ex-pkcs11-4.c

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <memory.h>       
#include "pkcs11.h"
#include "pkcs11p6r.h"    // optional, only needed if using P6R vendor extensions


// *** For this example to work Example #1 must be run successfully first. ***
// Copy the following files from example 1 into example 4: PKCS11, PKCS11.sig, pkcs11baseKey.txt,
// so that they don't have to be created for each example.
// ***
// Example 1 initializes the token with the Security Officer and normal user accounts.
//
int main(int argc,char *argv[])
{
   CK_C_INITIALIZE_ARGS initArgs;
   CK_SLOT_INFO         oneSlot;
   CK_MECHANISM         oneMech;
   CK_ATTRIBUTE         keyTemplate[5];
   CK_ATTRIBUTE         getTemplate[10];
   CK_UTF8CHAR          label[50];
   CK_UTF8CHAR          label2[50];
   CK_BYTE              keyMaterial[50];
   CK_SLOT_ID_PTR       pSlotList      = NULL_PTR;
   CK_UTF8CHAR_PTR      pUserPin       = NULL_PTR;
   CK_OBJECT_HANDLE     hKey           = 0;
   CK_SESSION_HANDLE    hSession       = 0;
   CK_OBJECT_CLASS      keyClass       = 0;
   CK_KEY_TYPE          getKeyType     = 0;  
   CK_BBOOL             bTFlag         = CK_TRUE;
   CK_BBOOL             bUsage         = CK_FALSE;
   CK_FLAGS             flags          = 0;
   CK_ULONG             ulSlotCount    = 0;
   CK_ULONG             keyLength      = 0;
   CK_ULONG             materialLength = 0;
   CK_ULONG             i              = 0;
   CK_RV                rv             = 0;
   int                  match          = 0;

   // [A] We must first initialize the entire PKCS 11 library
   memset( &initArgs, 0, sizeof( CK_C_INITIALIZE_ARGS ));
   initArgs.flags = CKF_OS_LOCKING_OK;         // -> let PKCS11 use its own locking

   if (CKR_OK != (rv = C_Initialize( &initArgs ))) {
      printf( "PKCS11 example4: failed C_Initialize (error:%lx)", rv );
      return -1;
   }


   // [B] What slots are defined (see p6pkcs11.conf file)
   if (CKR_OK == (rv = C_GetSlotList( CK_FALSE, NULL_PTR, &ulSlotCount )))
   {
      if (NULL_PTR == (pSlotList = (CK_SLOT_ID_PTR) malloc( ulSlotCount * sizeof( CK_SLOT_ID )))) {
         printf( "PKCS11 example4: memory allocation failed" );
          return -2;
      }

      // -> (re-)initialize a particular slot by its description (or all defined slots if desired)
       if (CKR_OK == (rv = C_GetSlotList( CK_FALSE, pSlotList, &ulSlotCount )))
      {
         for( i=0; i < ulSlotCount; i++ )
         {
           if (CKR_OK == (rv = C_GetSlotInfo( pSlotList[i], (CK_SLOT_INFO_PTR)&oneSlot )))
           {
              // -> slot description field is a fixed 64 characters long and is not NULL terminated
              match = strncmp( (const char*)oneSlot.slotDescription, "KMIP SLOT1                                                      ", 64 );
              if (0 == match)
              {
                 // The normal user must login before he can save a key onto the token
                 // -> most things on a token require that we first create a session to the token in the slot
                      flags = CKF_SERIAL_SESSION | CKF_RW_SESSION;
                 if (CKR_OK != (rv = C_OpenSession( pSlotList[i], flags, NULL, NULL, &hSession ))) {
                    printf( "PKCS11 example4: slot %ld failed to open a session (error:%lx)", pSlotList[i], rv );
                    break;
                 }

