example2: slot %ld failed to open a session (error:%lx)", pSlotList[i], rv );
break;
}
// Here the client creates an AES key and then saves it onto the token
pUserPin = (CK_UTF8CHAR_PTR)"roggerrabbit";
if (CKR_OK == (rv = C_Login( hSession, CKU_USER, pUserPin, 12 )))
{
// CREATE the AES key with whatever crypto library you use and place that value into the keyBytes buffer
// -> here we just use fake data for the test, you can replace this
CK_BYTE keyBytes[100];
CK_ULONG keySizeInBytes = 32; // -> 32 bytes is 256 bit AES key
for( j=0; j < 32; j++ ) keyBytes[j] = (CK_BYTE)j+15;
objClass = CKO_SECRET_KEY;
keyType = CKK_AES;
strncpy( (char*) label, "An AES secret key object", 24 );
keyTemplate[0].type = CKA_CLASS;
keyTemplate[0].pValue = &objClass;
keyTemplate[0].ulValueLen = sizeof(CK_OBJECT_CLASS);
keyTemplate[1].type = CKA_KEY_TYPE;
keyTemplate[1].pValue = &keyType;
keyTemplate[1].ulValueLen = sizeof(CK_KEY_TYPE);
keyTemplate[2].type = CKA_TOKEN;
keyTemplate[2].pValue = &bTFlag;
keyTemplate[2].ulValueLen = sizeof(CK_BBOOL);
keyTemplate[3].type = CKA_LABEL;
keyTemplate[3].pValue = &label;
keyTemplate[3].ulValueLen = 24;
keyTemplate[4].type = CKA_ENCRYPT;
keyTemplate[4].pValue = &bTFlag;
keyTemplate[4].ulValueLen = sizeof(CK_BBOOL);
keyTemplate[5].type = CKA_DECRYPT;
keyTemplate[5].pValue = &bTFlag;
keyTemplate[5].ulValueLen = sizeof(CK_BBOOL);
keyTemplate[6].type = CKA_VALUE;
keyTemplate[6].pValue = (CK_VOID_PTR)keyBytes;
keyTemplate[6].ulValueLen = keySizeInBytes;
if ( CKR_OK != (rv = C_CreateObject( hSession, (CK_ATTRIBUTE_PTR)keyTemplate, 7, &hKey )))
{
printf( "PKCS11 example2: slot %ld failed to store key on token (error:%lx)", pSlotList[i], rv );
}
else
{ // -> show how to add the start/end date attributes to the key on the token, and modify an attribute CKA_LABEL at the same time
start.year[0] = '2'; start.year[1] = '0'; start.year[2] = '1'; start.year[3] = '5';
start.month[0] = '1'; start.month[1] = '1';
start.day[0] = '1'; start.day[1] = '6';
end.year[0] = '2'; end.year[1] = '0'; end.year[2] = '1'; end.year[3] = '6';
end.month[0] = '1'; end.month[1] = '1';
end.day[0] = '0'; end.day[1] = '2';
strncpy( (char*)label2, "An updated AES secret key object on token", 41 );
changeTemplate[0].type = CKA_START_DATE;
changeTemplate[0].pValue = &start;
changeTemplate[0].ulValueLen = sizeof(CK_DATE);
changeTemplate[1].type = CKA_END_DATE;
changeTemplate[1].pValue = &end;
changeTemplate[1].ulValueLen = sizeof(CK_DATE);
changeTemplate[2].type = CKA_LABEL;
changeTemplate[2].pValue = label2;
changeTemplate[2].ulValueLen = 41;
if (CKR_OK != (rv = C_SetAttributeValue( hSession, hKey, (CK_ATTRIBUTE_PTR)changeTemplate, 3 ))) {
printf( "PKCS11 example2: slot %ld failed to update key on token (error:%lx)", pSlotList[i], rv );
}
}
if (CKR_OK != (rv = C_Logout( hSession ))) {
printf( "PKCS11 example2: slot %ld failed to logout of token (error:%lx)", pSlotList[i], rv );
}
}
// Now we are done we have to close the session to the token
if (CKR_OK != (rv = C_CloseSession( hSession ))) {
printf( "PKCS11 example2: slot %ld failed to close an active token session (error:%lx)", pSlotList[i], rv );
break;
}
}
else {
printf( "PKCS11 example2: slot %ld failed to log user into token (error:%lx)", pSlotList[i], rv );
}
}
}
}
}
// [C] At the end we must tell the library we are done
if (NULL_PTR != pSlotList) free( pSlotList );
if (CKR_OK != (rv = C_Finalize( NULL_PTR ))) {
printf( "PKCS11 example2: failed C_Finalize %lx", rv );
return -3;
}
return 0;
}