                 // Logging into the token in slot pSlotList[i] as the SO 
                      pUserPin = (CK_UTF8CHAR_PTR)"roggerrabbit";
                      if (CKR_OK == (rv = C_Login( hSession, CKU_USER, pUserPin, 12 )))
                 {
                    oneMech.mechanism      = CKM_AES_KEY_GEN;
                    oneMech.pParameter     = NULL_PTR;
                    oneMech.ulParameterLen = 0;
                    keyLength = 16;  // in bytes
                    materialLength = sizeof(keyMaterial);
                    strncpy( (char*)label, "AES key Generated by the token", 30 );

                          keyTemplate[0].type       = CKA_TOKEN;
                          keyTemplate[0].pValue     = &bTFlag;
                          keyTemplate[0].ulValueLen = sizeof(CK_BBOOL);
                          keyTemplate[1].type       = CKA_LABEL;
                          keyTemplate[1].pValue     = label;
                          keyTemplate[1].ulValueLen = 30;
                    keyTemplate[2].type       = CKA_VALUE_LEN;
                          keyTemplate[2].pValue     = &keyLength;
                          keyTemplate[2].ulValueLen = sizeof(CK_ULONG);                  
                    keyTemplate[3].type       = CKA_ENCRYPT;
                          keyTemplate[3].pValue     = &bTFlag;
                          keyTemplate[3].ulValueLen = sizeof(CK_BBOOL);
                    keyTemplate[4].type       = CKA_DECRYPT;
                          keyTemplate[4].pValue     = &bTFlag;
                          keyTemplate[4].ulValueLen = sizeof(CK_BBOOL);
                    if ( CKR_OK != (rv = C_GenerateKey( hSession, &oneMech, (CK_ATTRIBUTE_PTR)keyTemplate, 5, &hKey )))
                    {
                         printf( "PKCS11 example4: slot %ld failed to generate key on token (error:%lx)", pSlotList[i], rv );
                    }
                          else
                    {    // -> now get the generated key bytes from the server
                              getTemplate[0].type       = CKA_CLASS;
                               getTemplate[0].pValue     = &keyClass;
                               getTemplate[0].ulValueLen = sizeof(CK_OBJECT_CLASS);
                               getTemplate[1].type       = CKA_LABEL;
                               getTemplate[1].pValue     = label2;
                               getTemplate[1].ulValueLen = sizeof(label2)-1;
                         getTemplate[2].type       = CKA_VALUE;
                               getTemplate[2].pValue     = keyMaterial;
                               getTemplate[2].ulValueLen = materialLength;                  
                         getTemplate[3].type       = CKA_ENCRYPT;
                               getTemplate[3].pValue     = &bUsage;
                               getTemplate[3].ulValueLen = sizeof(CK_BBOOL);
                         getTemplate[4].type       = CKA_KEY_TYPE;
                               getTemplate[4].pValue     = &getKeyType;
                               getTemplate[4].ulValueLen = sizeof(CK_KEY_TYPE);
                          if ( CKR_OK != (rv = C_GetAttributeValue( hSession, hKey, (CK_ATTRIBUTE_PTR)getTemplate, 5 ))) 
                        {
                           printf( "PKCS11 example4: slot %ld failed to get key attributes (error:%lx)", pSlotList[i], rv );
                        }
                        else
                        {    // -> key material is available here
                             // -> key is now available on server to perform a C_Encrypt / C_Decrypt set of operations
                             ;
                        }
                    }
                                      
                    if (CKR_OK != (rv = C_Logout( hSession ))) {
                         printf( "PKCS11 example4: slot %ld failed to logout of token (error:%lx)", pSlotList[i], rv );
                    }
                 }

                 // Now we are done we have to close the session to the token
                 if (CKR_OK != (rv = C_CloseSession( hSession ))) {
                    printf( "PKCS11 example4: slot %ld failed to close an active token session (error:%lx)", pSlotList[i], rv );
                    break;
                 }
              }
           }

         }
      }
   }


   // [C] At the end we must tell the library we are done
   if (NULL_PTR != pSlotList) free( pSlotList );

   if (CKR_OK != (rv = C_Finalize( NULL_PTR ))) {
      printf( "PKCS11 example4: failed C_Finalize %lx", rv );
      return -3;
   }

   return 0;
}